You can search in the contents of individual connections at the api/audit/sessions/<session-id>/content/?q=<my-search-expression> endpoint.
GET https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/content/?q=<my-search-expression>
Cookie name | Description | Required | Values |
---|---|---|---|
session_id | Contains the authentication token of the user | Required |
The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API. Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format). |
The following command retrieves those events in the contents of a specific connection that match the search expression(s).
curl --cookie cookies https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/content/?q=<my-search-expression>
NOTE: Make sure that you use the ?q option and that when you use it, you do not leave it empty. Not using the ?q option or an empty ?q will result in an empty "items" list returned in the response.
You can use the Apache Lucene query syntax to create the search expression, but note the following points.
You must format the search expression as a URL, and escape special characters accordingly. For example, if your search expression is man iptables, you must escape the whitespace: man%20iptables
Do not begin the expression with the * wildcard.
The response contains a list of those events in the contents of the connection that match the search expression(s). The response also contains some meta fields.
If you specified a search expression using the ?q option and the response returns an empty "items" list, that can indicate that:
The search returned no results.
There is no content recorded for the connection.
The following is an example response:
{ "items": [ { "channel.id": 5, "end_time": "2017-08-14T10:35:43.957000", "rank": 2.4756217002868652, "record_id": { "begin": 158, "end": 160, "for_screenshot": 158 }, "start_time": "2017-08-14T10:35:19.098000", "trail_id": "12" } ], "meta": { "href": "/api/audit/sessions/2a620c1cfeb39c537a5e80280283d741/content", "parent": "/api/audit/sessions/2a620c1cfeb39c537a5e80280283d741", "remaining_seconds": 599 } }
Element | Type | Description | ||
---|---|---|---|---|
items | list | Top-level element, a list containing the details of the matching session. | ||
channel.id | integer | A reference to the ID of the channel in the session where the event occurred. | ||
end_time | string |
The timestamp of when the content disappeared from the screen. Starting with SPS 5 LTS, the timestamp is in ISO 8601 format, for example, 2018-10-11T09:23:38.000+02:00. In earlier versions, it was in UNIX timestamp format. | ||
rank | float |
Indicates the relevance of the match. If there are several results, the order of them is based on their relevance. | ||
record_id | integer | The content element's exact position in the audit trail file. | ||
begin | integer | The identifier of the screenshot in the audit trail file where the content element first appeared. | ||
end | integer | The identifier of the screenshot in the audit trail file where the content element last appeared. | ||
for_screenshot | integer | The identifier of the most relevant screenshot in the audit trail file. This is the screenshot on which the event in question is the most clearly visible. For details on how to generate and retrieve the screenshot, see Generate and retrieve screenshot for content search. | ||
start_time | string |
The timestamp of when the content first appeared on the screen and recording started. Starting with SPS 5 LTS, the timestamp is in ISO 8601 format, for example, 2018-10-11T09:23:38.000+02:00. In earlier versions, it was in UNIX timestamp format. | ||
trail_id | integer | The unique identifier of the trail that contains the event. |
In addition, search results can contain the usual meta elements of other endpoints:
Element | Type | Description | |
---|---|---|---|
meta | JSON object |
Top-level element, a list containing meta information about the response. For details about the type of information returned, see Message format. |
To generate and download screenshots for a specific content search result, complete the following steps. For details on searching in the content of a session, see Searching in connection content.
Use a GET request on the endpoint of a specific session, for example:
GET https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/content/?q=<my-search-expression>
For details, see Searching in connection content. If there are search results for the search keywords in the session, the response includes a record_id block, for example:
"record_id": { "begin": 158, "end": 160, "for_screenshot": 158 },
Note the value of the for_screenshot key in the search response, and use it to generate a screenshot for that particular record_id. POST the value of the for_screenshot key to the https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/_generate?record_ids=<value-of-for_screenshot> endpoint.
To download the screenshot in PNG format, GET the value of the for_screenshot key to the https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/screenshots/<value-of-for_screenshot> endpoint.
The api/audit/sessions/stats endpoint provides statistics about recorded sessions (active and closed).
GET https://<IP-address-of-SPS>/api/audit/sessions/stats?field=<field-name>
Cookie name | Description | Required | Values |
---|---|---|---|
session_id | Contains the authentication token of the user | Required |
The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API. Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format). |
The following command retrieves statistical data about sessions.
curl --cookie cookies https://<IP-address-of-SPS>/api/audit/sessions/stats?field=<field-name>
Use the following parameters to fine-tune your request for statistics:
?q: Narrow down the scope of statistics using one or more properties (elements) of the sessions.
?field: Request statistics for the selected properties (elements and values) of sessions (for example, protocol).
Using this parameter is mandatory.
?sub_fields: Request sub statistics for the selected properties (elements and values) of sessions (for example, protocol).
This parameter only accepts a single parameter. If more than one parameter is listed, only the first will be considered.
?size: Limit the range of values displayed in the statistics for a given field. Statistics will be shown only for the top size number of most frequently occurring values (that is, values with the highest number of counts).
Take the following example. If you query "/api/audit/sessions/stats?field=protocol&size=2", and the following sessions were recorded:
... { "Alpha": { "protocol": "http" }, "Bravo": { "protocol": "ssh" }, "Charlie": { "protocol": "rdp" }, "Delta": { "protocol": "rdp" }, "Echo": { "protocol": "rdp" }, "Foxtrot": { "protocol": "http" }, "Golf": { "protocol": "http" } } ...
The response contains:
... { "meta": { "href": "/api/audit/sessions/stats", "parent": "/api/audit/sessions", "others": 1, "field": "protocol", "size": 2 } } ...
And the response items look like the snippet below. That is, in this example, there will be no statistics for "protocol": "ssh". The top 2 values are "rdp" and "http", with a count of 3 each. "ssh" occurred only once, so it did not make it to the top 2 most frequent values.
... [ {"count": 3, "value": "http"}, {"count": 3, "value": "rdp"} ...
?start: Statistics are returned for sessions that started after the specified date. Use the ISO 8601 format for the date, for example, 2017-01-25T10:00.
?end: Statistics are returned for sessions that ended before the specified date. Use the ISO 8601 format for the date, for example, 2017-01-25T11:00.
?content: Statistics are returned for indexed sessions that contain the type of content specified.
NOTE: When performing a content query, the maximum number of results returned is 3000. When this limit is exceeded, the scope of statistics is limited to the first 3000 sessions (even if there are more than 3000 sessions that match your criteria).
The following snippet is a sample response received when retrieving statistics about the protocol field.
For details of the meta object, see Message format.
Those fields of the meta object that are specific to statistics are collected in table Element .
{ "items": [ { "count": 7, "value": "ssh" } ], "meta": { "field": "protocol", "href": "/api/audit/sessions/stats", "others": 0, "parent": "/api/audit/sessions", "remaining_seconds": 600, "size": 10 } }
Element | Type | Description | |
---|---|---|---|
body, or items when a list is returned | Top-level element (string) | Contains the properties that are in the scope of the requested statistics. | |
count | integer | Indicates the number of sessions included in the scope of statistics. | |
value | string | Contains the value of the field that you requested statistics about. | |
meta | Top-level element | Contains links to different parts of the REST service. | |
field | string | Contains the name of the field that you requested statistics about. | |
sub_fields | string | Contains the name of the sub field that you requested statistics about. | |
others | integer |
Some values of the field that you specified in your query are not included in the scope of statitics. This happens when a specific value occurs fewer times in the examined sessions than the aggregation size. The others field indicates the number of those distinct values that are not included in the statistics. For a detailed explanation with an example, see ?size. | |
size | integer | The size that you specified in your query. |
If you query "/api/audit/sessions/stats?field=protocol", and the following sessions were recorded:
... { "Alpha": { "protocol": "ssh" }, "Bravo": { "protocol": "ssh" }, "Charlie": { "protocol": "rdp" }, "Delta": { "protocol": "rdp" }, "Echo": { "protocol": "rdp" }, "Foxtrot": { "protocol": "ssh" }, "Golf": { "protocol": "ssh" } } ...
The response contains:
... { "meta": { "href": "/api/audit/sessions/stats", "parent": "/api/audit/sessions", "others": 0, "field": "protocol" } } ...
The response items contain:
... [ {"count": 4, "value": "ssh"}, {"count": 3, "value": "rdp"} ...
If you query "/api/audit/sessions/stats?field=protocol&content=login&start=2017-01-02&end=2017-01-03&q=psm.content_reference_id%3A%5B3%20TO%206%5D", and the following sessions were recorded:
{ "Alpha": { "protocol": "ssh", "start_time": "2017-01-01", "end_time": "2017-01-02", "recording": { "content_reference_id": 1 } }, "Bravo": { "protocol": "ssh", "start_time": "2017-01-01", "end_time": "2017-01-02", "recording": { "content_reference_id": 2 } }, "Charlie": { "protocol": "rdp", "start_time": "2017-01-01", "end_time": "2017-01-02", "recording": { "content_reference_id": 3 } }, "Delta": { "protocol": "rdp", "start_time": "2017-01-03", "end_time": "2017-01-04", "psm": { "content_reference_id": 4 } }, "Echo": { "protocol": "rdp", "start_time": "2017-01-03", "end_time": "2017-01-04", "recording": { "content_reference_id": 5 } }, "Foxtrot": { "protocol": "ssh", "start_time": "2017-01-04", "end_time": "2017-01-06", "recording": { "content_reference_id": 6 } }, "Golf": { "protocol": "ssh", "start_time": "2017-01-02", "end_time": "2017-01-10", "recording": { "content_reference_id": 7 } } }
And the following sessions match when running the content query:
| trail_id | rank | hits_count | | 1 | 1.555 | 1 | | 2 | 1.555 | 1 | | 3 | 1.555 | 1 | | 4 | 1.555 | 1 | | 6 | 1.555 | 1 |
The response contains:
... { "meta": { "href": "/api/audit/sessions/stats", "parent": "/api/audit/sessions", "others": 0, "field": "protocol" } } ...
The response items contain:
... [ {"count": 2, "value": "rdp"} ...
If you query "/api/audit/sessions/stats?field=user.gateway_username&?sub_fields=protocol&?size=1", and the following sessions were recorded:
... { "Alpha": { "protocol": "ssh", "user": { "gateway_username": "user-Alpha" } }, "Bravo": { "protocol": "ssh", "user": { "gateway_username": "user-Bravo" } }, "Charlie": { "protocol": "rdp", "user": { "gateway_username": "user-Charlie" } }, "Delta": { "protocol": "rdp", "user": { "gateway_username": "user-Alpha" } }, "Echo": { "protocol": "rdp", "user": { "gateway_username": "user-Alpha" } }, "Foxtrot": { "protocol": "ssh", "user": { "gateway_username": "user-Alpha" } }, "Golf": { "protocol": "ssh", "user": { "gateway_username": "user-Alpha" } }, "Hotel": { "protocol": "ssh", "user": { "gateway_username": "user-Delta" } } } ...
The response contains:
... { "meta": { "href": "/api/audit/sessions/stats", "parent": "/api/audit/sessions", "others": 3 } } ...
The response items contain:
... [ { "buckets": [ { "count": 3, "value": "ssh" } ], "count": 5, "others": 2, "value": "user-Alpha" } ] ...
The following table lists the typical status and error codes for this request. For a complete list of error codes, see Application level error codes.
Code | Description | Notes |
---|---|---|
200 | OK | The query was well-formed and statistics have been successfully retrieved. |
400 | InvalidQueryValue | The query is invalid, for example, it has an invalid value. |
500 | SearchUnavailable | The search backend is inaccessible. |
The api/audit/sessions/histogram endpoint provides a histogram about the recorded sessions.
GET https://<IP-address-of-SPS>/api/audit/sessions/histogram
Cookie name | Description | Required | Values |
---|---|---|---|
session_id | Contains the authentication token of the user | Required |
The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API. Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format). |
The following command retrieves statistical data about sessions.
curl --cookie cookies https://<IP-address-of-SPS>/api/audit/sessions/histogram
Use the following parameters to fine-tune your request for statistics:
?q: Narrow down the scope of the histogram using one or more properties (elements) of the sessions.
?field: Create a histogram for the selected properties (elements and values) of sessions (for example, protocol).
Using this parameter is mandatory.
?bin-size: Determines the size of the unit for the histogram, for example, hour. SPS splits the queried period to intervals of this unit, and returns the number of sessions to each interval. For example, if you query an histogram from 2018-02-12:14:40 to 2018-02-16:14:40, and you set the bin-size to day, then SPS will return five datasets (one for each day). If you set the bin-size to week, then SPS will return only one dataset.
?start: Create a histogram from the sessions that started after the specified date. Use the ISO 8601 format for the date, for example, 2017-01-25T10:00. By default, this is the one month before the date of the request.
?end: Create a histogram from the sessions that ended before the specified date. Use the ISO 8601 format for the date, for example, 2017-01-25T11:00. By default, this is the date of the request.
?size: Limit the range of values displayed in the histogram for a given field. The histogram will only be created for the top size number of most frequently occurring values (that is, values with the highest number of counts).
The following snippet is a sample response received when retrieving a histogram about the audited sessions.
For details of the meta object, see Message format.
Those fields of the meta object that are specific to histograms are described in table Element .
{ "body": { "buckets": [ { "active_count": 61, "id": "2018-01-15T12:00:00.000Z", "start_count": 61 }, { "active_count": 99, "id": "2018-01-15T13:00:00.000Z", "start_count": 89 }, { "active_count": 39, "id": "2018-01-15T14:00:00.000Z", "start_count": 24 }, { "active_count": 62, "id": "2018-01-15T15:00:00.000Z", "start_count": 62 }, { "active_count": 92, "id": "2018-01-15T16:00:00.000Z", "start_count": 81 }, { "active_count": 27, "id": "2018-01-15T17:00:00.000Z", "start_count": 19 } ] }, "key": "histogram", "meta": { "bin_size": "month", "field": "recording.connection_policy", "href": "/api/audit/sessions/histogram", "parent": "/api/audit/sessions", "remaining_seconds": 599, "time_zone": "Etc/UTC", "size": "10" } }
Element | Type | Description | ||
---|---|---|---|---|
body | Top-level element (string) | Contains the properties that are in the scope of the requested histogram. | ||
buckets | list | Contains the details of the histogram. | ||
active_count | integer | The number of sessions that were active in this interval. | ||
id | date | The starting date of the interval in ISO 8601 format. | ||
start_count | integer | The number of sessions that were started in this interval. | ||
meta | Top-level element (JSON object) | Contains metadata about the endpoint and the histogram. | ||
bin_size | string | The size of the intervals used to create the histogram. You can change this using the ?bin_size parameter of the request. Default value: month. Possible values: second, minute, hour, day, week, month, year | ||
field | string | Contains the name of the field that you requested statistics about. | ||
end | date | The date set in the ?end parameter of the request. By default, this is the date of the request. | ||
start | date | The date set in the ?start parameter of the request. By default, this is one month before the date of the request. | ||
time_zone | string | The time zone to use when calculating the intervals of the histogram, for example, Etc/UTC. By default, SPS uses UTC+0 (Zulu Time Zone). For the list of available time zones, see Element . | ||
size | integer | The size that you specified in your query. |
The following table lists the typical status and error codes for this request. For a complete list of error codes, see Application level error codes.
Code | Description | Notes |
---|---|---|
200 | OK | The query was well-formed and the histogram has been successfully retrieved. |
400 | TooMuchBucketsInResult | Using the requested bin_size would result in too many intervals for the queried period. |
400 | NotSupportedContentOption | This endpoint does not support filtering in the content of sessions. |
© ALL RIGHTS RESERVED. Feedback Termini di utilizzo Privacy Cookie Preference Center