Searching in the session database
Searching in connection content
Generate and retrieve screenshot for content search
The api/audit/sessions endpoint lists the recorded sessions (active and closed).
GET https://<IP-address-of-SPS>/api/audit/sessions
Cookie name | Description | Required | Values |
---|---|---|---|
session_id | Contains the authentication token of the user | Required |
The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API. Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format). |
The following command lists the connections.
curl --cookie cookies https://<IP-address-of-SPS>/api/audit/sessions
The following command retrieves the properties of a specific connection.
curl --cookie cookies https://<IP-address-of-SPS>/api/audit/sessions/<session-id>
The following is a sample response received when listing connections.
For details of the meta object, see Message format.
{ "items": [ { "key": "2", "meta": { "href": "/api/audit/sessions/2" } }, { "key": "1", "meta": { "href": "/api/audit/sessions/1" } } ], "meta": { "fields": [], "first": "/api/audit/sessions?limit=500&offset=0&fields=", "href": "/api/audit/sessions", "last": "/api/audit/sessions?limit=500&offset=0&fields=", "limit": 500, "match_count": 39, "next": null, "offset": 0, "parent": "/api/audit", "previous": null } }
When retrieving the endpoint of a specific connection, the response is the following.
{ "body": { "active": false, "alerts": { "href": "/api/audit/sessions/rUhhQZ3jYsY1NDWYp9DEpq/alerts" }, "analytics": { "interesting_events": [], "scripted": false, "scripted_results": {}, "similar_sessions": [], "tags": [] }, "channels": { "href": "/api/audit/sessions/rUhhQZ3jYsY1NDWYp9DEpq/channels" }, "client": { "ip": "10.20.30.40", "name": "10.20.30.40", "port": 59125 }, "creation_time": "2018-11-14T12:26:59.244Z", "duration": 57, "end_time": "2018-09-15T14:22:00+05:00", "events": { "href": "/api/audit/sessions/rUhhQZ3jYsY1NDWYp9DEpq/events" }, "hidden": false, "indexing": { "href": "/api/audit/sessions/rUhhQZ3jYsY1NDWYp9DEpq/indexing" }, "node_id": "6fed7872-065e-41d2-9cfa-ba75e8cad901", "origin": "RECORDING", "phantom": false, "protocol": "SSH", "recording": { "archived": false, "audit_trail": { "archive": null, "download": { "href": "/api/audit/sessions/rUhhQZ3jYsY1NDWYp9DEpq/audit_trail" } }, "auth_method": "password", "channel_policy": "shell-only", "command_extracted": false, "connection_policy": "myconnectionpolicy", "connection_policy_id": "15682863055beac3c8d23bf", "content_reference_id": 30, "has_accepted_channel": true, "index_status": "INDEXED", "server_local": { "ip": "10.20.30.40", "name": "10.20.30.40", "port": 55386 }, "session_id": "svc/rUhhQZ3jYsY1NDWYp9DEpq/abcde:29", "target": { "ip": "10.20.30.40", "name": "10.20.30.40", "port": 221 }, "verdict": "Accepted", "window_title_extracted": false }, "revision": 15, "server": { "ip": "10.20.30.40", "name": "10.20.30.40", "port": 22 }, "start_time": "2018-09-15T15:53:00+05:00", "user": { "id": "myid", "name": "myname", "server_username": "myserver" }, "verdict": "ACCEPT" }, "key": "rUhhQZ3jYsY1NDWYp9DEpq", "meta": { "href": "/api/audit/sessions/rUhhQZ3jYsY1NDWYp9DEpq", "parent": "/api/audit/sessions", "remaining_seconds": 594 } }
Element | Type | Description | ||
---|---|---|---|---|
key | string | Top level element, contains the key of the connection or audit trail. | ||
body | Top level element (string) | Contains the properties of the connection. | ||
active | boolean | If the returned value is true, the connection is ongoing. | ||
alerts | Top level item |
Contains a link to the details of the alerts. For details, see Session alerts. An event is listed as alert only if the Actions > Store in Connection Database option is selected in the Content Policy used to handle the session. "alerts": { "href": "/api/audit/sessions/7930f4308efe8aecd710202d815b76ff/alerts" }, | ||
analytics | Top level item | Contains analytics details of the connection. | ||
channels | Top level list |
Contains a link to the details of the channel. "channels": { "href": "/api/audit/sessions/svc-rUhhQZ3jYsY1NDWYp9DEpq-kecske-29/channels" }, | ||
client | Top level item | The IP address and port number of the client. | ||
creation_time | date | The time this document was created. In optimal cases this is near equal to the session's original start_time. However, it can be later than start_time. | ||
duration | int | The duration of the session in seconds. Computed value. | ||
end_time | ISO 8601 date |
The timestamp of the end of the connection. For ongoing connection, the value is null. Starting with SPS 5 LTS, the timestamp is in ISO 8601 format, for example, 2018-10-11T09:23:38.000+02:00. In earlier versions, it was in UNIX timestamp format. | ||
events | Top level item |
Contains a link to the details of the events. For details, see Session events. "events": { "href": "/api/audit/sessions/7930f4308efe8aecd710202d815b76ff/events" }, | ||
hidden | boolean | True if this is a session that has not been displayed on the SPS GUI yet (due to fragmented data about the session). | ||
indexer | Top level item |
Contains the details of indexing. For details on configuring indexing, see Local services: configuring the indexer. "indexer": { "href": "/api/audit/sessions/rUhhQZ3jYsY1NDWYp9DEpq/indexer" }, | ||
node_id | string | The node ID of the SPS machine where this session has been recorded. | ||
origin | string |
How SPA received this session. The following values are possible:
| ||
protocol | string | The protocol of the connection. | ||
recording | Top level item | Contains the properties of the audit trail. | ||
archived | boolean | If the audit trail has been archived, this value is true, otherwise it is false. For details about the archiving, see the archive object of the psm.audit_trail field. | ||
audit_trail | Top level item | The path to the audit trail file on SPS. If the session does not have an audit trail, this element is not used. To download the audit trail, see Download audit trails. | ||
auth_method | Top level item |
Authentication method: The authentication method used in the connection. For example, password | ||
channel_policy | string | References the name of the channel policy. You can find the list of channel policies for each protocol at the /api/configuration/<protocol>/channel_policies/ endpoint. | ||
command_extracted | boolean | If commands have been extracted from this terminal session, this value is true, otherwise it is false. The extracted commands are available in the events object field. | ||
connection_policy | string | The name of the Connection Policy that handled the session, for example, ssh_gateway_auth. This is the name displayed on the Control > Connections page of the SPS web interface, and in the name field of the Connection Policy object. You can find the list of connection policies for each protocol at the /api/configuration/<protocol>/connections/ endpoint. | ||
connection_policy_id | string | The key of the Connection Policy that handled the session, for example, 54906683158e768e727100. You can find the list of connection policies for each protocol at the /api/configuration/<protocol>/connections/ endpoint. | ||
content_reference_id | long | The unique ID of the TCP connection. | ||
has_accepted_channel | boolean | True, if at least the connection has been built successfully, the authentication was successful, and there was actual traffic. | ||
index_status | string |
Channel's indexing status: Shows if the channel has been indexed. The following values are possible:
| ||
network_id | string | The ID of the Linux network namespace where the session originated from. | ||
server_local | Top level item | The IP address and port number of SPS. | ||
session_id | string | The identifier of the session. | ||
target | Top level item | The IP address and port number the client targeted for connection. | ||
verdict | string |
The connection verdict. Possible values are:
| ||
window_title_extracted | boolean | If window titles have been extracted from this graphical session, this value is true, otherwise it is false. The extracted window titles are available in the events object field. | ||
revision | int | The revision number of the document. A newer document has a larger revision number than an older one. This helps you to determine which session version is newer. | ||
server | Top level item | The IP address and port number of the remote server. | ||
trail_downloads | Top level item |
Contains a link to the details of the audit-trail downloads in this session (if any). "trail_downloads": { "href": "/api/audit/sessions/rUhhQZ3jYsY1NDWYp9DEpq/trail_downloads" }, | ||
start_time | ISO 8601 date |
The timestamp of the start of the connection. Starting with SPS 5 LTS, the timestamp is in ISO 8601 format, for example, 2018-10-11T09:23:38.000+02:00. In earlier versions, it was in UNIX timestamp format. | ||
user | Top level item | The details of the user authenticating on the remote server. | ||
id | string | The ID of the user. | ||
name | string | The username used for authenticating against the gateway. | ||
server_username | string | The username used for authenticating on the remote server. | ||
verdict | string | Indicates what SPS decided about the session. A session verdict that originates from log events or other external events. |
All possible SSH channel types:
"channels": [ { "key": "1", "meta": { "href": "/api/audit/sessions/1/channels/1" }, "body": { "type": "session shell", "verdict": "accept", "start_time": 1451901988, "end_time": 1451902145, "duration": 157 } }, { "key": "2", "meta": { "href": "/api/audit/sessions/1/channels/2" }, "body": { "type": "session exec", "verdict": "accept", "start_time": 1451902141, "end_time": 1451902145, "duration": 4, "command": "ls" } }, { "key": "3", "meta": { "href": "/api/audit/sessions/1/channels/3" }, "body": { "type": "session exec scp", "verdict": "accept", "start_time": 1451902141, "end_time": 1451902145, "duration": 4, "scp_path": "<path-to-folder>" } }, { "key": "4", "meta": { "href": "/api/audit/sessions/1/channels/4" }, "body": { "type": "session subsystem sftp", "verdict": "accept", "start_time": 1451902142, "end_time": 1451902145, "duration": 3, "subsystem_name": "sftp" } }, { "key": "5", "meta": { "href": "/api/audit/sessions/1/channels/5" }, "body": { "type": "local forward", "verdict": "accept", "start_time": 1451902145, "end_time": 1451902146, "duration": 1, "originator.address": "::1", "originator.port": 59578, "connected.address": "<server>", "connected.port": 22 } }, { "key": "6", "meta": { "href": "/api/audit/sessions/1/channels/6" }, "body": { "type": "remote forward", "verdict": "accept", "start_time": 1451902145, "end_time": 1451902146, "duration": 1, "originator.address": "::1", "originator.port": 42212, "connected.address": "localhost", "connected.port": 9898 } }, { "key": "7", "meta": { "href": "/api/audit/sessions/1/channels/7" }, "body": { "type": "x11 forward", "verdict": "deny", "start_time": 1451902149, "end_time": 1451902149, "duration": 0 } } ]
All possible RDP channel types:
"channels": [ { "key": "1", "meta": { "href": "/api/audit/sessions/1/channels/1" }, "body": { "type": "drawing", "verdict": "accept", "start_time": 1451901988, "end_time": 1451902145, "duration": 157 } }, { "key": "2", "meta": { "href": "/api/audit/sessions/1/channels/2" }, "body": { "type": "sound", "verdict": "accept", "start_time": 1451902141, "end_time": 1451902145, "duration": 4 } }, { "key": "3", "meta": { "href": "/api/audit/sessions/1/channels/3" }, "body": { "type": "clipboard", "verdict": "accept", "start_time": 1451902141, "end_time": 1451902145, "duration": 4 } }, { "key": "4", "meta": { "href": "/api/audit/sessions/1/channels/4" }, "body": { "type": "seamless", "verdict": "deny", "start_time": 1451902142, "end_time": 1451902142, "duration": 0 } }, { "key": "5", "meta": { "href": "/api/audit/sessions/1/channels/5" }, "body": { "type": "dynamic virtual", "verdict": "accept", "start_time": 1451902145, "end_time": 1451902146, "duration": 1, "dynamic_channel": "Microsoft::Windows::RDS::Geometry::v08.01" } }, { "key": "6", "meta": { "href": "/api/audit/sessions/1/channels/6" }, "body": { "type": "custom", "verdict": "deny", "start_time": 1451902145, "end_time": 1451902145, "duration": 0 } }, { "key": "7", "meta": { "href": "/api/audit/sessions/1/channels/7" }, "body": { "type": "serial redirect", "verdict": "accept", "start_time": 1451902149, "end_time": 1451902150, "duration": 1, "device_name": "COM1" } }, { "key": "8", "meta": { "href": "/api/audit/sessions/1/channels/8" }, "body": { "type": "parallel redirect", "verdict": "accept", "start_time": 1451902149, "end_time": 1451902150, "duration": 1, "device_name": "LPT1" } }, { "key": "9", "meta": { "href": "/api/audit/sessions/1/channels/9" }, "body": { "type": "printer redirect", "verdict": "accept", "start_time": 1451902149, "end_time": 1451902150, "duration": 1, "device_name": "PRN22" } }, { "key": "10", "meta": { "href": "/api/audit/sessions/1/channels/10" }, "body": { "type": "disk redirect", "verdict": "accept", "start_time": 1451902149, "end_time": 1451902150, "duration": 1, "device_name": "J:" } }, { "key": "11", "meta": { "href": "/api/audit/sessions/1/channels/11" }, "body": { "type": "scard redirect", "verdict": "accept", "start_time": 1451902149, "end_time": 1451902150, "duration": 1, "device_name": "SCARD" } }
The following table lists the typical status and error codes for this request. For a complete list of error codes, see Application level error codes.
Code | Description | Notes |
---|---|---|
201 | Created | The new resource was successfully created. |
400 | InvalidQuery | The requested filter or its value is invalid. |
401 | Unauthenticated | The requested resource cannot be retrieved because the client is not authenticated and the resource requires authorization to access it. The details section contains the path that was attempted to be accessed, but could not be retrieved. |
403 | Unauthorized | The requested resource cannot be retrieved because the client is not authorized to access it. The details section contains the path that was attempted to be accessed, but could not be retrieved. |
404 | NotFound | The requested object does not exist. |
You can download the audit trail of a session from the /api/audit/sessions/<session-id>/audit_trail endpoint. To find a specific audit trail, see Searching in the session database. You can download audit trails that are available on SPS, and also audit trails that have been archived (if SPS can access the archived audit trail).
curl --cookie cookies "https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/audit_trail"
To actually create a file, you must save the downloaded data into a file (use the .zat file extension), for example:
curl --cookie cookies "https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/audit_trail" > my-downloaded-trail.zat
You can replay the downloaded audit trails with the Safeguard Desktop Player application. For details, see Safeguard Desktop Player User Guide.
If you want to replay an ongoing session in follow mode, you have to download the audit trail in .srs format. Use the ?format=srs option:
curl --cookie cookies "https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/audit_trail?format=srs" > my-downloaded-trail.srs
For details, see "Replay audit files in follow mode" in the Safeguard Desktop Player User Guide.
You can list, search, and filter the SPS session database at the /api/audit/sessions endpoint. You can use the following actions:
Display sessions that started after the specified date. Use the ISO 8601 format for the date, for example, 2017-01-25T10:00.
Filter the list using one or more property (element) of the sessions.
Search in the content of indexed sessions.
Display sessions that ended before the specified date. Use the ISO 8601 format for the date, for example, 2017-01-25T10:00.
Display the selected properties (elements and values) of the listed sessions.
Configure the pagination of the displayed results using the ?offset and ?limit parameters.
The ?limit parameter allows you to configure the maximum number of results to display on a page at once.
The default value of ?limit is 500.
Configure the pagination of the displayed results using the ?offset and ?limit parameters.
The ?offset parameter allows you to configure the offset from the first result that is displayed. This can be useful if the number of items returned exceeds the number of items displayed on the first page, and you want to navigate to any of the subsequent items displayed on other pages.
The default value of ?offset is null.
NOTE: The maximum number of search results in One Identity Safeguard for Privileged Sessions is 10000. As a result, any ?offset values set to larger than 10000 will be ignored and the results exceeding the value of 10000 will not be displayed.
Sort the results based on the values of the fields.
Configure the format of the displayed results.
The default value of ?format is json. If you do not configure the ?format parameter, the results will be displayed in JSON format.
To display search results in a CSV format, enter csv as a value.
To combine multiple expressions, use the & (ampersand) character, for example:
Display the target server and port of each active session:
curl --cookie cookies "https://<IP-address-of-SPS>/api/audit/sessions?fields=psm.target.address,psm.target.port&q=active:true"
Display 10 sessions at once, and navigate to 31-40:
curl --cookie cookies "https://<IP-address-of-SPS>/api/audit/sessions?limit=10&offset=31"
Search in metadata and session content at the same time:
curl --cookie cookies "https://<IP-address-of-SPS>/api/audit/sessions?q=protocol:ssh&content=sudo"
NOTE: If you use curl, use quotation marks for the URL to avoid problems with the & (ampersand) character.
The response to search or filtering action contains a list of the matching sessions, as well as some additional meta fields. For example:
{ "items": [ { "body": { "duration": 0, "name": "myname", "start_time": "2017-01-25T11:11:52.000+01:00" }, "key": "2", "meta": { "href": "/api/audit/sessions/2" } }, { "body": { "duration": 34, "name": "myname", "start_time": "2017-01-25T11:11:11.000+01:00" }, "key": "10", "meta": { "href": "/api/audit/sessions/10" } } ], "meta": { "fields": [ "start_time", "name", "duration" ], "first": "/api/audit/sessions?limit=500&offset=0&fields=start_time,name,duration&q=name%3Amyname&=duration", "href": "/api/audit/sessions", "last": "/api/audit/sessions?limit=500&offset=0&fields=start_time,name,duration&q=name%3Amyname&sort=duration", "limit": 500, "match_count": 2, "next": null, "offset": 0, "parent": "/api/audit", "previous": null }
Element | Type | Description | |
---|---|---|---|
items | list | Top level element, a list containing the details of the matching sessions. | |
body | JSON object |
Contains the information returned about a session, that is, the fields selected with the ?fields expression. For example, if you used the fields=start_time,psm.gateway_username,duration expression in your query, then the body element contains these fields for each returned session: "body": { "duration": 0, "name": null, "start_time": "2017-01-25T11:11:52.000+01:00" }, For details about the returned fields, see Element . | |
key | string |
A globally unique string that identifies the session. This session ID has the following format: svc/<unique-random-hash>/<name-of-the-connection-policy>:<session-number-since-service-started>/<protocol>, for example, svc/5tmEaM7xdNi1oscgVWpbZx/ssh_console:1/ssh. Log messages related to the session also contain this ID. For example: 2015-03-20T14:29:15+01:00 demo.example zorp/scb_ssh[5594]: scb.audit(4): (svc/5tmEaM7xdNi1oscgVWpbZx/ssh_console:0/ssh): Closing connection; connection='ssh_console', protocol='ssh', connection_id='409829754550c1c7a27e7d', src_ip='10.40.0.28', src_port='39183', server_ip='10.10.20.35', server_port='22', gateway_username='', remote_username='example-username', verdict='ZV_ACCEPT' Note that when using the session ID in a REST call, you must replace the special characters in the ID with the hyphen (-) character. For example, if the session ID in the log message is svc/fNLgRmAyf5EtycgUYnKc1B/ssh_demo2:2, use the svc-fNLgRmAyf5EtycgUYnKc1B-ssh_demo2-2 ID in REST calls. |
In addition to the usual meta elements of other endpoints, search results can contain the following additional elements.
Element | Type | Description | |
---|---|---|---|
meta | JSON object | Top level element, a list containing meta information about the response. | |
fields | list |
Contains the list of data fields returned about each session, that is, the fields selected with the ?fields expression. For example, if you used the fields=start_time,psm.gateway_username,duration expression in your query, then the body element contains these fields for each returned session: "fields": [ "start_time", "name", "duration" ], For details about the returned fields, see Element . | |
limit | integer | The maximum number of sessions returned in a the response (by default, 500). | |
match_count | integer | The number of results matching the query. | |
next | string | A query to retrieve the next set of search results, if match_count is higher than limit. | |
offset | integer | Indicates the position of the results in this response, relative to the total number of results (match_count). Otherwise, its value is null. | |
previous | string | A query to retrieve the previous set of search results, if match_count is higher than limit, and offset is higher than 0. Otherwise, its value is null. |
You can use the ?q option to filter the list using one or more property (element) of the sessions.
?q=protocol:ssh
You can escape special characters using the backslash character.
?q=server_username:\"Windows User\"
To add multiple elements to the filter, you can use the AND, AND NOT, and OR operators.
?q=protocol:ssh AND verdict:accept AND NOT name:admin
You can create groups using () (parentheses).
?q=(client.address:10.20.30.40 OR target.address:10.20.30.40) AND verdict:accept
You can also use () (parentheses) to add multiple possible values for a property.
?q=protocol:(ssh rdp)
You can use the * (asterisk) and ? (question mark) wildcards for string-type values.
?q=name:?dmi*
You can define ranges using [] (brackets) or {} (braces) and the TO operator. This only works for numeric (int) values.
[ means equal or higher than the following value
] means equal or lower than the preceding value
{ means higher than the following value
}means lower than the preceding value
For example, the following range resolves to 22:
?q=port:{21 TO 23}
You can also use the * (asterisk) wildcard in the range.
?q=start_time:[* TO 1461654799]
Note that not all connection data can be used for filtering. The available elements are:
active
Boolean, true means the session is ongoing (it is still active).
auth_method
String, the authentication method used.
channel_policy
String, the key of the channel policy.
client.address
String, the IP address of the client.
client.port
Integer, the port of the client.
psm.connection_policy
String, the key of the connection policy.
end_time
The date of the end of the session in ISO 8601 format.
name
String, the username used for authenticating against the gateway.
protocol
String, the protocol of the session.
server.address
String, the IP of the remote server.
psm.server_local.address
String, the IP of SPS.
psm.server_local.port
String, the port of SPS.
server.port
String, the port of the remote server.
server_username
String, the username used for authenticating on the remote server.
session_id
String, the identifier of the session.
start_time
The date of the start of the session in ISO 8601 format.
target.address
String, the IP the client targeted in the session.
target.port
Integer, the port the client targeted in the session.
verdict
String, the connection verdict. Possible values are:
accept
The connection attempt was successful.
accept-terminated
The connection violated a content policy, and was terminated by SPS.
auth-fail
Authentication failure.
deny
The connection was denied.
fail
The connection attempt failed.
gw-auth-fail
Gateway authentication failure.
key-error
The connection attempt failed due to a host key mismatch.
user-mapping-fail
The connection attempt failed due to a user mapping failure.
You can use the ?content option to search for keywords that appear in the content of the audit trails. Such content is any text that appeared on the screen in terminal or graphical sessions, or commands that the user typed in terminal sessions. Note that content search works only if:
Indexing was enabled in the connection policy related to the audit trail during the session, and
the audit trail has already been indexed.
?content="my-search-expression"
You can use the Apache Lucene query syntax to create the search expression, but note the following points.
You must format the search expression as an URL, and escape special characters accordingly. For example, if your search expression is man iptables, you must escape the whitespace: man%20iptables
For a list of special (reserved) URL characters, see RFC3986.
Do not begin the expression with the * wildcard.
Search for the word example
?content=example
Search for the words example, examples, and so on:
?content=example%3F
Search for the words example, examine, and so on:
?content=exam%2A
Search in metadata and session content at the same time:
curl --cookie cookies "https://<IP-address-of-SPS>/api/audit/sessions?q=protocol:ssh&content=sudo"
For further details and examples, see "Searching in the contents of audit trails" in the Administration Guide.
You can use the ?fields option to display the selected data (body elements) of each session.
?fields=protocol
To list multiple elements, use the , (comma) character. Note that the response includes the selected fields in alphabetic order, not in the order they were specified.
?fields=protocol,name
To list all possible elements, use the fields=* expression.
?fields=*
Note that not all connection data can be displayed in the generated list. The available elements are:
active
Boolean, true means the connection is ongoing.
archived
Boolean, true means the session has been archived.
auth_method
String, the authentication method used.
channel_policy
String, the key of the channel policy.
client.address
String, the IP address of the client.
client.port
Integer, the port of the client.
connection_policy
String, the key of the connection policy.
duration
Integer, the duration of the session. Computed value.
end_time
The date of the end of the session in ISO 8601 format.
name
String, the username used for authenticating against the gateway.
protocol
String, the protocol of the session.
server.address
String, the IP of the remote server.
server_local.address
String, the IP of SPS.
server_local.port
Integer, the port of SPS.
server.port
Integer, the port of the remote server.
server_username
String, the username used for authenticating on the remote server.
session_id
String, the identifier of the session.
start_time
The date of the start of the session in ISO 8601 format.
target.address
String, the IP the client targeted in the session.
target.port
Integer, the port the client targeted in the session.
To display search results only for specific date intervals, you can use the ?start and ?end options.
The ?start option selects the sessions that started after the specified date (based on the value of the start_time field).
The ?end option selects the sessions that ended before the specified date (based on the value of the end_time field).
Both options accept the date in ISO 8601 format.
?start=2017-01-25T11:11:52.000+01:00 ?end=2017-01-25T11:41:52.000+01:00 ?start=2017-01-24&end=2017-01-25
Select sessions that started on January 20, 2017, or later:
?start=2017-01-20
Select sessions that started on 11:00 January 20, 2017, or later:
?start=2017-01-20T11:00
Select sessions that ended on January 20, 2017:
?end=2017-01-20
Select sessions started and ended on January 20, 2017:
?start=2017-01-20&end=2017-01-20
Select sessions started after 11:00, January 20, 2017, and ended before 09:00, January 21, 2017:
?start=2017-01-20T11:00&end=2017-01-21T09:00
You can use the ?limit option to change the number of items displayed at once. The default limit is 500.
?limit=1000
To navigate beyond the displayed set, use the offset option.
You can use the ?offset option to navigate data sets that extend beyond the display limit. The default value of the offset is 0, this is the initially displayed set. To move to other items beyond the initial set, increase the value to a number that corresponds to the item where you want to start displaying results from.
Example: the display limit is the default 500, and the number of sessions is 1012. The initial 500 sessions are listed at:
?offset=0
To view sessions from 501 to 1000, change the offset to 501:
?offset=501
To display the remaining 12 sessions, change the offset to 1001:
?offset=1001
You can sort the search results using the sort expression, for example, based on the length of the sessions:
?sort=duration
You can use any field to sort the results. By default, sorting returns the results in ascending order, if you use ?sort=duration, then the shortest session is at the beginning of the list. To sort the results in descending order, add the minus sign (-) before the field name. For example, the response to the following expression starts with the longest session:
?sort=-duration
You can specify multiple fields to order the list. In this case, the list is first ordered using the first field, then the second, and so on. For example, to order the list first by duration, then by start time, use the following expression.
?sort=duration,start_time
The following example sorts the results by duration, and displays the start time, gateway username, and duration fields.
curl --cookie cookies "https://<IP-address-of-SPS>/api/audit/sessions?sort=duration&fields=start_time,psm.gateway_username,duration"
The default value of ?format is json. If you do not configure the ?format parameter, the results will be displayed in JSON format.
?format=json
To display search results in a CSV format, enter csv as a value.
?format=csv
Given that the following sessions were recorded:
{ "1": { "channel": [ {"channel_id": 1}, {"channel_id": 2} ], "recording": { "session_id": 1, "archived": false, "channel_policy": "policy1", "content_reference_id": 1, "connection_policy": "connection1", "auth_method": "password", "target": { "port": 2222, "ip": "1.1.1.1", "name": "1.1.1.1" }, "server_local": { "port": 46, "ip": "1.1.1.1", "name": "1.1.1.1" } }, "user": { "server_username": "user1", "gateway_username": "user1" }, "client": { "port": 48679, "ip": "2.2.2.2", "name": "2.2.2.2" }, "active": false, "start_time": 1, "duration": 4, "server": { "port": 22, "ip": "2.2.2.2", "name": "2.2.2.2" }, "end_time": 5, "protocol": "ssh" }, "2": { "channel": [ {"channel_id": 3}, {"channel_id": 4} ], "recording": { "session_id": 2, "archived": false, "channel_policy": "policy2", "content_reference_id": 2, "connection_policy": "connection2", "auth_method": "password", "target": { "port": 2222, "ip": "1.1.1.1", "name": "1.1.1.1" }, "server_local": { "port": 46, "ip": "1.1.1.1", "name": "1.1.1.1" } }, "user": { "server_username": "user2", "gateway_username": "user2" }, "client": { "port": 48680, "ip": "3.3.3.3", "name": "3.3.3.3" }, "active": false, "start_time": 1, "duration": 4, "server": { "port": 24, "ip": "2.2.2.2", "name": "2.2.2.2" }, "end_time": 7, "protocol": "ssh" } }
When the query is the following:
curl --cookie cookies "https://<IP-address-of-SPS>/api/audit/sessions?format=csv&fields=protocol,end_time,user.gateway_username,server.ip,client.ip,client.port"
The response is the following:
"Key","Protocol","End time","Gateway username","Server IP","Client IP","Client port" "2","ssh","7","user2","2.2.2.2","3.3.3.3","48680" "1","ssh","5","user1","2.2.2.2","2.2.2.2","48679"
Given that the following sessions were recorded:
{ "1":{ "origin": "RECORDING", "protocol": "SSH", "analytics": { "interesting_events": ["ssh", "sudo"], "similar_sessions": [] }, "recording": { "session_id": "1", "verdict": "ACCEPT", "audit_trail": "/var/lib/zorp/audit/532078660569910c6542b2/01/audit-scb_ssh-1451900800-1.zat", "connection_policy": "ssh1", "content_reference_id": 1 } }, "2":{ "origin": "RECORDING", "protocol": "SSH", "analytics": { "interesting_events": ["sudo", "systemctl"], "similar_sessions": [] }, "recording": { "session_id": "2", "verdict": "ACCEPT", "connection_policy": "ssh2", "content_reference_id": 2 } } }
When the query is the following:
curl --cookie cookies "https://<IP-address-of-SPS>/api/audit/sessions?sort=recording.session_id&format=csv&fields=recording.session_id,analytics.interesting_events,analytics.similar_sessions"
The response is the following:
"Key","Recording Session ID","Analytics Interesting events","Similar Sessions" "1","1","ssh","" "1","1","sudo","" "2","2","sudo","" "2","2","systemctl",""
Given that the following sessions were recorded:
{ "svc-paKzcMJwXghEFJ9UvsdqFU-sid-1": { "origin": "RECORDING", "protocol": "SSH", "recording": { "session_id": "1", "verdict": "ACCEPT", "audit_trail": "/var/lib/zorp/audit/532078660569910c6542b2/01/audit-scb_ssh-1451900800-1.zat", "connection_policy": "ssh1", "content_reference_id": 1 } }, "svc-paKzcMJwXghEFJ9UvsdqFU-sid-2": { "origin": "RECORDING", "protocol": "SSH", "recording": { "session_id": "2", "verdict": "ACCEPT", "connection_policy": "ssh2", "content_reference_id": 2 } } }
When the query is the following:
curl --cookie cookies "https://<IP-address-of-SPS>/api/audit/sessions?format=csv&fields=trail_download_link"
The response is the following:
"Key","Audit trail download link" "svc-paKzcMJwXghEFJ9UvsdqFU-sid-2","" "svc-paKzcMJwXghEFJ9UvsdqFU-sid-1","https://127.0.0.1/api/audit/sessions/svc-paKzcMJwXghEFJ9UvsdqFU-sid-1/audit_trail"
© ALL RIGHTS RESERVED. Feedback Termini di utilizzo Privacy Cookie Preference Center