One Identity Safeguard for Privileged Sessions 7.5.1

The api/audit/sessions endpoint lists the recorded sessions (active and closed).

URL

GET https://<IP-address-of-SPS>/api/audit/sessions

Cookies

Cookie name	Description	Required	Values
session_id	Contains the authentication token of the user	Required	The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For more information on authentication, see Authenticate to the SPS REST API. NOTE: This session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format).

Sample request

The following command lists the connections.

curl --cookie cookies.txt https://<IP-address-of-SPS>/api/audit/sessions

The following command retrieves the properties of a specific connection.

curl --cookie cookies.txt https://<IP-address-of-SPS>/api/audit/sessions/<session-id>

Response

The following is a sample response received when listing connections.

For more information on the meta object, see Message format.

{
  "items": [
    {
      "key": "2",
      "meta": {
        "href": "/api/audit/sessions/2"
      }
    },
    {
      "key": "1",
      "meta": {
        "href": "/api/audit/sessions/1"
      }
    }
  ],
  "meta": {
    "fields": [],
    "first": "/api/audit/sessions?limit=500&offset=0&fields=",
    "href": "/api/audit/sessions",
    "last": "/api/audit/sessions?limit=500&offset=0&fields=",
    "limit": 500,
    "match_count": 39,
    "next": null,
    "offset": 0,
    "parent": "/api/audit",
    "previous": null
  }
}

When retrieving the endpoint of a specific connection, the response is the following.

{
  "body": {
    "active": false,
    "alerts": {
      "href": "/api/audit/sessions/rUhhQZ3jYsY1NDWYp9DEpq/alerts"
    },
    "analytics": {
      "interesting_events": [],
      "scripted": false,
      "scripted_results": {},
      "similar_sessions": [],
      "tags": []
    },
    "channels": {
      "href": "/api/audit/sessions/rUhhQZ3jYsY1NDWYp9DEpq/channels"
    },
    "client": {
      "ip": "10.20.30.40",
      "name": "10.20.30.40",
      "port": 59125
    },
    "creation_time": "2018-11-14T12:26:59.244Z",
    "duration": 57,
    "end_time": "2018-09-15T14:22:00+05:00",
    "events": {
      "href": "/api/audit/sessions/rUhhQZ3jYsY1NDWYp9DEpq/events"
    },
    "hidden": false,
    "indexing": {
      "href": "/api/audit/sessions/rUhhQZ3jYsY1NDWYp9DEpq/indexing"
    },
    "node_id": "6fed7872-065e-41d2-9cfa-ba75e8cad901",
    "origin": "RECORDING",
    "phantom": false,
    "protocol": "SSH",
    "recording": {
      "archived": false,
      "audit_trail": {
        "archive": null,
        "download": {
          "href": "/api/audit/sessions/rUhhQZ3jYsY1NDWYp9DEpq/audit_trail"
        }
      },
      "auth_method": "password",
      "channel_policy": "shell-only",
      "command_extracted": false,
      "connection_policy": "myconnectionpolicy",
      "connection_policy_id": "15682863055beac3c8d23bf",
      "content_reference_id": 30,
      "has_accepted_channel": true,
      "index_status": "INDEXED",
      "server_local": {
        "ip": "10.20.30.40",
        "name": "10.20.30.40",
        "port": 55386
      },
      "session_id": "svc/rUhhQZ3jYsY1NDWYp9DEpq/abcde:29",
      "target": {
        "ip": "10.20.30.40",
        "name": "10.20.30.40",
        "port": 221
      },
      "verdict": "Accepted",
      "window_title_extracted": false
    },
    "revision": 15,
    "server": {
      "ip": "10.20.30.40",
      "name": "10.20.30.40",
      "port": 22
    },
    "start_time": "2018-09-15T15:53:00+05:00",
    "user": {
      "id": "myid",
      "name": "myname",
      "server_username": "myserver"
    },
    "verdict": "ACCEPT"
  },
  "key": "rUhhQZ3jYsY1NDWYp9DEpq",
  "meta": {
      "href": "/api/audit/sessions/rUhhQZ3jYsY1NDWYp9DEpq",
      "parent": "/api/audit/sessions",
      "remaining_seconds": 594
  }
}

Element			Type	Description
key			string	Top level element, contains the key of the connection or audit trail.
body			Top level element (string)	Contains the properties of the connection.
	active		boolean	If the returned value is true, the connection is ongoing.
	alerts		Top level item	Contains a link to the details of the alerts. For details, see Session alerts. An event is listed as alert only if the Actions > Store in Connection Database option is selected in the Content Policy used to handle the session. "alerts": { "href": "/api/audit/sessions/7930f4308efe8aecd710202d815b76ff/alerts" },
	analytics		Top level item	Contains analytics details of the connection.
	channels		Top level list	Contains a link to the details of the channel. "channels": { "href": "/api/audit/sessions/svc-rUhhQZ3jYsY1NDWYp9DEpq-kecske-29/channels" },
	client		Top level item	The IP address and port number of the client.
	creation_time		date	The time this document was created. In optimal cases this is near equal to the session's original start_time. However, it can be later than start_time.
	duration		int	The duration of the session in seconds. Computed value.
	end_time		ISO 8601 date	The timestamp of the end of the connection. For ongoing connection, the value is null. Starting with SPS 5 LTS, the timestamp is in ISO 8601 format, for example, 2018-10-11T09:23:38.000+02:00. In earlier versions, it was in UNIX timestamp format.
	events		Top level item	Contains a link to the details of the events. For details, see Session events. "events": { "href": "/api/audit/sessions/7930f4308efe8aecd710202d815b76ff/events" },
	hidden		boolean	True if this is a session that has not been displayed on the SPS GUI yet (due to fragmented data about the session).
	indexer		Top level item	Contains the details of indexing. For details on configuring indexing, see Local services: configuring the indexer. "indexer": { "href": "/api/audit/sessions/rUhhQZ3jYsY1NDWYp9DEpq/indexer" },
	node_id		string	The node ID of the SPS machine where this session has been recorded.
	origin		string	How SPA received this session. The following values are possible: PSM for sessions based on an audit trail recorded by SPS. LOG for sessions built from log data.
	protocol		string	The protocol of the connection.
	recording		Top level item	Contains the properties of the audit trail.
		archived	boolean	If the audit trail has been archived, this value is true, otherwise it is false. For details about the archiving, see the archive object of the psm.audit_trail field.
		audit_trail	Top level item	The path to the audit trail file on SPS. If the session does not have an audit trail, this element is not used. To download the audit trail, see Download audit trails.
		auth_method	Top level item	Authentication method: The authentication method used in the connection. For example, password
		channel_policy	string	References the name of the channel policy. You can find the list of channel policies for each protocol at the /api/configuration/<protocol>/channel_policies/ endpoint.
		command_extracted	boolean	If commands have been extracted from this terminal session, this value is true, otherwise it is false. The extracted commands are available in the events object field.
		connection_policy	string	The name of the Connection Policy that handled the session, for example, ssh_gateway_auth. This is the name displayed on the Control > Connections page of the SPS web interface, and in the name field of the Connection Policy object. You can find the list of connection policies for each protocol at the /api/configuration/<protocol>/connections/ endpoint.
		connection_policy_id	string	The key of the Connection Policy that handled the session, for example, 54906683158e768e727100. You can find the list of connection policies for each protocol at the /api/configuration/<protocol>/connections/ endpoint.
		content_reference_id	long	The unique ID of the TCP connection.
		has_accepted_channel	boolean	True, if at least the connection has been built successfully, the authentication was successful, and there was actual traffic.
		index_status	string	Channel's indexing status: Shows if the channel has been indexed. The following values are possible: CHANNEL_OPEN (0): The connection of the channel is still open (indexer is waiting for the connection to close). NOT_INDEXED (1): All channels of the connection have been closed which belong to the connection. The channel is ready for indexing, unless the audit trail was placed in the skipped_connections queue. INDEXING_IN_PROGRESS (2): The channel is being indexed (indexing in progress). Note that SPS will return search results for the parts of the channel are already indexed. INDEXED (3): Indexing the channel is complete. INDEXING_NOT_REQUIRED (4): Indexing not required (indexing is not enabled for the connection). INDEXING_FAILED (5): Indexing failed. The indexer service writes the corresponding error message in the error_message column of the indexer_jobs table. Note that SPS will return search results for the parts of the channel that were successfully indexed before the error occurred. For example, if the error occurred at the end of a long audit trail, you can still search for content from the first part of the audit trail. NO_TRAIL (6): Auditing is not enabled for the channel.
		network_id	string	The ID of the Linux network namespace where the session originated from.
		server_local	Top level item	The IP address and port number of SPS.
		session_id	string	The identifier of the session.
		target	Top level item	The IP address and port number the client targeted for connection.
		verdict	string	The connection verdict. Possible values are: accept The connection attempt was successful. accept-terminated The connection violated a content policy, and was terminated by SPS. auth-fail Authentication failure. deny The connection was denied. fail The connection attempt failed. gw-auth-fail Gateway authentication failure. key-error The connection attempt failed due to a host key mismatch. user-mapping-fail The connection attempt failed due to a user mapping failure.
		window_title_extracted	boolean	If window titles have been extracted from this graphical session, this value is true, otherwise it is false. The extracted window titles are available in the events object field.
	revision		int	The revision number of the document. A newer document has a larger revision number than an older one. This helps you to determine which session version is newer.
	server		Top level item	The IP address and port number of the remote server.
	trail_downloads		Top level item	Contains a link to the details of the audit-trail downloads in this session (if any). "trail_downloads": { "href": "/api/audit/sessions/rUhhQZ3jYsY1NDWYp9DEpq/trail_downloads" },
	start_time		ISO 8601 date	The timestamp of the start of the connection. Starting with SPS 5 LTS, the timestamp is in ISO 8601 format, for example, 2018-10-11T09:23:38.000+02:00. In earlier versions, it was in UNIX timestamp format.
	user		Top level item	The details of the user authenticating on the remote server.
		id	string	The ID of the user.
		name	string	The username used for authenticating against the gateway.
		server_username	string	The username used for authenticating on the remote server.
	verdict		string	Indicates what SPS decided about the session. A session verdict that originates from log events or other external events.

Analytics elements		Type	Description
analytics		Top level element	Contains analytics details of the connection. For example: "analytics": { "interesting_events": [], "scripted": false, "scripted_results": {}, "similar_sessions": [], "tags": [] },
	interesting_events	string	A list of commands and window titles from the session that could be interesting from a security point of view.
	score.aggregated	int	The risk score that SPA assigned to the session. Values range from 0 to 100, with 100 representing the highest risk.
	score.details	object	This is an object where the keys are algorithm names and values are algorithm-specific details about the score result.
	scripted	boolean	True if the SPA module marked the session as scripted because of non-human activity.
	scripted_results	object	A key-value pair, where key=<algorithm-name>, value=<reason-of-the-decision>. The algorithm can be clockmaster or gapminder. Result: True/False. Reason: Either the reason behind the result, or if no result is avalialble, an error message (for example, the baseline has not been built yet).
	similar_sessions	string	Collection of similar sessions from different sources.
	tags	string	The Analytics tags section in Search > Details.

Audit trail elements		Type	Description
archive		Top level element	Indicates whether the audit trail has been archived or not. If the audit trail has not been archived yet, the value of the element is null. For example: "audit_trail": { "archive": { "date": "2018-11-25T12:00:05.000Z", "path": "2018-11-23/", "policy": "8106930065bf7eb4c3cf59", "server": "\\\\10.20.30.40\\archive\\abc123 (user: myuser)" }, "download": { "href": "/api/audit/sessions/10/audit_trail" } },
	date	ISO 8601 date	The date when the audit trail was archived in ISO 8601 date.
	server	hostname or IP address	The address of the remote server where the audit trail was archived.
	path	string	The path on the remote server where the audit trail was archived.
	policy	string	The ID of the archiving policy that was used to archive the audit trail.
download		string	The download element allows downloading the audit trail.

Channel elements		Type	Description
key		string	Top level element, contains the ID of the channel.
items		Top level element (string)	The properties of the channel.
	active	boolean	If the returned value is true, the session has not ended yet and the channel is active.
	audit_stream_id	string	The identifier of the channel's audit stream. If the session does not have an audit trail, this element is not used.
	channel_id	long	The unique ID of the channel.
	client_x509_subject	string	The client's certificate in Telnet or VNC sessions. Available only if the Traffic Controls > Protocol name > Connections > Client-side transport security settings > Peer certificate validation is enabled in SPS.
	duration	int	The duration of the connection. Computed value.
	end_time	ISO 8601 date	The ISO 8601 date of the end of the connection. For ongoing connections, the value is null.
	rule_num	string	The number of the line in the Channel policy applied to the channel.
	start_time	ISO 8601 date	The ISO 8601 date of the start of the connection.
	type	string	The type of the channel. Additional elements might be used with certain ICA, SSH and RDP channel types.
	verdict	string	The channel's connection verdict. Possible values are: accept The connection attempt was successful. deny The connection attempt was denied. four-eyes-deferred Four-eyes authorization is unable to progress as it is waiting for a remote username. four-eyes-error An internal error occurred during four-eyes authorization. four-eyes-reject The connection attempt was rejected by a four-eyes agent on SPS. four-eyes-timeout Four-eyes authorization timed out.
	command	string	Used with the session exec SSH channel type. The executed command.
	scp_path	string	Used with the session exec scp SSH channel type. The folder used for Secure Copy.
	subsystem_name	string	Used with the session subsystem sftp SSH channel type. The name of the used subsystem.
	originator.ip	string	Used with the local forward and remote forward SSH channel types. The source address of the forwarded traffic.
	originator.name	string	The source host name of the forwarded traffic. If this information is not available, the value is the IP address instead.
	originator.port	int	Used with the local forward and remote forward SSH channel types. The source port of the forwarded traffic.
	connected.ip	string	Used with the local forward and remote forward SSH channel types. The target address of the forwarded traffic.
	connected.name	string	The target host name of the forwarded traffic. If this information is not available, the value is the IP address instead.
	connected.port	int	Used with the local forward and remote forward SSH channel types. The target port of the forwarded traffic.
	dynamic_channel	string	Used with the dynamic virtual RDP channel type. The name of the dynamic channel.
	device_name	string	Used with the serial redirect, parallel redirect, printer redirect, disk redirect, and scard redirect RDP channel types. The name of the device.
	application	string	Used with ICA connections. The name of the application accessed in a seamless Citrix ICA connection.
	four_eyes_authorizer	string	The username of the user who authorized the session. Available only if four-eyes authorization is required for the channel.
	four_eyes_description	string	The description of the session submitted by the authorizer of the session. Available only if four-eyes authorization is required for the channel.

Client elements		Type	Description
client		Top level element	The IP address and port number of the client. For example: "client": { "ip": "10.20.30.40", "port": 59125 },
	ip	string	The IP address of the client.
	name	string	The host name of the client. If this information is not available, the value is the IP address instead.
	port	int	The port number of the client.

Server elements		Type	Description
server		Top level element	The IP address and port number of the remote server. For example: "server": { "ip": "10.20.30.40", "port": 55386 },
	ip	string	The IP address of the remote server.
	name	string	The host name of the remote server. If this information is not available, the value is the IP address instead.
	port	int	The port number of the remote server.

Server_local elements		Type	Description
server_local		Top level element	The IP address and port number of SPS. For example: "server_local": { "ip": "10.20.30.40", "port": 55386 },
	ip	string	The IP address of SPS.
	name	string	The host name of SPS. If this information is not available, the value is the IP address instead.
	port	int	The port number of SPS.

Target elements		Type	Description
target		Top level element	The IP address and port number the client targeted for connection. For example: "target": { "ip": "10.20.30.40", "port": 221 },
	ip	string	The IP address the client targeted for connection.
	name	string	The host name of the client targeted for connection. If this information is not available, the value is the IP address instead.
	port	int	The port number the client targeted for connection.

Examples:

All possible SSH channel types:

"channels": [
  {
    "key": "1",
    "meta": {
      "href": "/api/audit/sessions/1/channels/1"
    },
    "body": {
      "type": "session shell",
      "verdict": "accept",
      "start_time": 1451901988,
      "end_time": 1451902145,
      "duration": 157
    }
  },
  {
    "key": "2",
    "meta": {
      "href": "/api/audit/sessions/1/channels/2"
    },
    "body": {
      "type": "session exec",
      "verdict": "accept",
      "start_time": 1451902141,
      "end_time": 1451902145,
      "duration": 4,
      "command": "ls"
    }
  },
  {
    "key": "3",
    "meta": {
      "href": "/api/audit/sessions/1/channels/3"
    },
    "body": {
      "type": "session exec scp",
      "verdict": "accept",
      "start_time": 1451902141,
      "end_time": 1451902145,
      "duration": 4,
      "scp_path": "<path-to-folder>"
    }
  },
  {
    "key": "4",
    "meta": {
      "href": "/api/audit/sessions/1/channels/4"
    },
    "body": {
      "type": "session subsystem sftp",
      "verdict": "accept",
      "start_time": 1451902142,
      "end_time": 1451902145,
      "duration": 3,
      "subsystem_name": "sftp"
    }
  },
  {
    "key": "5",
    "meta": {
      "href": "/api/audit/sessions/1/channels/5"
    },
    "body": {
      "type": "local forward",
      "verdict": "accept",
      "start_time": 1451902145,
      "end_time": 1451902146,
      "duration": 1,
      "originator.address": "::1",
      "originator.port": 59578,
      "connected.address": "<server>",
      "connected.port": 22
    }
  },
  {
    "key": "6",
    "meta": {
      "href": "/api/audit/sessions/1/channels/6"
    },
    "body": {
      "type": "remote forward",
      "verdict": "accept",
      "start_time": 1451902145,
      "end_time": 1451902146,
      "duration": 1,
      "originator.address": "::1",
      "originator.port": 42212,
      "connected.address": "localhost",
      "connected.port": 9898
    }
  },
  {
    "key": "7",
    "meta": {
      "href": "/api/audit/sessions/1/channels/7"
    },
    "body": {
    "type": "x11 forward",
    "verdict": "deny",
    "start_time": 1451902149,
    "end_time": 1451902149,
    "duration": 0
    }
  }
 ]

All possible RDP channel types:

"channels": [
  {
    "key": "1",
    "meta": {
      "href": "/api/audit/sessions/1/channels/1"
    },
    "body": {
      "type": "drawing",
      "verdict": "accept",
      "start_time": 1451901988,
      "end_time": 1451902145,
      "duration": 157
    }
  },
  {
    "key": "2",
    "meta": {
      "href": "/api/audit/sessions/1/channels/2"
    },
    "body": {
      "type": "sound",
      "verdict": "accept",
      "start_time": 1451902141,
      "end_time": 1451902145,
      "duration": 4
    }
  },
  {
    "key": "3",
    "meta": {
      "href": "/api/audit/sessions/1/channels/3"
    },
    "body": {
      "type": "clipboard",
      "verdict": "accept",
      "start_time": 1451902141,
      "end_time": 1451902145,
      "duration": 4
    }
  },
  {
    "key": "4",
    "meta": {
      "href": "/api/audit/sessions/1/channels/4"
    },
    "body": {
      "type": "seamless",
      "verdict": "deny",
      "start_time": 1451902142,
      "end_time": 1451902142,
      "duration": 0
    }
  },
  {
    "key": "5",
    "meta": {
      "href": "/api/audit/sessions/1/channels/5"
    },
    "body": {
      "type": "dynamic virtual",
      "verdict": "accept",
      "start_time": 1451902145,
      "end_time": 1451902146,
      "duration": 1,
      "dynamic_channel": "Microsoft::Windows::RDS::Geometry::v08.01"
    }
  },
  {
    "key": "6",
    "meta": {
      "href": "/api/audit/sessions/1/channels/6"
    },
    "body": {
      "type": "custom",
      "verdict": "deny",
      "start_time": 1451902145,
      "end_time": 1451902145,
      "duration": 0
    }
  },
  {
    "key": "7",
    "meta": {
      "href": "/api/audit/sessions/1/channels/7"
    },
    "body": {
      "type": "serial redirect",
      "verdict": "accept",
      "start_time": 1451902149,
      "end_time": 1451902150,
      "duration": 1,
      "device_name": "COM1"
    }
  },
  {
    "key": "8",
    "meta": {
      "href": "/api/audit/sessions/1/channels/8"
    },
    "body": {
      "type": "parallel redirect",
      "verdict": "accept",
      "start_time": 1451902149,
      "end_time": 1451902150,
      "duration": 1,
      "device_name": "LPT1"
    }
  },
  {
    "key": "9",
    "meta": {
      "href": "/api/audit/sessions/1/channels/9"
    },
    "body": {
      "type": "printer redirect",
      "verdict": "accept",
      "start_time": 1451902149,
      "end_time": 1451902150,
      "duration": 1,
      "device_name": "PRN22"
    }
  },
  {
    "key": "10",
    "meta": {
      "href": "/api/audit/sessions/1/channels/10"
    },
    "body": {
      "type": "disk redirect",
      "verdict": "accept",
      "start_time": 1451902149,
      "end_time": 1451902150,
      "duration": 1,
      "device_name": "J:"
    }
  },
  {
    "key": "11",
    "meta": {
      "href": "/api/audit/sessions/1/channels/11"
    },
    "body": {
      "type": "scard redirect",
      "verdict": "accept",
      "start_time": 1451902149,
      "end_time": 1451902150,
      "duration": 1,
      "device_name": "SCARD"
    }
  }

Status and error codes

The following table lists the typical status and error codes for this request. For a complete list of error codes, see Application level error codes.

Code	Description	Notes
201	Created	The new resource was successfully created.
400	InvalidQuery	The requested filter or its value is invalid.
401	Unauthenticated	The requested resource cannot be retrieved because the client is not authenticated and the resource requires authorization to access it. The details section contains the path that was attempted to be accessed, but could not be retrieved.
403	Unauthorized	The requested resource cannot be retrieved because the client is not authorized to access it. The details section contains the path that was attempted to be accessed, but could not be retrieved.
404	NotFound	The requested object does not exist.

You can list, search, and filter the SPS session database at the /api/audit/sessions endpoint.

Limitations

NOTE: Searching in the session database with the basic search method has the limitation of returning a maximum of 10000 sessions from the session database. With pagination, you can only iterate through the first 10000 results. If you have to retrieve all sessions from the database that match your specified query and results in a match count of 10000 (or more), use the advanced search method.

Actions available with the basic search method

You can use the following actions:

?start

Display sessions that started after the specified date. Use the ISO 8601 format for the date, for example, 2017-01-25T10:00.
?end

Display sessions that ended before the specified date. Use the ISO 8601 format for the date, for example, 2017-01-25T10:00.
?fields

Display the selected properties (elements and values) of the listed sessions.
?q

Filter the list using one or more properties (elements) of the sessions.
?limit

Configure the pagination of the displayed results using the ?offset and ?limit parameters.

The ?limit parameter allows you to configure the maximum number of results to display on a page at once.

The default value of ?limit is 500.

NOTE: The default value of 500 is the maximum permitted value you can set for ?limit. If you set the ?limit parameter to a value bigger than 500, only the first 500 results will be displayed.
?offset

Configure the pagination of the displayed results using the ?offset and ?limit parameters.

The ?offset parameter allows you to configure the offset from the first result that is displayed. This can be useful if the number of items returned exceeds the number of items displayed on the first page, and you want to navigate to any of the subsequent items displayed on other pages.

The default value of ?offset is null.

NOTE: The maximum number of search results in One Identity Safeguard for Privileged Sessions is 10000. As a result, any ?offset values set to larger than 10000 will be ignored and the results exceeding the value of 10000 will not be displayed.
?sort

Sort the results based on the values of the fields.
?format

Configure the format of the displayed results.

The default value of ?format is json. If you do not configure the ?format parameter, the results will be displayed in JSON format.

To display search results in a CSV format, enter csv as a value.

To combine multiple expressions, use the & (ampersand) character, for example:

Display the target server and port of each active session:

curl --cookie cookies.txt "https://<IP-address-of-SPS>/api/audit/sessions?fields=psm.target.address,psm.target.port&q=active:true"

Display 10 sessions at once, and navigate to 31-40:

curl --cookie cookies.txt "https://<IP-address-of-SPS>/api/audit/sessions?limit=10&offset=31"

Search in metadata and session content at the same time:

curl --cookie cookies.txt "https://<IP-address-of-SPS>/api/audit/sessions?q=protocol:ssh&content=sudo"

NOTE: If you use curl, use quotation marks for the URL to avoid problems with the & (ampersand) character.

Response

The response to search or filtering action contains a list of the matching sessions, as well as some additional meta fields. For example:

{
    "items": [
        {
            "body": {
                "duration": 0,
                "name": "myname",
                "start_time": "2017-01-25T11:11:52.000+01:00"
            },
            "key": "2",
            "meta": {
                "href": "/api/audit/sessions/2"
            }
        },
        {
            "body": {
                "duration": 34,
                "name": "myname",
                "start_time": "2017-01-25T11:11:11.000+01:00"
            },
            "key": "10",
            "meta": {
                "href": "/api/audit/sessions/10"
            }
        }
    ],
    "meta": {
        "fields": [
            "start_time",
            "name",
            "duration"
        ],
        "first": "/api/audit/sessions?limit=500&offset=0&fields=start_time,name,duration&q=name%3Amyname&=duration",
        "href": "/api/audit/sessions",
        "last": "/api/audit/sessions?limit=500&offset=0&fields=start_time,name,duration&q=name%3Amyname&sort=duration",
        "limit": 500,
        "match_count": 2,
        "next": null,
        "offset": 0,
        "parent": "/api/audit",
        "previous": null
    }

Element	Type	Description
items		list	Top level element, a list containing the details of the matching sessions.
	body	JSON object	Contains the information returned about a session, that is, the fields selected with the ?fields expression. For example, if you used the fields=start_time,psm.gateway_username,duration expression in your query, then the body element contains these fields for each returned session: "body": { "duration": 0, "name": null, "start_time": "2017-01-25T11:11:52.000+01:00" },
	key	string	A globally unique string that identifies the session. This session ID has the following format: svc/<unique-random-hash>/<name-of-the-connection-policy>:<session-number-since-service-started>/<protocol>, for example, svc/5tmEaM7xdNi1oscgVWpbZx/ssh_console:1/ssh. Log messages related to the session also contain this ID. For example: 2015-03-20T14:29:15+01:00 demo.example zorp/scb_ssh[5594]: scb.audit(4): (svc/5tmEaM7xdNi1oscgVWpbZx/ssh_console:0/ssh): Closing connection; connection='ssh_console', protocol='ssh', connection_id='409829754550c1c7a27e7d', src_ip='10.40.0.28', src_port='39183', server_ip='10.10.20.35', server_port='22', gateway_username='', remote_username='example-username', verdict='ZV_ACCEPT' Note that when using the session ID in a REST call, you must replace the special characters in the ID with the hyphen (-) character. For example, if the session ID in the log message is svc/fNLgRmAyf5EtycgUYnKc1B/ssh_demo2:2, use the svc-fNLgRmAyf5EtycgUYnKc1B-ssh_demo2-2 ID in REST calls.

Element

Type

Description

items

list

Top level element, a list containing the details of the matching sessions.

body

JSON object

Contains the information returned about a session, that is, the fields selected with the ?fields expression. For example, if you used the fields=start_time,psm.gateway_username,duration expression in your query, then the body element contains these fields for each returned session:

"body": {
                "duration": 0,
                "name": null,
                "start_time": "2017-01-25T11:11:52.000+01:00"
            },

key

string

A globally unique string that identifies the session. This session ID has the following format: svc/<unique-random-hash>/<name-of-the-connection-policy>:<session-number-since-service-started>/<protocol>, for example, svc/5tmEaM7xdNi1oscgVWpbZx/ssh_console:1/ssh.

Log messages related to the session also contain this ID. For example:

2015-03-20T14:29:15+01:00 demo.example
zorp/scb_ssh[5594]: scb.audit(4):
(svc/5tmEaM7xdNi1oscgVWpbZx/ssh_console:0/ssh):
Closing connection; connection='ssh_console',
protocol='ssh', connection_id='409829754550c1c7a27e7d',
src_ip='10.40.0.28', src_port='39183',
server_ip='10.10.20.35', server_port='22',
gateway_username='', remote_username='example-username',
verdict='ZV_ACCEPT'

Note that when using the session ID in a REST call, you must replace the special characters in the ID with the hyphen (-) character. For example, if the session ID in the log message is svc/fNLgRmAyf5EtycgUYnKc1B/ssh_demo2:2, use the svc-fNLgRmAyf5EtycgUYnKc1B-ssh_demo2-2 ID in REST calls.

In addition to the usual meta elements of other endpoints, search results can contain the following additional elements.

Element		Type	Description
meta		JSON object	Top level element, a list containing meta information about the response.
	fields	list	Contains the list of data fields returned about each session, that is, the fields selected with the ?fields expression. For example, if you used the fields=start_time,psm.gateway_username,duration expression in your query, then the body element contains these fields for each returned session: "fields": [ "start_time", "name", "duration" ],
	limit	integer	The maximum number of sessions returned in a the response (by default, 500).
	match_count	integer	The number of results matching the query. NOTE: Searching in the session database with the basic search method has the limitation of returning a maximum of 10000 sessions from the session database. With pagination, you can only iterate through the first 10000 results. If you have to retrieve all sessions from the database that match your specified query and results in a match count of 10000 (or more), use the advanced search method.
	next	string	A query to retrieve the next set of search results, if match_count is higher than limit.
	offset	integer	Indicates the position of the results in this response, relative to the total number of results (match_count). Otherwise, its value is null.
	previous	string	A query to retrieve the previous set of search results, if match_count is higher than limit, and offset is higher than 0. Otherwise, its value is null.

Filtering

You can use the ?q option to filter the list using one or more property (element) of the sessions.

?q=protocol:ssh

You can escape special characters using the backslash character.

?q=server_username:\"Windows User\"

To add multiple elements to the filter, you can use the AND, AND NOT, and OR operators.

?q=protocol:ssh AND verdict:accept AND NOT name:admin

You can create groups using () (parentheses).

?q=(client.address:10.20.30.40 OR target.address:10.20.30.40) AND verdict:accept

You can also use () (parentheses) to add multiple possible values for a property.

?q=protocol:(ssh rdp)

You can use the * (asterisk) and ? (question mark) wildcards for string-type values.

?q=name:?dmi*

You can define ranges using [] (brackets) or {} (braces) and the TO operator. This only works for numeric (int) values.

[ means equal or higher than the following value
] means equal or lower than the preceding value
{ means higher than the following value
}means lower than the preceding value

For example, the following range resolves to 22:

?q=port:{21 TO 23}

You can also use the * (asterisk) wildcard in the range.

?q=start_time:[* TO 1461654799]

Note that not all connection data can be used for filtering. The available elements are:

active

Boolean, true means the session is ongoing (it is still active).
auth_method

String, the authentication method used.
channel_policy

String, the key of the channel policy.
client.address

String, the IP address of the client.
client.port

Integer, the port of the client.
psm.connection_policy

String, the key of the connection policy.
end_time

The date of the end of the session in ISO 8601 format.
name

String, the username used for authenticating against the gateway.
protocol

String, the protocol of the session.
server.address

String, the IP of the remote server.
psm.server_local.address

String, the IP of SPS.
psm.server_local.port

String, the port of SPS.
server.port

String, the port of the remote server.
server_username

String, the username used for authenticating on the remote server.
session_id

String, the identifier of the session.
start_time

The date of the start of the session in ISO 8601 format.
target.address

String, the IP the client targeted in the session.
target.port

Integer, the port the client targeted in the session.
verdict

String, the connection verdict. Possible values are:
- accept
  
  The connection attempt was successful.
- accept-terminated
  
  The connection violated a content policy, and was terminated by SPS.
- auth-fail
  
  Authentication failure.
- deny
  
  The connection was denied.
- fail
  
  The connection attempt failed.
- gw-auth-fail
  
  Gateway authentication failure.
- key-error
  
  The connection attempt failed due to a host key mismatch.
- user-mapping-fail
  
  The connection attempt failed due to a user mapping failure.

Content search in indexed audit trails

You can use the ?q=screen.content option to search for keywords that appear in the screen content of the audit trails. Such content is any text that appeared on the screen in terminal or graphical sessions, or commands that the user entered in terminal sessions. Note that content search works only if:

Indexing was enabled in the connection policy related to the audit trail during the session, and
the audit trail has already been indexed.

?q=screen.content:"my-search-expression"

You can use the Apache Lucene query syntax to create the search expression, but note the following points.

You must format the search expression as an URL, and escape special characters accordingly. For example, if your search expression is man iptables, you must escape the whitespace: man%20iptables

For a list of special (reserved) URL characters, see RFC3986.
Do not begin the expression with the * wildcard.

Examples:

Search for the word example

?q=screen.content:example

Search for the words example, examples, and so on:

?q=screen.content:example%3F

Search for the words example, examine, and so on:

?q=screen.content:exam%2A

Search in metadata and session content at the same time:

curl --cookie cookies.txt "https://<IP-address-of-SPS>/api/audit/sessions?q=protocol:ssh&content=sudo"

For further details and examples, see Searching in the contents of audit trails in the Administration Guide.

Displaying session data

You can use the ?fields option to display the selected data (body elements) of each session.

?fields=protocol

To list multiple elements, use the , (comma) character. Note that the response includes the selected fields in alphabetic order, not in the order they were specified.

?fields=protocol,name

To list all possible elements, use the fields=* expression.

?fields=*

Note that not all connection data can be displayed in the generated list. The available elements are:

active

Boolean, true means the connection is ongoing.
archived

Boolean, true means the session has been archived.
auth_method

String, the authentication method used.
channel_policy

String, the key of the channel policy.
client.address

String, the IP address of the client.
client.port

Integer, the port of the client.
connection_policy

String, the key of the connection policy.
duration

Integer, the duration of the session. Computed value.
end_time

The date of the end of the session in ISO 8601 format.
name

String, the username used for authenticating against the gateway.
protocol

String, the protocol of the session.
server.address

String, the IP of the remote server.
server_local.address

String, the IP of SPS.
server_local.port

Integer, the port of SPS.
server.port

Integer, the port of the remote server.
server_username

String, the username used for authenticating on the remote server.
session_id

String, the identifier of the session.
start_time

The date of the start of the session in ISO 8601 format.
target.address

String, the IP the client targeted in the session.
target.port

Integer, the port the client targeted in the session.

Date-specific search

To display search results only for specific date intervals, you can use the ?start and ?end options.

The ?start option selects the sessions that started after the specified date (based on the value of the start_time field).
The ?end option selects the sessions that ended before the specified date (based on the value of the end_time field).
Both options accept the date in ISO 8601 format.

?start=2017-01-25T11:11:52.000+01:00
?end=2017-01-25T11:41:52.000+01:00
?start=2017-01-24&end=2017-01-25

Examples:

Select sessions that started on January 20, 2017, or later:

?start=2017-01-20

Select sessions that started on 11:00 January 20, 2017, or later:

?start=2017-01-20T11:00

Select sessions that ended on January 20, 2017:

?end=2017-01-20

Select sessions started and ended on January 20, 2017:

?start=2017-01-20&end=2017-01-20

Select sessions started after 11:00, January 20, 2017, and ended before 09:00, January 21, 2017:

?start=2017-01-20T11:00&end=2017-01-21T09:00

Changing the display limit

You can use the ?limit option to change the number of items displayed at once. The default maximum limit is 500.

?limit=100

To navigate beyond the displayed set, use the offset option.

Navigating large datasets

You can use the ?offset option to navigate data sets that extend beyond the display limit. The default value of the offset is 0, this is the initially displayed set. To move to other items beyond the initial set, increase the value to a number that corresponds to the item where you want to start displaying results from.

Example: the display limit is the default 500, and the number of sessions is 1012. The initial 500 sessions are listed at:

?offset=0

To view sessions from 501 to 1000, change the offset to 501:

?offset=501

To display the remaining 12 sessions, change the offset to 1001:

?offset=1001

Sort the results

You can sort the search results using the sort expression, for example, based on the length of the sessions:

?sort=duration

You can use any field to sort the results. By default, sorting returns the results in ascending order, if you use ?sort=duration, then the shortest session is at the beginning of the list. To sort the results in descending order, add the minus sign (-) before the field name. For example, the response to the following expression starts with the longest session:

?sort=-duration

You can specify multiple fields to order the list. In this case, the list is first ordered using the first field, then the second, and so on. For example, to order the list first by duration, then by start time, use the following expression.

?sort=duration,start_time

The following example sorts the results by duration, and displays the start time, gateway username, and duration fields.

curl --cookie cookies.txt "https://<IP-address-of-SPS>/api/audit/sessions?sort=duration&fields=start_time,psm.gateway_username,duration"

Configure the format of the displayed results

The default value of ?format is json. If you do not configure the ?format parameter, the results will be displayed in JSON format.

?format=json

To display search results in a CSV format, enter csv as a value.

?format=csv

Example: querying sessions in CSV result format

Given that the following sessions were recorded:

{
  "1": {
    "channel": [
      {"channel_id": 1},
      {"channel_id": 2}
    ],
    "recording": {
      "session_id": 1,
      "archived": false,
      "channel_policy": "policy1",
      "content_reference_id": 1,
      "connection_policy": "connection1",
      "auth_method": "password",
      "target": {
        "port": 2222,
        "ip": "1.1.1.1",
        "name": "1.1.1.1"
      },
      "server_local": {
        "port": 46,
        "ip": "1.1.1.1",
        "name": "1.1.1.1"
      }
    },
    "user": {
      "server_username": "user1",
      "gateway_username": "user1"
    },
    "client": {
      "port": 48679,
      "ip": "2.2.2.2",
      "name": "2.2.2.2"
    },
    "active": false,
    "start_time": 1,
    "duration": 4,
    "server": {
      "port": 22,
      "ip": "2.2.2.2",
      "name": "2.2.2.2"
    },
    "end_time": 5,
    "protocol": "ssh"
  },
  "2": {
    "channel": [
      {"channel_id": 3},
      {"channel_id": 4}
    ],
    "recording": {
      "session_id": 2,
      "archived": false,
      "channel_policy": "policy2",
      "content_reference_id": 2,
      "connection_policy": "connection2",
      "auth_method": "password",
      "target": {
        "port": 2222,
        "ip": "1.1.1.1",
        "name": "1.1.1.1"
      },
      "server_local": {
        "port": 46,
        "ip": "1.1.1.1",
        "name": "1.1.1.1"
      }
    },
    "user": {
      "server_username": "user2",
      "gateway_username": "user2"
    },
    "client": {
      "port": 48680,
      "ip": "3.3.3.3",
      "name": "3.3.3.3"
    },
    "active": false,
    "start_time": 1,
    "duration": 4,
    "server": {
      "port": 24,
      "ip": "2.2.2.2",
      "name": "2.2.2.2"
    },
    "end_time": 7,
    "protocol": "ssh"
  }
}

When the query is the following:

curl --cookie cookies.txt "https://<IP-address-of-SPS>/api/audit/sessions?format=csv&fields=protocol,end_time,user.gateway_username,server.ip,client.ip,client.port"

The response is the following:

"Key","Protocol","End time","Gateway username","Server IP","Client IP","Client port"
"2","ssh","7","user2","2.2.2.2","3.3.3.3","48680"
"1","ssh","5","user1","2.2.2.2","2.2.2.2","48679"

Example: querying sessions in CSV result format with interesting events

Given that the following sessions were recorded:

{
  "1":{
    "origin": "RECORDING",
    "protocol": "SSH",
    "analytics": {
      "interesting_events": ["ssh", "sudo"],
      "similar_sessions": []
    },
    "recording": {
      "session_id": "1",
      "verdict": "ACCEPT",
      "audit_trail": "/var/lib/zorp/audit/532078660569910c6542b2/01/audit-scb_ssh-1451900800-1.zat",
      "connection_policy": "ssh1",
      "content_reference_id": 1
    }
  },
  "2":{
    "origin": "RECORDING",
    "protocol": "SSH",
    "analytics": {
      "interesting_events": ["sudo", "systemctl"],
      "similar_sessions": []
    },
    "recording": {
      "session_id": "2",
      "verdict": "ACCEPT",
      "connection_policy": "ssh2",
      "content_reference_id": 2
    }
  }
}

When the query is the following:

curl --cookie cookies.txt "https://<IP-address-of-SPS>/api/audit/sessions?sort=recording.session_id&format=csv&fields=recording.session_id,analytics.interesting_events,analytics.similar_sessions"

The response is the following:

"Key","Recording Session ID","Analytics Interesting events","Similar Sessions"
"1","1","ssh",""
"1","1","sudo",""
"2","2","sudo",""
"2","2","systemctl",""

Example: querying sessions in CSV result format with audit trail link

Given that the following sessions were recorded:

{
  "svc-paKzcMJwXghEFJ9UvsdqFU-sid-1": {
    "origin": "RECORDING",
    "protocol": "SSH",
    "recording": {
      "session_id": "1",
      "verdict": "ACCEPT",
      "audit_trail": "/var/lib/zorp/audit/532078660569910c6542b2/01/audit-scb_ssh-1451900800-1.zat",
      "connection_policy": "ssh1",
      "content_reference_id": 1
    }
  },
  "svc-paKzcMJwXghEFJ9UvsdqFU-sid-2": {
   "origin": "RECORDING",
    "protocol": "SSH",
    "recording": {
      "session_id": "2",
      "verdict": "ACCEPT",
      "connection_policy": "ssh2",
      "content_reference_id": 2
    }
  }
}

When the query is the following:

curl --cookie cookies.txt "https://<IP-address-of-SPS>/api/audit/sessions?format=csv&fields=trail_download_link"

The response is the following:

"Key","Audit trail download link"
"svc-paKzcMJwXghEFJ9UvsdqFU-sid-2",""
"svc-paKzcMJwXghEFJ9UvsdqFU-sid-1","https://127.0.0.1/api/audit/sessions/svc-paKzcMJwXghEFJ9UvsdqFU-sid-1/audit_trail"

One Identity Safeguard for Privileged Sessions 7.5.1 - REST API Reference Guide

Search, retrieve, download, and index sessions

Detailed information about this topic

Audited sessions

URL

Cookies

Sample request

Response

Examples:

Status and error codes

Download audit trails

Searching in the session database with the basic search method

Limitations

Actions available with the basic search method

Response

Filtering

Content search in indexed audit trails

Examples:

Displaying session data

Date-specific search

Examples:

Changing the display limit

Navigating large datasets

Sort the results

Configure the format of the displayed results

Example: querying sessions in CSV result format

Example: querying sessions in CSV result format with interesting events

Example: querying sessions in CSV result format with audit trail link

製品を選択してください:

サービス向上のために、「Purpose of your Chat（チャットの目的）」を記入してください。

お客様の不具合に推奨されるソリューション

One Identity Safeguard for Privileged Sessions 7.5.1 - REST API Reference Guide

Search, retrieve, download, and index sessions

Detailed information about this topic

Audited sessions

URL

Cookies

Sample request

Response

Examples:

Status and error codes

Download audit trails

Searching in the session database with the basic search method

Limitations

Actions available with the basic search method

Response

Filtering

Content search in indexed audit trails

Examples:

Displaying session data

Date-specific search

Examples:

Changing the display limit

Navigating large datasets

Sort the results

Configure the format of the displayed results

Example: querying sessions in CSV result format

Example: querying sessions in CSV result format with interesting events

Example: querying sessions in CSV result format with audit trail link