One Identity Safeguard for Privileged Sessions 6.0.2 - REST API Reference Guide

Searching in connection content

You can search in the contents of individual connections at the api/audit/sessions/<session-id>/content/?q=<my-search-expression> endpoint.

URL

GET https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/content/?q=<my-search-expression>

Cookies

Sample request

The following command retrieves those events in the contents of a specific connection that match the search expression(s).

curl --cookie cookies https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/content/?q=<my-search-expression>

You can use the Apache Lucene query syntax to create the search expression, but note the following points.

• You must format the search expression as a URL, and escape special characters accordingly. For example, if your search expression is man iptables, you must escape the whitespace: man%20iptables

• Do not begin the expression with the * wildcard.

Response

The response contains a list of those events in the contents of the connection that match the search expression(s). The response also contains some meta fields.

If you specified a search expression using the ?q option and the response returns an empty "items" list, that can indicate that:

• The search returned no results.

• There is no content recorded for the connection.

The following is an example response:

{
    "items": [
        { 
            "channel.id": 5, 
            "end_time": "2017-08-14T10:35:43.957000", 
            "rank": 2.4756217002868652,
            "record_id": {
                "begin": 158,
                "end": 160,
                "for_screenshot": 158
            },
            "start_time": "2017-08-14T10:35:19.098000", 
            "trail_id": "12" 
        }
    ],
    "meta":
        { 
            "href": "/api/audit/sessions/2a620c1cfeb39c537a5e80280283d741/content", 
            "parent": "/api/audit/sessions/2a620c1cfeb39c537a5e80280283d741", 
            "remaining_seconds": 599 
        }
}

In addition, search results can contain the usual meta elements of other endpoints:

Session statistics

The api/audit/sessions/stats endpoint provides statistics about recorded sessions (active and closed).

URL

GET https://<IP-address-of-SPS>/api/audit/sessions/stats?field=<field-name>

Cookies

Sample request

The following command retrieves statistical data about sessions.

curl --cookie cookies https://<IP-address-of-SPS>/api/audit/sessions/stats?field=<field-name>

Request parameters

Use the following parameters to fine-tune your request for statistics:

• ?q: Narrow down the scope of statistics using one or more properties (elements) of the sessions.

• ?field: Request statistics for the selected properties (elements and values) of sessions (for example, protocol).

  Using this parameter is mandatory.

• ?sub_fields: Request sub statistics for the selected properties (elements and values) of sessions (for example, protocol).

  This parameter only accepts a single parameter. If more than one parameter is listed, only the first will be considered.

• ?size: Limit the range of values displayed in the statistics for a given field. Statistics will be shown only for the top size number of most frequently occurring values (that is, values with the highest number of counts).

  Take the following example. If you query "/api/audit/sessions/stats?field=protocol&size=2", and the following sessions were recorded:

  ...
  {
    "Alpha": {
      "protocol": "http"
    },
    "Bravo": {
      "protocol": "ssh"
    },
    "Charlie": {
      "protocol": "rdp"
    },
    "Delta": {
      "protocol": "rdp"
    },
    "Echo": {
      "protocol": "rdp"
    },
    "Foxtrot": {
      "protocol": "http"
    },
    "Golf": {
      "protocol": "http"
    }
  }
  ...

  The response contains:

  ...
  {
   "meta": {
      "href": "/api/audit/sessions/stats",
      "parent": "/api/audit/sessions",
      "others": 1,
      "field": "protocol",
      "size": 2
   }
  }
  ...

  And the response items look like the snippet below. That is, in this example, there will be no statistics for "protocol": "ssh". The top 2 values are "rdp" and "http", with a count of 3 each. "ssh" occurred only once, so it did not make it to the top 2 most frequent values.

  ...
  [
   {"count": 3, "value": "http"},
   {"count": 3, "value": "rdp"}
  ...

• ?start: Statistics are returned for sessions that started after the specified date. Use the ISO 8601 format for the date, for example, 2017-01-25T10:00.

• ?end: Statistics are returned for sessions that ended before the specified date. Use the ISO 8601 format for the date, for example, 2017-01-25T11:00.

• ?content: Statistics are returned for indexed sessions that contain the type of content specified.

  NOTE: When performing a content query, the maximum number of results returned is 3000. When this limit is exceeded, the scope of statistics is limited to the first 3000 sessions (even if there are more than 3000 sessions that match your criteria).

Response

The following snippet is a sample response received when retrieving statistics about the protocol field.

For details of the meta object, see Message format.

Those fields of the meta object that are specific to statistics are collected in table Element .

{
    "items": [
        {
            "count": 7,
            "value": "ssh"
        }
    ],
    "meta": {
        "field": "protocol",
        "href": "/api/audit/sessions/stats",
        "others": 0,
        "parent": "/api/audit/sessions",
        "remaining_seconds": 600,
        "size": 10
    }
}

...
{
  "Alpha": {
    "protocol": "ssh"
  },
  "Bravo": {
    "protocol": "ssh"
  },
  "Charlie": {
    "protocol": "rdp"
  },
  "Delta": {
    "protocol": "rdp"
  },
  "Echo": {
    "protocol": "rdp"
  },
  "Foxtrot": {
    "protocol": "ssh"
  },
  "Golf": {
    "protocol": "ssh"
  }
}
...

...
{
  "meta": {
    "href": "/api/audit/sessions/stats",
    "parent": "/api/audit/sessions",
    "others": 0,
    "field": "protocol"
  }
}
...

...
[
 {"count": 4, "value": "ssh"},
 {"count": 3, "value": "rdp"}  
...

{
  "Alpha": {
    "protocol": "ssh",
    "start_time": "2017-01-01",
    "end_time": "2017-01-02",
    "recording": {
      "content_reference_id": 1
    }
  },
  "Bravo": {
    "protocol": "ssh",
    "start_time": "2017-01-01",
    "end_time": "2017-01-02",
    "recording": {
      "content_reference_id": 2
    }
  },
  "Charlie": {
    "protocol": "rdp",
    "start_time": "2017-01-01",
    "end_time": "2017-01-02",
    "recording": {
      "content_reference_id": 3
    }
  },
  "Delta": {
    "protocol": "rdp",
    "start_time": "2017-01-03",
    "end_time": "2017-01-04",
    "psm": {
      "content_reference_id": 4
    }
  },
  "Echo": {
    "protocol": "rdp",
    "start_time": "2017-01-03",
    "end_time": "2017-01-04",
    "recording": {
      "content_reference_id": 5
    }
  },
  "Foxtrot": {
    "protocol": "ssh",
    "start_time": "2017-01-04",
    "end_time": "2017-01-06",
    "recording": {
      "content_reference_id": 6
    }
  },
  "Golf": {
    "protocol": "ssh",
    "start_time": "2017-01-02",
    "end_time": "2017-01-10",
    "recording": {
      "content_reference_id": 7
    }
  }
}

| trail_id | rank  | hits_count |
|    1     | 1.555 | 1          |
|    2     | 1.555 | 1          |
|    3     | 1.555 | 1          |
|    4     | 1.555 | 1          |
|    6     | 1.555 | 1          |

...
{
  "meta": {
    "href": "/api/audit/sessions/stats",
    "parent": "/api/audit/sessions",
    "others": 0,
    "field": "protocol"
  }
}
...

...
[
 {"count": 2, "value": "rdp"} 
...

...
{
  "Alpha": {
    "protocol": "ssh",
    "user": {
      "gateway_username": "user-Alpha"
    }
  },
  "Bravo": {
    "protocol": "ssh",
    "user": {
      "gateway_username": "user-Bravo"
    }
  },
  "Charlie": {
    "protocol": "rdp",
    "user": {
      "gateway_username": "user-Charlie"
    }
  },
  "Delta": {
    "protocol": "rdp",
    "user": {
      "gateway_username": "user-Alpha"
    }
  },
  "Echo": {
    "protocol": "rdp",
    "user": {
      "gateway_username": "user-Alpha"
    }
  },
  "Foxtrot": {
    "protocol": "ssh",
    "user": {
      "gateway_username": "user-Alpha"
    }
  },
  "Golf": {
    "protocol": "ssh",
    "user": {
      "gateway_username": "user-Alpha"
    }
  },
  "Hotel": {
    "protocol": "ssh",
    "user": {
      "gateway_username": "user-Delta"
    }
  }
}
...

...
{
  "meta": {
    "href": "/api/audit/sessions/stats",
    "parent": "/api/audit/sessions",
    "others": 3
  }
}
...

...
[
  {
    "buckets": [
      {
        "count": 3,
        "value": "ssh"
      }
    ],
    "count": 5,
    "others": 2,
    "value": "user-Alpha"
  }
]  
...

Status and error codes

The following table lists the typical status and error codes for this request. For a complete list of error codes, see Application level error codes.

Session histogram

The api/audit/sessions/histogram endpoint provides a histogram about the recorded sessions.

URL

GET https://<IP-address-of-SPS>/api/audit/sessions/histogram

Cookies

Sample request

The following command retrieves statistical data about sessions.

curl --cookie cookies https://<IP-address-of-SPS>/api/audit/sessions/histogram

Request parameters

Use the following parameters to fine-tune your request for statistics:

• ?q: Narrow down the scope of the histogram using one or more properties (elements) of the sessions.

• ?field: Create a histogram for the selected properties (elements and values) of sessions (for example, protocol).

  Using this parameter is mandatory.

• ?bin-size: Determines the size of the unit for the histogram, for example, hour. SPS splits the queried period to intervals of this unit, and returns the number of sessions to each interval. For example, if you query an histogram from 2018-02-12:14:40 to 2018-02-16:14:40, and you set the bin-size to day, then SPS will return five datasets (one for each day). If you set the bin-size to week, then SPS will return only one dataset.

• ?start: Create a histogram from the sessions that started after the specified date. Use the ISO 8601 format for the date, for example, 2017-01-25T10:00. By default, this is the one month before the date of the request.

• ?end: Create a histogram from the sessions that ended before the specified date. Use the ISO 8601 format for the date, for example, 2017-01-25T11:00. By default, this is the date of the request.

• ?size: Limit the range of values displayed in the histogram for a given field. The histogram will only be created for the top size number of most frequently occurring values (that is, values with the highest number of counts).

Response

The following snippet is a sample response received when retrieving a histogram about the audited sessions.

For details of the meta object, see Message format.

Those fields of the meta object that are specific to histograms are described in table Element .

{
"body": {
    "buckets": [
        { "active_count": 61, "id": "2018-01-15T12:00:00.000Z", "start_count": 61 },
        { "active_count": 99, "id": "2018-01-15T13:00:00.000Z", "start_count": 89 },
        { "active_count": 39, "id": "2018-01-15T14:00:00.000Z", "start_count": 24 },
        { "active_count": 62, "id": "2018-01-15T15:00:00.000Z", "start_count": 62 },
        { "active_count": 92, "id": "2018-01-15T16:00:00.000Z", "start_count": 81 },
        { "active_count": 27, "id": "2018-01-15T17:00:00.000Z", "start_count": 19 }
    ]
},

"key": "histogram",
"meta":
    {
        "bin_size": "month",
        "field": "recording.connection_policy",
        "href": "/api/audit/sessions/histogram",
        "parent": "/api/audit/sessions",
        "remaining_seconds": 599,
        "time_zone": "Etc/UTC",
        "size": "10"
    }
}

Status and error codes

The following table lists the typical status and error codes for this request. For a complete list of error codes, see Application level error codes.

Session alerts

The api/audit/sessions/<session-id>/alerts endpoint lists the alerts triggered in a session (if any). For details on configuring alerts, see Real-time content monitoring with Content Policies.

An event is listed as alert only if the Actions > Store in Connection Database option is selected in the Content Policy used to handle the session.

URL

GET https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/alerts

Cookies

Sample request

The following command lists the alerts of a session.

curl --cookie cookies "https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/alerts"

Response

The following is a sample response received when listing the alerts of a session.

For details of the meta object, see Message format.

{
    "items": [
        {
            "alert_type": "adp.event.command",
            "channel_id": "0",
            "matched_action": "ls",
            "matched_content": "[myuser@examplehost ~]$ ls",
            "matched_regexp": "ls",
            "record_id": 94,
            "rule_name": "PatternMatcherRule",
            "time": "2017-04-25T13:26:39.144356"
        },
        {
            "alert_type": "adp.event.command",
            "channel_id": "0",
            "matched_action": "man man",
            "matched_content": "[myuser@examplehost ~]$ man man",
            "matched_regexp": "man",
            "record_id": 197,
            "rule_name": "PatternMatcherRule",
            "time": "2017-04-25T13:34:15.265411"
        }
    ],
    "meta": {
        "first": "/api/audit/sessions/c7e51cebad1a3e2ade480909f7687b16/alerts?limit=500&offset=0",
        "href": "/api/audit/sessions/c7e51cebad1a3e2ade480909f7687b16/alerts",
        "last": "/api/audit/sessions/c7e51cebad1a3e2ade480909f7687b16/alerts?limit=500&offset=0",
        "limit": 500,
        "match_count": 3,
        "next": null,
        "offset": 0,
        "parent": "/api/audit/sessions/c7e51cebad1a3e2ade480909f7687b16",
        "previous": null,
        "remaining_seconds": 600
    }
}

Changing the display limit

You can use the ?limit option to change the number of items displayed at once. The default limit is 500.

?limit=1000

To navigate beyond the displayed set, use the offset option.

Navigating large datasets

You can use the ?offset option to navigate data sets that extend beyond the display limit. The default value of the offset is 0, this is the initially displayed set. To move to other items beyond the initial set, increase the value to a number that corresponds to the item where you want to start displaying results from.

Example: the display limit is the default 500, and the number of sessions is 1012. The initial 500 sessions are listed at:

?offset=0

To view sessions from 501 to 1000, change the offset to 501:

?offset=501

To display the remaining 12 sessions, change the offset to 1001:

?offset=1001

Sorting and filtering

Sorting and filtering alerts is currently not supported. The items are automatically sorted by the record ID. The response includes every available field.