One Identity Safeguard for Privileged Sessions 6.0.1

Message format How to configure SPS using REST How to configure SPS using REST: a sample transaction

Authenticate to the SPS REST API Authenticate to the SPS REST API using X.509 certificate Retrieve user information Checking the transaction status Open a transaction Commit a transaction Delete a transaction Reviewing the changelog of a transaction Application level error codes Navigating the configuration of SPS Modifying the configuration of SPS

Delete an object Headers Headers

Basic settings

Retrieve basic firmware and host information Network settings

Web interface Network configuration options DNS servers Routing between interfaces Naming options Network addresses Routing table Local services of SPS Local services: Web login for administrators Local services: Web login for users

Date and time

Date & time NTP servers Timezone

Logs, monitoring and alerts

Management options Syslog server settings Disk fill-up prevention Mail settings Health monitoring SNMP settings SNMP traps Local services: access for SNMP agents Alerting System alerts Traffic alerts

User management and access control

User management and access control Authentication and user database settings Privileges of usergroups Audit data access rules Active sessions Manage users and usergroups locally on SPS Manage usergroups locally on SPS Manage users locally on SPS

Managing SPS

Troubleshooting options Internal certificates Headers Headers Headers Local services: enabling SSH access to the SPS host RPC API Manage the SPS license Change contact information Splunk integration Manage Safeguard for Privileged Sessions clusters

Promote a Safeguard for Privileged Sessions node to be the Central Management node in a new cluster Join node(s) to the cluster Query join status Assign a role to a node Query nodes Query one particular node Query the status of all nodes in the cluster Query the status of one particular node Upload and enable a configuration synchronization plugin Disable a configuration synchronization plugin

General connection settings

Channel policy Policies Archive/Cleanup policy Audit policies Backup policy Real-time content monitoring with Content Policies LDAP servers Signing CA policies Time policy Trusted Certificate Authorities Local user databases User lists

HTTP connections

HTTP connections HTTP connection policies HTTP authentication policies Global HTTP options HTTP settings policies

Citrix ICA connections

ICA connections ICA connection policies ICA channels Global ICA options ICA settings policies

RDP connections

RDP connections RDP connection policies RDP channels Configuring domain membership Global RDP options RDP settings policies

SSH connections

SSH connections SSH connection policies SSH channels SSH authentication policies Global SSH options SSH settings policies SSH host keys and certificates

Telnet connections

Telnet connections Telnet connection policies Global Telnet options

VNC connections

VNC connections VNC connection policies Global VNC options

Search, download, and index sessions

Audited sessions Download audit trails Searching in the session database Searching in connection content Session statistics Session histogram Session alerts Session events Indexing sessions Session audit trail downloads Local services: configuring the indexer Indexer policies

Reporting

Reporting Reports Built-in subchapters Pre-defined reports Content subchapters Custom subchapters Connection statistics subchapters

Health and maintenance

Monitor appliance health status

Advanced authentication and authorization

Usermapping policy Plugins Authentication and authorization plugins Credential store plugins Credential stores

Completing the Welcome Wizard using REST

Enable and configure analytics using REST

Enable One Identity Safeguard for Privileged Analytics Configure One Identity Safeguard for Privileged Analytics

Session statistics

Search, download, and index sessions > Session statistics

The api/audit/sessions/stats endpoint provides statistics about recorded sessions (active and closed).

URL

GET https://<IP-address-of-SPS>/api/audit/sessions/stats?field=<field-name>

Cookies

Cookie name	Description	Required	Values
session_id	Contains the authentication token of the user	Required	The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API. Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format).

Cookie name

Description

Required

Values

session_id

Contains the authentication token of the user

Required

The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API.

Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format).

Sample request

The following command retrieves statistical data about sessions.

curl --cookie cookies https://<IP-address-of-SPS>/api/audit/sessions/stats?field=<field-name>

Request parameters

Use the following parameters to fine-tune your request for statistics:

?q: Narrow down the scope of statistics using one or more properties (elements) of the sessions.
?field: Request statistics for the selected properties (elements and values) of sessions (for example, protocol).

Using this parameter is mandatory.
?sub_fields: Request sub statistics for the selected properties (elements and values) of sessions (for example, protocol).

This parameter only accepts a single parameter. If more than one parameter is listed, only the first will be considered.
?size: Limit the range of values displayed in the statistics for a given field. Statistics will be shown only for the top size number of most frequently occurring values (that is, values with the highest number of counts).

Take the following example. If you query "/api/audit/sessions/stats?field=protocol&size=2", and the following sessions were recorded:
```
...
{
  "Alpha": {
    "protocol": "http"
  },
  "Bravo": {
    "protocol": "ssh"
  },
  "Charlie": {
    "protocol": "rdp"
  },
  "Delta": {
    "protocol": "rdp"
  },
  "Echo": {
    "protocol": "rdp"
  },
  "Foxtrot": {
    "protocol": "http"
  },
  "Golf": {
    "protocol": "http"
  }
}
...
```
The response contains:
```
...
{
 "meta": {
    "href": "/api/audit/sessions/stats",
    "parent": "/api/audit/sessions",
    "others": 1,
    "field": "protocol",
    "size": 2
 }
}
...
```
And the response items look like the snippet below. That is, in this example, there will be no statistics for "protocol": "ssh". The top 2 values are "rdp" and "http", with a count of 3 each. "ssh" occurred only once, so it did not make it to the top 2 most frequent values.
```
...
[
 {"count": 3, "value": "http"},
 {"count": 3, "value": "rdp"}
...
```
?start: Statistics are returned for sessions that started after the specified date. Use the ISO 8601 format for the date, for example, 2017-01-25T10:00.
?end: Statistics are returned for sessions that ended before the specified date. Use the ISO 8601 format for the date, for example, 2017-01-25T11:00.

?content: Statistics are returned for indexed sessions that contain the type of content specified.

NOTE:

When performing a content query, the maximum number of results returned is 3000. When this limit is exceeded, the scope of statistics is limited to the first 3000 sessions (even if there are more than 3000 sessions that match your criteria).

Response

The following snippet is a sample response received when retrieving statistics about the protocol field.

For details of the meta object, see Message format.

Those fields of the meta object that are specific to statistics are collected in table Element .

{
    "items": [
        {
            "count": 7,
            "value": "ssh"
        }
    ],
    "meta": {
        "field": "protocol",
        "href": "/api/audit/sessions/stats",
        "others": 0,
        "parent": "/api/audit/sessions",
        "remaining_seconds": 600,
        "size": 10
    }
}

Element		Type	Description
body, or items when a list is returned		Top-level element (string)	Contains the properties that are in the scope of the requested statistics.
	count	integer	Indicates the number of sessions included in the scope of statistics.
	value	string	Contains the value of the field that you requested statistics about.
meta		Top-level element	Contains links to different parts of the REST service.
	field	string	Contains the name of the field that you requested statistics about.
	sub_fields	string	Contains the name of the sub field that you requested statistics about.
	others	integer	Some values of the field that you specified in your query are not included in the scope of statitics. This happens when a specific value occurs fewer times in the examined sessions than the aggregation size. The others field indicates the number of those distinct values that are not included in the statistics. For a detailed explanation with an example, see ?size.
	size	integer	The size that you specified in your query.

Example 1:

If you query "/api/audit/sessions/stats?field=protocol", and the following sessions were recorded:

...
{
  "Alpha": {
    "protocol": "ssh"
  },
  "Bravo": {
    "protocol": "ssh"
  },
  "Charlie": {
    "protocol": "rdp"
  },
  "Delta": {
    "protocol": "rdp"
  },
  "Echo": {
    "protocol": "rdp"
  },
  "Foxtrot": {
    "protocol": "ssh"
  },
  "Golf": {
    "protocol": "ssh"
  }
}
...

The response contains:

...
{
  "meta": {
    "href": "/api/audit/sessions/stats",
    "parent": "/api/audit/sessions",
    "others": 0,
    "field": "protocol"
  }
}
...

The response items contain:

...
[
 {"count": 4, "value": "ssh"},
 {"count": 3, "value": "rdp"}  
...

Example 2:

If you query "/api/audit/sessions/stats?field=protocol&content=login&start=2017-01-02&end=2017-01-03&q=psm.content_reference_id%3A%5B3%20TO%206%5D", and the following sessions were recorded:

{
  "Alpha": {
    "protocol": "ssh",
    "start_time": "2017-01-01",
    "end_time": "2017-01-02",
    "recording": {
      "content_reference_id": 1
    }
  },
  "Bravo": {
    "protocol": "ssh",
    "start_time": "2017-01-01",
    "end_time": "2017-01-02",
    "recording": {
      "content_reference_id": 2
    }
  },
  "Charlie": {
    "protocol": "rdp",
    "start_time": "2017-01-01",
    "end_time": "2017-01-02",
    "recording": {
      "content_reference_id": 3
    }
  },
  "Delta": {
    "protocol": "rdp",
    "start_time": "2017-01-03",
    "end_time": "2017-01-04",
    "psm": {
      "content_reference_id": 4
    }
  },
  "Echo": {
    "protocol": "rdp",
    "start_time": "2017-01-03",
    "end_time": "2017-01-04",
    "recording": {
      "content_reference_id": 5
    }
  },
  "Foxtrot": {
    "protocol": "ssh",
    "start_time": "2017-01-04",
    "end_time": "2017-01-06",
    "recording": {
      "content_reference_id": 6
    }
  },
  "Golf": {
    "protocol": "ssh",
    "start_time": "2017-01-02",
    "end_time": "2017-01-10",
    "recording": {
      "content_reference_id": 7
    }
  }
}

And the following sessions match when running the content query:

| trail_id | rank  | hits_count |
|    1     | 1.555 | 1          |
|    2     | 1.555 | 1          |
|    3     | 1.555 | 1          |
|    4     | 1.555 | 1          |
|    6     | 1.555 | 1          |

The response contains:

...
{
  "meta": {
    "href": "/api/audit/sessions/stats",
    "parent": "/api/audit/sessions",
    "others": 0,
    "field": "protocol"
  }
}
...

The response items contain:

...
[
 {"count": 2, "value": "rdp"} 
...

Example 3:

If you query "/api/audit/sessions/stats?field=user.gateway_username&?sub_fields=protocol&?size=1", and the following sessions were recorded:

...
{
  "Alpha": {
    "protocol": "ssh",
    "user": {
      "gateway_username": "user-Alpha"
    }
  },
  "Bravo": {
    "protocol": "ssh",
    "user": {
      "gateway_username": "user-Bravo"
    }
  },
  "Charlie": {
    "protocol": "rdp",
    "user": {
      "gateway_username": "user-Charlie"
    }
  },
  "Delta": {
    "protocol": "rdp",
    "user": {
      "gateway_username": "user-Alpha"
    }
  },
  "Echo": {
    "protocol": "rdp",
    "user": {
      "gateway_username": "user-Alpha"
    }
  },
  "Foxtrot": {
    "protocol": "ssh",
    "user": {
      "gateway_username": "user-Alpha"
    }
  },
  "Golf": {
    "protocol": "ssh",
    "user": {
      "gateway_username": "user-Alpha"
    }
  },
  "Hotel": {
    "protocol": "ssh",
    "user": {
      "gateway_username": "user-Delta"
    }
  }
}
...

The response contains:

...
{
  "meta": {
    "href": "/api/audit/sessions/stats",
    "parent": "/api/audit/sessions",
    "others": 3
  }
}
...

The response items contain:

...
[
  {
    "buckets": [
      {
        "count": 3,
        "value": "ssh"
      }
    ],
    "count": 5,
    "others": 2,
    "value": "user-Alpha"
  }
]  
...

Status and error codes

The following table lists the typical status and error codes for this request. For a complete list of error codes, see Application level error codes.

Code	Description	Notes
200	OK	The query was well-formed and statistics have been successfully retrieved.
400	InvalidQueryValue	The query is invalid, for example, it has an invalid value.
500	SearchUnavailable	The search backend is inaccessible.

Session histogram

Search, download, and index sessions > Session histogram

The api/audit/sessions/histogram endpoint provides a histogram about the recorded sessions.

URL

GET https://<IP-address-of-SPS>/api/audit/sessions/histogram

Cookies

Cookie name	Description	Required	Values
session_id	Contains the authentication token of the user	Required	The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API. Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format).

Cookie name

Description

Required

Values

session_id

Contains the authentication token of the user

Required

Sample request

The following command retrieves statistical data about sessions.

curl --cookie cookies https://<IP-address-of-SPS>/api/audit/sessions/histogram

Request parameters

Use the following parameters to fine-tune your request for statistics:

?q: Narrow down the scope of the histogram using one or more properties (elements) of the sessions.
?field: Create a histogram for the selected properties (elements and values) of sessions (for example, protocol).

Using this parameter is mandatory.
?bin-size: Determines the size of the unit for the histogram, for example, hour. SPS splits the queried period to intervals of this unit, and returns the number of sessions to each interval. For example, if you query an histogram from 2018-02-12:14:40 to 2018-02-16:14:40, and you set the bin-size to day, then SPS will return five datasets (one for each day). If you set the bin-size to week, then SPS will return only one dataset.
?start: Create a histogram from the sessions that started after the specified date. Use the ISO 8601 format for the date, for example, 2017-01-25T10:00. By default, this is the one month before the date of the request.
?end: Create a histogram from the sessions that ended before the specified date. Use the ISO 8601 format for the date, for example, 2017-01-25T11:00. By default, this is the date of the request.
?size: Limit the range of values displayed in the histogram for a given field. The histogram will only be created for the top size number of most frequently occurring values (that is, values with the highest number of counts).

Response

The following snippet is a sample response received when retrieving a histogram about the audited sessions.

For details of the meta object, see Message format.

Those fields of the meta object that are specific to histograms are described in table Element .

{
"body": {
    "buckets": [
        { "active_count": 61, "id": "2018-01-15T12:00:00.000Z", "start_count": 61 },
        { "active_count": 99, "id": "2018-01-15T13:00:00.000Z", "start_count": 89 },
        { "active_count": 39, "id": "2018-01-15T14:00:00.000Z", "start_count": 24 },
        { "active_count": 62, "id": "2018-01-15T15:00:00.000Z", "start_count": 62 },
        { "active_count": 92, "id": "2018-01-15T16:00:00.000Z", "start_count": 81 },
        { "active_count": 27, "id": "2018-01-15T17:00:00.000Z", "start_count": 19 }
    ]
},

"key": "histogram",
"meta":
    {
        "bin_size": "month",
        "field": "recording.connection_policy",
        "href": "/api/audit/sessions/histogram",
        "parent": "/api/audit/sessions",
        "remaining_seconds": 599,
        "time_zone": "Etc/UTC",
        "size": "10"
    }
}

Element			Type	Description
body			Top-level element (string)	Contains the properties that are in the scope of the requested histogram.
	buckets		list	Contains the details of the histogram.
		active_count	integer	The number of sessions that were active in this interval.
		id	date	The starting date of the interval in ISO 8601 format.
		start_count	integer	The number of sessions that were started in this interval.
meta			Top-level element (JSON object)	Contains metadata about the endpoint and the histogram.
	bin_size		string	The size of the intervals used to create the histogram. You can change this using the ?bin_size parameter of the request. Default value: month. Possible values: second, minute, hour, day, week, month, year
	field		string	Contains the name of the field that you requested statistics about.
	end		date	The date set in the ?end parameter of the request. By default, this is the date of the request.
	start		date	The date set in the ?start parameter of the request. By default, this is one month before the date of the request.
	time_zone		string	The time zone to use when calculating the intervals of the histogram, for example, Etc/UTC. By default, SPS uses UTC+0 (Zulu Time Zone). For the list of available time zones, see Element .
	size		integer	The size that you specified in your query.

Status and error codes

The following table lists the typical status and error codes for this request. For a complete list of error codes, see Application level error codes.

Code	Description	Notes
200	OK	The query was well-formed and the histogram has been successfully retrieved.
400	TooMuchBucketsInResult	Using the requested bin_size would result in too many intervals for the queried period.
400	NotSupportedContentOption	This endpoint does not support filtering in the content of sessions.

Session alerts

Search, download, and index sessions > Session alerts

The api/audit/sessions/<session-id>/alerts endpoint lists the alerts triggered in a session (if any). For details on configuring alerts, see Real-time content monitoring with Content Policies.

An event is listed as alert only if the Actions > Store in Connection Database option is selected in the Content Policy used to handle the session.

URL

GET https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/alerts

Cookies

Cookie name	Description	Required	Values
session_id	Contains the authentication token of the user	Required	The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API. Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format).

Cookie name

Description

Required

Values

session_id

Contains the authentication token of the user

Required

Sample request

The following command lists the alerts of a session.

curl --cookie cookies "https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/alerts"

Response

The following is a sample response received when listing the alerts of a session.

For details of the meta object, see Message format.

{
    "items": [
        {
            "alert_type": "adp.event.command",
            "channel_id": "0",
            "matched_action": "ls",
            "matched_content": "[myuser@examplehost ~]$ ls",
            "matched_regexp": "ls",
            "record_id": 94,
            "rule_name": "PatternMatcherRule",
            "time": "2017-04-25T13:26:39.144356"
        },
        {
            "alert_type": "adp.event.command",
            "channel_id": "0",
            "matched_action": "man man",
            "matched_content": "[myuser@examplehost ~]$ man man",
            "matched_regexp": "man",
            "record_id": 197,
            "rule_name": "PatternMatcherRule",
            "time": "2017-04-25T13:34:15.265411"
        }
    ],
    "meta": {
        "first": "/api/audit/sessions/c7e51cebad1a3e2ade480909f7687b16/alerts?limit=500&offset=0",
        "href": "/api/audit/sessions/c7e51cebad1a3e2ade480909f7687b16/alerts",
        "last": "/api/audit/sessions/c7e51cebad1a3e2ade480909f7687b16/alerts?limit=500&offset=0",
        "limit": 500,
        "match_count": 3,
        "next": null,
        "offset": 0,
        "parent": "/api/audit/sessions/c7e51cebad1a3e2ade480909f7687b16",
        "previous": null,
        "remaining_seconds": 600
    }
}

Element		Type	Description
items		list	Top level element, a list containing the alerts of the session.
	alert_type	string	The type of the event that triggered the alert. Possible values: adp.event.command: A command entered in SSH or Telnet. adp.event.screen.content: Alert triggered by the screen content. adp.event.screen.creditcard: Credit card numbers detected. Displayed only as an alert, not visible in the events. adp.event.screen.windowtitle: The title of the window in graphic protocols.
	channel_id	string	The regular expression that matched the command line without prompt.
	matched_action	integer	A reference to the ID of the channel in the session where the event occurred.
	matched_content	text	The content that occurred in the session and triggered the alert. Note that this value contains the context of the match as well. For example, if a Content Policy triggers an alert if a user types the sudo command, then the psm.alerts.matched_content value contains the entire command line, including the command prompt, for example, myuser@examplehost:~$ man sudo
	matched_regexp	text	The regular expression (match field) of the Content Policy that matched a part of the content and triggered the alert. For details, see Real-time content monitoring with Content Policies.
	record_id	integer	The ID number of the alert within the session.
	rule_name	string	The name of the content policy rule that triggered the alert. Note that this is not the name of the Content Policy.
	time	string	The timestamp when the alert was triggered, for example, 2017-04-25T13:26:39.144356.

Changing the display limit

You can use the ?limit option to change the number of items displayed at once. The default limit is 500.

?limit=1000

To navigate beyond the displayed set, use the offset option.

Navigating large datasets

You can use the ?offset option to navigate data sets that extend beyond the display limit. The default value of the offset is 0, this is the initially displayed set. To move to other items beyond the initial set, increase the value to a number that corresponds to the item where you want to start displaying results from.

Example: the display limit is the default 500, and the number of sessions is 1012. The initial 500 sessions are listed at:

?offset=0

To view sessions from 501 to 1000, change the offset to 501:

?offset=501

To display the remaining 12 sessions, change the offset to 1001:

?offset=1001

Sorting and filtering

Sorting and filtering alerts is currently not supported. The items are automatically sorted by the record ID. The response includes every available field.

Session events

Search, download, and index sessions > Session events

The api/audit/sessions/<session-id>/events endpoint lists the events extracted from a session (if any). Events are available only if the session is indexed. For details on configuring indexing, see Local services: configuring the indexer.

URL

GET https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/events

Cookies

Cookie name	Description	Required	Values
session_id	Contains the authentication token of the user	Required	The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API. Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format).

Cookie name

Description

Required

Values

session_id

Contains the authentication token of the user

Required

Sample request

The following command lists the events of a session.

curl --cookie cookies "https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/events"

Response

The following is a sample response received when listing the events of a session.

For details of the meta object, see Message format.

{
    "items": [
        {
            "action": "ls",
            "channels_id": "0",
            "content": "myuser@examplehost:~$ ls",
            "record_id": 46,
            "time": "2017-04-11T09:21:10.832",
            "type": "command"
        },
        {
            "action": "cd",
            "channels_id": "0",
            "content": "myuser@examplehost:~$ cd /cd",
            "record_id": 64,
            "time": "2017-04-11T09:21:15.488",
            "type": "command"
        },
        {
            "action": "cat 24hrs.txt",
            "channels_id": "0",
            "content": "myuser@examplehost:/var$ cat 24hrs.txt",
            "record_id": 78,
            "time": "2017-04-11T09:21:18.017",
            "type": "command"
        },
        {
            "action": "ls -la",
            "channels_id": "0",
            "content": "myuser@examplehost:/var$ ls -la",
            "record_id": 95,
            "time": "2017-04-11T09:21:21.04",
            "type": "command"
        },
        {
            "action": "echo example.txt",
            "channels_id": "0",
            "content": "myuser@examplehost:/var$ echo example.txt",
            "record_id": 113,
            "time": "2017-04-11T09:21:23.353",
            "type": "command"
        },
        {
            "action": "ls",
            "channels_id": "0",
            "content": "myuser@examplehost:/var$ man sudo",
            "record_id": 148,
            "time": "2017-04-11T09:21:27.017",
            "type": "command"
        }
    ],
    "meta": {
        "first": "/api/audit/sessions/7930f4308efe8aecd710202d815b76ff/events?limit=500&offset=0",
        "href": "/api/audit/sessions/7930f4308efe8aecd710202d815b76ff/events",
        "last": "/api/audit/sessions/7930f4308efe8aecd710202d815b76ff/events?limit=500&offset=0",
        "limit": 500,
        "next": null,
        "offset": 0,
        "parent": "/api/audit/sessions/7930f4308efe8aecd710202d815b76ff",
        "previous": null
    }
}

Element		Type	Description
items		list	Top level element, a list containing the alerts of the session.
	action	string	The command line without prompt in commands.
	channels_id	integer	A reference to the ID of the channel in the session where the event occurred.
	content	text	The event that occurred in the session. Note that this value contains the context of the event as well. For example, for command events in terminal sessions, the value contains the entire command line, including the command prompt. For example, myuser@examplehost:~$ man sudo
	record_id	integer	The ID number of the event within the session.
	type	string	The type of the event. Possible values: command: A command entered in SSH or Telnet. file_transfer: A file transfer event. http_request: An HTTP request initiated during the session. window_title: The title of the window in graphic protocols.
	time	string	The timestamp when the event occurred, for example, 2017-04-25T13:26:39.144356.

Changing the display limit

You can use the ?limit option to change the number of items displayed at once. The default limit is 500.

?limit=1000

To navigate beyond the displayed set, use the offset option.

Navigating large datasets

Example: the display limit is the default 500, and the number of sessions is 1012. The initial 500 sessions are listed at:

?offset=0

To view sessions from 501 to 1000, change the offset to 501:

?offset=501

To display the remaining 12 sessions, change the offset to 1001:

?offset=1001

Filtering

You can filter events at the /api/audit/sessions/<session-id>/events endpoint. Use the ?q option to filter the list using one or more properties (elements) of the sessions.

?q=content:sudo

You can escape special characters using the backslash character.

?q=content:\"Copying Files\"

To add multiple elements to the filter, you can use the AND, AND NOT, and OR operators.

content:ls AND content:cp AND NOT content:mv

You can create groups using () (parentheses).

?q=(content:rm OR content:mv) AND channels_id:5

You can also use () (parentheses) to add multiple possible values for a property.

?q=content:(sudo rm)

You can use the * (asterisk) and ? (question mark) wildcards for string-type values.

?q=content:?dmi*

You can define ranges using [] (brackets) or {} (braces) and the TO operator. This only works for numeric (int) values.

[ means equal or higher than the following value
] means equal or lower than the preceding value
{ means higher than the following value
}means lower than the preceding value

For example, the following range resolves to 2:

?q=channels_id:{1 TO 3}

You can also use the * (asterisk) wildcard in the range.

?q=channels_id:[* TO 5]

Note that not all connection data can be used for filtering. The available elements are:

channels_id

Integer, the channel in the session where the event occurred.
content

Text, the event that occurred in the session.
record_id

Integer, the identifier of the event in the session.
time

String, the timestamp when the event occurred.
type

String, the type of the event:
- command: A command entered in SSH or Telnet.
- screen.content: Screen content.
- screen.creditcard: Credit card numbers detected. Displayed only as an alert, not visible in the events.
- screen.windowtitle: The title of the window in graphic protocols.

Please select your product:

To serve you better, please complete the Purpose of your Chat:

Recommended Solutions for Your Problem

One Identity Safeguard for Privileged Sessions 6.0.1 - REST API Reference Guide

Session statistics

URL

Cookies

Sample request

Request parameters

Response

Example 1:

Example 2:

Example 3:

Status and error codes

Session histogram

URL

Cookies

Sample request

Request parameters

Response

Status and error codes

Session alerts

URL

Cookies

Sample request

Response

Changing the display limit

Navigating large datasets

Sorting and filtering

Session events

URL

Cookies

Sample request

Response

Changing the display limit

Navigating large datasets

Filtering