The api/audit/sessions/<session-id>/alerts endpoint lists the alerts triggered in a session (if any). For details on configuring alerts, see Real-time content monitoring with Content Policies.
An event is listed as alert only if the Actions > Store in Connection Database option is selected in the Content Policy used to handle the session.
GET https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/alerts
| Cookie name | Description | Required | Values |
|---|---|---|---|
| session_id | Contains the authentication token of the user | Required |
The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API. Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format). |
The following command lists the alerts of a session.
curl --cookie cookies "https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/alerts"
The following is a sample response received when listing the alerts of a session.
For details of the meta object, see Message format.
{
"items": [
{
"alert_type": "adp.event.command",
"channel_id": "0",
"matched_action": "ls",
"matched_content": "[myuser@examplehost ~]$ ls",
"matched_regexp": "ls",
"record_id": 94,
"rule_name": "PatternMatcherRule",
"time": "2017-04-25T13:26:39.144356"
},
{
"alert_type": "adp.event.command",
"channel_id": "0",
"matched_action": "man man",
"matched_content": "[myuser@examplehost ~]$ man man",
"matched_regexp": "man",
"record_id": 197,
"rule_name": "PatternMatcherRule",
"time": "2017-04-25T13:34:15.265411"
}
],
"meta": {
"first": "/api/audit/sessions/c7e51cebad1a3e2ade480909f7687b16/alerts?limit=500&offset=0",
"href": "/api/audit/sessions/c7e51cebad1a3e2ade480909f7687b16/alerts",
"last": "/api/audit/sessions/c7e51cebad1a3e2ade480909f7687b16/alerts?limit=500&offset=0",
"limit": 500,
"match_count": 3,
"next": null,
"offset": 0,
"parent": "/api/audit/sessions/c7e51cebad1a3e2ade480909f7687b16",
"previous": null,
"remaining_seconds": 600
}
}
| Element | Type | Description | |
|---|---|---|---|
| items | list | Top level element, a list containing the alerts of the session. | |
| alert_type | string |
The type of the event that triggered the alert. Possible values:
| |
| channel_id | string | The regular expression that matched the command line without prompt. | |
| matched_action | integer | A reference to the ID of the channel in the session where the event occurred. | |
| matched_content | text | The content that occurred in the session and triggered the alert. Note that this value contains the context of the match as well. For example, if a Content Policy triggers an alert if a user types the sudo command, then the psm.alerts.matched_content value contains the entire command line, including the command prompt, for example, myuser@examplehost:~$ man sudo | |
| matched_regexp | text | The regular expression (match field) of the Content Policy that matched a part of the content and triggered the alert. For details, see Real-time content monitoring with Content Policies. | |
| record_id | integer | The ID number of the alert within the session. | |
| rule_name | string | The name of the content policy rule that triggered the alert. Note that this is not the name of the Content Policy. | |
| time | string | The timestamp when the alert was triggered, for example, 2017-04-25T13:26:39.144356. | |
You can use the ?limit option to change the number of items displayed at once. The default limit is 500.
?limit=1000
To navigate beyond the displayed set, use the offset option.
You can use the ?offset option to navigate data sets that extend beyond the display limit. The default value of the offset is 0, this is the initially displayed set. To move to other items beyond the initial set, increase the value to a number that corresponds to the item where you want to start displaying results from.
Example: the display limit is the default 500, and the number of sessions is 1012. The initial 500 sessions are listed at:
?offset=0
To view sessions from 501 to 1000, change the offset to 501:
?offset=501
To display the remaining 12 sessions, change the offset to 1001:
?offset=1001
Sorting and filtering alerts is currently not supported. The items are automatically sorted by the record ID. The response includes every available field.
The api/audit/sessions/<session-id>/events endpoint lists the events extracted from a session (if any). Events are available only if the session is indexed. For details on configuring indexing, see Local services: configuring the indexer.
GET https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/events
| Cookie name | Description | Required | Values |
|---|---|---|---|
| session_id | Contains the authentication token of the user | Required |
The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API. Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format). |
The following command lists the events of a session.
curl --cookie cookies "https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/events"
The following is a sample response received when listing the events of a session.
For details of the meta object, see Message format.
{
"items": [
{
"action": "ls",
"channels_id": "0",
"content": "myuser@examplehost:~$ ls",
"record_id": 46,
"time": "2017-04-11T09:21:10.832",
"type": "command"
},
{
"action": "cd",
"channels_id": "0",
"content": "myuser@examplehost:~$ cd /cd",
"record_id": 64,
"time": "2017-04-11T09:21:15.488",
"type": "command"
},
{
"action": "cat 24hrs.txt",
"channels_id": "0",
"content": "myuser@examplehost:/var$ cat 24hrs.txt",
"record_id": 78,
"time": "2017-04-11T09:21:18.017",
"type": "command"
},
{
"action": "ls -la",
"channels_id": "0",
"content": "myuser@examplehost:/var$ ls -la",
"record_id": 95,
"time": "2017-04-11T09:21:21.04",
"type": "command"
},
{
"action": "echo example.txt",
"channels_id": "0",
"content": "myuser@examplehost:/var$ echo example.txt",
"record_id": 113,
"time": "2017-04-11T09:21:23.353",
"type": "command"
},
{
"action": "ls",
"channels_id": "0",
"content": "myuser@examplehost:/var$ man sudo",
"record_id": 148,
"time": "2017-04-11T09:21:27.017",
"type": "command"
}
],
"meta": {
"first": "/api/audit/sessions/7930f4308efe8aecd710202d815b76ff/events?limit=500&offset=0",
"href": "/api/audit/sessions/7930f4308efe8aecd710202d815b76ff/events",
"last": "/api/audit/sessions/7930f4308efe8aecd710202d815b76ff/events?limit=500&offset=0",
"limit": 500,
"next": null,
"offset": 0,
"parent": "/api/audit/sessions/7930f4308efe8aecd710202d815b76ff",
"previous": null
}
}
| Element | Type | Description | |
|---|---|---|---|
| items | list | Top level element, a list containing the alerts of the session. | |
| action | string | The command line without prompt in commands. | |
| channels_id | integer | A reference to the ID of the channel in the session where the event occurred. | |
| content | text | The event that occurred in the session. Note that this value contains the context of the event as well. For example, for command events in terminal sessions, the value contains the entire command line, including the command prompt. For example, myuser@examplehost:~$ man sudo | |
| record_id | integer | The ID number of the event within the session. | |
| type | string |
The type of the event. Possible values:
| |
| time | string | The timestamp when the event occurred, for example, 2017-04-25T13:26:39.144356. | |
You can use the ?limit option to change the number of items displayed at once. The default limit is 500.
?limit=1000
To navigate beyond the displayed set, use the offset option.
You can use the ?offset option to navigate data sets that extend beyond the display limit. The default value of the offset is 0, this is the initially displayed set. To move to other items beyond the initial set, increase the value to a number that corresponds to the item where you want to start displaying results from.
Example: the display limit is the default 500, and the number of sessions is 1012. The initial 500 sessions are listed at:
?offset=0
To view sessions from 501 to 1000, change the offset to 501:
?offset=501
To display the remaining 12 sessions, change the offset to 1001:
?offset=1001
You can filter events at the /api/audit/sessions/<session-id>/events endpoint. Use the ?q option to filter the list using one or more properties (elements) of the sessions.
?q=content:sudo
You can escape special characters using the backslash character.
?q=content:\"Copying Files\"
To add multiple elements to the filter, you can use the AND, AND NOT, and OR operators.
content:ls AND content:cp AND NOT content:mv
You can create groups using () (parentheses).
?q=(content:rm OR content:mv) AND channels_id:5
You can also use () (parentheses) to add multiple possible values for a property.
?q=content:(sudo rm)
You can use the * (asterisk) and ? (question mark) wildcards for string-type values.
?q=content:?dmi*
You can define ranges using [] (brackets) or {} (braces) and the TO operator. This only works for numeric (int) values.
[ means equal or higher than the following value
] means equal or lower than the preceding value
{ means higher than the following value
}means lower than the preceding value
For example, the following range resolves to 2:
?q=channels_id:{1 TO 3}
You can also use the * (asterisk) wildcard in the range.
?q=channels_id:[* TO 5]
Note that not all connection data can be used for filtering. The available elements are:
channels_id
Integer, the channel in the session where the event occurred.
content
Text, the event that occurred in the session.
record_id
Integer, the identifier of the event in the session.
time
String, the timestamp when the event occurred.
type
String, the type of the event:
command: A command entered in SSH or Telnet.
screen.content: Screen content.
screen.creditcard: Credit card numbers detected. Displayed only as an alert, not visible in the events.
screen.windowtitle: The title of the window in graphic protocols.
The api/audit/sessions/<session-id>/indexing endpoint lists the indexing-related details in this session (if any). For details on configuring indexing, see Local services: configuring the indexer.
GET https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/indexers
| Cookie name | Description | Required | Values |
|---|---|---|---|
| session_id | Contains the authentication token of the user | Required |
The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API. Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format). |
The following command lists the indexing-related details of a session.
curl --cookie cookies "https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/indexing"
The following is a sample response received when listing the indexing-related details of a session.
For details of the meta object, see Message format.
{
"items": [
{
"config": {
"command": {
"enabled": true
},
"keyboard": {
"buffer_interval": 3,
"enabled": false
},
"mouse": {
"buffer_interval": 1,
"enabled": false
},
"near_realtime": false,
"ocr_languages": [],
"screen": {
"enabled": true,
"omnipage_trade_off": "TO_ACCURATE"
},
"title": {
"enabled": true
}
},
"statistics": {
"cpu_time": 5,
"duration": 149,
"start_time": 1542116524143
},
"status": "COMPLETED",
"version": {
"adp": "6.0.20",
"worker": "4.0.26"
}
}
],
"meta": {
"first": "/api/audit/sessions/c7e51cebad1a3e2ade480909f7687b16/indexer?limit=500&offset=0",
"href": "/api/audit/sessions/c7e51cebad1a3e2ade480909f7687b16/indexer",
"last": "/api/audit/sessions/c7e51cebad1a3e2ade480909f7687b16/indexer?limit=500&offset=0",
"limit": 500,
"match_count": 1,
"next": null,
"offset": 0,
"parent": "/api/audit/sessions/rUhhQZ3jYsY1NDWYp9DEpq",
"previous": null,
"remaining_seconds": 599
}
}
| Element | Type | Description | |
|---|---|---|---|
| items | list |
Top level element, a list containing the indexing-related details of the session. For details, see indexer_info section in"List of available search filters" in the Administration Guide. | |
You can use the ?limit option to change the number of items displayed at once. The default limit is 500.
?limit=1000
To navigate beyond the displayed set, use the offset option.
You can use the ?offset option to navigate data sets that extend beyond the display limit. The default value of the offset is 0, this is the initially displayed set. To move to other items beyond the initial set, increase the value to a number that corresponds to the item where you want to start displaying results from.
Example: the display limit is the default 500, and the number of sessions is 1012. The initial 500 sessions are listed at:
?offset=0
To view sessions from 501 to 1000, change the offset to 501:
?offset=501
To display the remaining 12 sessions, change the offset to 1001:
?offset=1001
The api/audit/sessions/<session-id>/trail_downloads endpoint lists the details of audit-trail downloads in this session (if any). For details on downloading audit trails, see Local services: configuring the indexer.
GET https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/trail_downloads
| Cookie name | Description | Required | Values |
|---|---|---|---|
| session_id | Contains the authentication token of the user | Required |
The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API. Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format). |
The following command lists the indexing-related details of a session.
curl --cookie cookies "https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/trail_downloads"
The following is a sample response received when listing the indexing-related details of a session.
For details of the meta object, see Message format.
{
"items": [
{
"from_api": false,
"ip_address": "10.20.30.40",
"time": "2018-11-20T11:10:19.000Z",
"username": "admin"
},
{
"from_api": false,
"ip_address": "10.20.30.40",
"time": "2018-11-20T11:10:38.000Z",
"username": "admin"
}
],
"meta": {
"first": "/api/audit/sessions/c7e51cebad1a3e2ade480909f7687b16/indexer?limit=500&offset=0",
"href": "/api/audit/sessions/c7e51cebad1a3e2ade480909f7687b16/indexer",
"last": "/api/audit/sessions/c7e51cebad1a3e2ade480909f7687b16/indexer?limit=500&offset=0",
"limit": 5,
"match_count": 2,
"next": null,
"offset": 0,
"parent": "/api/audit/sessions/rUhhQZ3jYsY1NDWYp9DEpq",
"previous": null,
"remaining_seconds": 599
}
}
| Element | Type | Description | |
|---|---|---|---|
| items | list | Top level element, a list containing the indexing-related details of the session. | |
| from_api | boolean | True, if the audit trail was not downloaded from the GUI, but through SOAP or REST API. | |
| ip_address | string | The IP address of the client that downloaded the audit trail. | |
| time | boolean | The exact time when the user downloaded the audit trail file. | |
| username | string | The user name of the user who downloaded the audit trail. | |
You can use the ?limit option to change the number of items displayed at once. The default limit is 500.
?limit=1000
To navigate beyond the displayed set, use the offset option.
You can use the ?offset option to navigate data sets that extend beyond the display limit. The default value of the offset is 0, this is the initially displayed set. To move to other items beyond the initial set, increase the value to a number that corresponds to the item where you want to start displaying results from.
Example: the display limit is the default 500, and the number of sessions is 1012. The initial 500 sessions are listed at:
?offset=0
To view sessions from 501 to 1000, change the offset to 501:
?offset=501
To display the remaining 12 sessions, change the offset to 1001:
?offset=1001
© 2024 One Identity LLC. ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center