One Identity Safeguard for Privileged Sessions 6.0.2

The api/audit/sessions/<session-id>/events endpoint lists the events extracted from a session (if any). Events are available only if the session is indexed. For details on configuring indexing, see Local services: configuring the indexer.

URL

GET https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/events

Cookies

Cookie name	Description	Required	Values
session_id	Contains the authentication token of the user	Required	The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API. Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format).

Cookie name

Description

Required

Values

session_id

Contains the authentication token of the user

Required

The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API.

Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format).

Sample request

The following command lists the events of a session.

curl --cookie cookies "https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/events"

Response

The following is a sample response received when listing the events of a session.

For details of the meta object, see Message format.

{
    "items": [
        {
            "action": "ls",
            "channels_id": "0",
            "content": "myuser@examplehost:~$ ls",
            "record_id": 46,
            "time": "2017-04-11T09:21:10.832",
            "type": "command"
        },
        {
            "action": "cd",
            "channels_id": "0",
            "content": "myuser@examplehost:~$ cd /cd",
            "record_id": 64,
            "time": "2017-04-11T09:21:15.488",
            "type": "command"
        },
        {
            "action": "cat 24hrs.txt",
            "channels_id": "0",
            "content": "myuser@examplehost:/var$ cat 24hrs.txt",
            "record_id": 78,
            "time": "2017-04-11T09:21:18.017",
            "type": "command"
        },
        {
            "action": "ls -la",
            "channels_id": "0",
            "content": "myuser@examplehost:/var$ ls -la",
            "record_id": 95,
            "time": "2017-04-11T09:21:21.04",
            "type": "command"
        },
        {
            "action": "echo example.txt",
            "channels_id": "0",
            "content": "myuser@examplehost:/var$ echo example.txt",
            "record_id": 113,
            "time": "2017-04-11T09:21:23.353",
            "type": "command"
        },
        {
            "action": "ls",
            "channels_id": "0",
            "content": "myuser@examplehost:/var$ man sudo",
            "record_id": 148,
            "time": "2017-04-11T09:21:27.017",
            "type": "command"
        }
    ],
    "meta": {
        "first": "/api/audit/sessions/7930f4308efe8aecd710202d815b76ff/events?limit=500&offset=0",
        "href": "/api/audit/sessions/7930f4308efe8aecd710202d815b76ff/events",
        "last": "/api/audit/sessions/7930f4308efe8aecd710202d815b76ff/events?limit=500&offset=0",
        "limit": 500,
        "next": null,
        "offset": 0,
        "parent": "/api/audit/sessions/7930f4308efe8aecd710202d815b76ff",
        "previous": null
    }
}

Element		Type	Description
items		list	Top level element, a list containing the alerts of the session.
	action	string	The command line without prompt in commands.
	channels_id	integer	A reference to the ID of the channel in the session where the event occurred.
	content	text	The event that occurred in the session. Note that this value contains the context of the event as well. For example, for command events in terminal sessions, the value contains the entire command line, including the command prompt. For example, myuser@examplehost:~$ man sudo
	record_id	integer	The ID number of the event within the session.
	type	string	The type of the event. Possible values: command: A command entered in SSH or Telnet. file_transfer: A file transfer event. http_request: An HTTP request initiated during the session. window_title: The title of the window in graphic protocols.
	time	string	The timestamp when the event occurred, for example, 2017-04-25T13:26:39.144356.

Changing the display limit

You can use the ?limit option to change the number of items displayed at once. The default limit is 500.

?limit=1000

To navigate beyond the displayed set, use the offset option.

Navigating large datasets

You can use the ?offset option to navigate data sets that extend beyond the display limit. The default value of the offset is 0, this is the initially displayed set. To move to other items beyond the initial set, increase the value to a number that corresponds to the item where you want to start displaying results from.

Example: the display limit is the default 500, and the number of sessions is 1012. The initial 500 sessions are listed at:

?offset=0

To view sessions from 501 to 1000, change the offset to 501:

?offset=501

To display the remaining 12 sessions, change the offset to 1001:

?offset=1001

Filtering

You can filter events at the /api/audit/sessions/<session-id>/events endpoint. Use the ?q option to filter the list using one or more properties (elements) of the sessions.

?q=content:sudo

You can escape special characters using the backslash character.

?q=content:\"Copying Files\"

To add multiple elements to the filter, you can use the AND, AND NOT, and OR operators.

content:ls AND content:cp AND NOT content:mv

You can create groups using () (parentheses).

?q=(content:rm OR content:mv) AND channels_id:5

You can also use () (parentheses) to add multiple possible values for a property.

?q=content:(sudo rm)

You can use the * (asterisk) and ? (question mark) wildcards for string-type values.

?q=content:?dmi*

You can define ranges using [] (brackets) or {} (braces) and the TO operator. This only works for numeric (int) values.

[ means equal or higher than the following value
] means equal or lower than the preceding value
{ means higher than the following value
}means lower than the preceding value

For example, the following range resolves to 2:

?q=channels_id:{1 TO 3}

You can also use the * (asterisk) wildcard in the range.

?q=channels_id:[* TO 5]

Note that not all connection data can be used for filtering. The available elements are:

channels_id

Integer, the channel in the session where the event occurred.
content

Text, the event that occurred in the session.
record_id

Integer, the identifier of the event in the session.
time

String, the timestamp when the event occurred.
type

String, the type of the event:
- command: A command entered in SSH or Telnet.
- screen.content: Screen content.
- screen.creditcard: Credit card numbers detected. Displayed only as an alert, not visible in the events.
- screen.windowtitle: The title of the window in graphic protocols.

Indexing sessions

Search, download, and index sessions > Indexing sessions

The api/audit/sessions/<session-id>/indexing endpoint lists the indexing-related details in this session (if any). For details on configuring indexing, see Local services: configuring the indexer.

URL

GET https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/indexers

Cookies

Cookie name	Description	Required	Values
session_id	Contains the authentication token of the user	Required	The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API. Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format).

Cookie name

Description

Required

Values

session_id

Contains the authentication token of the user

Required

Sample request

The following command lists the indexing-related details of a session.

curl --cookie cookies "https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/indexing"

Response

The following is a sample response received when listing the indexing-related details of a session.

For details of the meta object, see Message format.

{
    "items": [
        {
            "config": {
                "command": {
                    "enabled": true
                },
                "keyboard": {
                    "buffer_interval": 3,
                    "enabled": false
                },
                "mouse": {
                    "buffer_interval": 1,
                    "enabled": false
                },
                "near_realtime": false,
                "ocr_languages": [],
                "screen": {
                    "enabled": true,
                    "omnipage_trade_off": "TO_ACCURATE"
                },
                "title": {
                    "enabled": true
                }
            },
            "statistics": {
                "cpu_time": 5,
                "duration": 149,
                "start_time": 1542116524143
            },
            "status": "COMPLETED",
            "version": {
                "adp": "6.0.20",
                "worker": "4.0.26"
            }
        }
    ],
    "meta": {
        "first": "/api/audit/sessions/c7e51cebad1a3e2ade480909f7687b16/indexer?limit=500&offset=0",
        "href": "/api/audit/sessions/c7e51cebad1a3e2ade480909f7687b16/indexer",
        "last": "/api/audit/sessions/c7e51cebad1a3e2ade480909f7687b16/indexer?limit=500&offset=0",
        "limit": 500,
        "match_count": 1,
        "next": null,
        "offset": 0,
        "parent": "/api/audit/sessions/rUhhQZ3jYsY1NDWYp9DEpq",
        "previous": null,
        "remaining_seconds": 599
    }
}

Element	Type	Description
items		list	Top level element, a list containing the indexing-related details of the session. For details, see indexer_info section in"List of available search filters" in the Administration Guide.

Element

Type

Description

items

list

Top level element, a list containing the indexing-related details of the session.

For details, see indexer_info section in"List of available search filters" in the Administration Guide.

Changing the display limit

You can use the ?limit option to change the number of items displayed at once. The default limit is 500.

?limit=1000

To navigate beyond the displayed set, use the offset option.

Navigating large datasets

Example: the display limit is the default 500, and the number of sessions is 1012. The initial 500 sessions are listed at:

?offset=0

To view sessions from 501 to 1000, change the offset to 501:

?offset=501

To display the remaining 12 sessions, change the offset to 1001:

?offset=1001

Session audit trail downloads

Search, download, and index sessions > Session audit trail downloads

The api/audit/sessions/<session-id>/trail_downloads endpoint lists the details of audit-trail downloads in this session (if any). For details on downloading audit trails, see Local services: configuring the indexer.

URL

GET https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/trail_downloads

Cookies

Cookie name	Description	Required	Values
session_id	Contains the authentication token of the user	Required	The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API. Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format).

Cookie name

Description

Required

Values

session_id

Contains the authentication token of the user

Required

Sample request

The following command lists the indexing-related details of a session.

curl --cookie cookies "https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/trail_downloads"

Response

The following is a sample response received when listing the indexing-related details of a session.

For details of the meta object, see Message format.

{
    "items": [
        {
            "from_api": false,
            "ip_address": "10.20.30.40",
            "time": "2018-11-20T11:10:19.000Z",
            "username": "admin"
        },
        {
            "from_api": false,
            "ip_address": "10.20.30.40",
            "time": "2018-11-20T11:10:38.000Z",
            "username": "admin"
        }
    ],
    "meta": {
        "first": "/api/audit/sessions/c7e51cebad1a3e2ade480909f7687b16/indexer?limit=500&offset=0",
        "href": "/api/audit/sessions/c7e51cebad1a3e2ade480909f7687b16/indexer",
        "last": "/api/audit/sessions/c7e51cebad1a3e2ade480909f7687b16/indexer?limit=500&offset=0",
        "limit": 5,
        "match_count": 2,
        "next": null,
        "offset": 0,
        "parent": "/api/audit/sessions/rUhhQZ3jYsY1NDWYp9DEpq",
        "previous": null,
        "remaining_seconds": 599
    }
}

Element		Type	Description
items		list	Top level element, a list containing the indexing-related details of the session.
	from_api	boolean	True, if the audit trail was not downloaded from the GUI, but through SOAP or REST API.
	ip_address	string	The IP address of the client that downloaded the audit trail.
	time	boolean	The exact time when the user downloaded the audit trail file.
	username	string	The user name of the user who downloaded the audit trail.

Changing the display limit

You can use the ?limit option to change the number of items displayed at once. The default limit is 500.

?limit=1000

To navigate beyond the displayed set, use the offset option.

Navigating large datasets

Example: the display limit is the default 500, and the number of sessions is 1012. The initial 500 sessions are listed at:

?offset=0

To view sessions from 501 to 1000, change the offset to 501:

?offset=501

To display the remaining 12 sessions, change the offset to 1001:

?offset=1001

Local services: configuring the indexer

Search, download, and index sessions > Local services: configuring the indexer

Indexing is a resource intensive (CPU and hard disk) operation, and depending on the number of processed audit trails and parallel connections passing SPS, may affect the performance of SPS. Test it thoroughly before enabling it in a production environment that is under heavy load. If your SPS appliance cannot handle the connections and the indexing, consider using external indexers (see "Configuring external indexers" in the Administration Guide) to decrease the load on SPS. For sizing recommendations, ask your One Identity partner or contact our Support Team.

NOTE:

Only those audit trails will be processed that were created after full-text indexing had been configured for the connection policy. It is not possible to process already existing audit trails.

NOTE:

Using content policies significantly slows down connections (approximately 5 times slower), and can also cause performance problems when using the indexer service.

URL

GET https://<IP-address-of-SPS>/api/configuration/local_services/indexer

Cookies

Cookie name	Description	Required	Values
session_id	Contains the authentication token of the user	Required	The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API. Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format).

Cookie name

Description

Required

Values

session_id

Contains the authentication token of the user

Required

Sample request

The following command lists the configuration options.

curl --cookie cookies https://<IP-address-of-SPS>/api/configuration/local_services/indexer

Response

The following is a sample response received when external indexers are disabled.

For details of the meta object, see Message format.

{
    "body": {
        "decryption_keys": [
            {
                "key": "e38d47bd-5374-4d7c-b683-e26ea77142e2",
                "meta": {
                    "href": "/api/configuration/x509/e38d47bd-5374-4d7c-b683-e26ea77142e2"
                }
            }
        ],

        "number_of_workers": 1,
        "remote_access": {
            "enabled": false
        },
        "selection": "integrated"
    },
    "key": "indexer",
    "meta": {
        "first": "/api/configuration/local_services/admin_web",
        "href": "/api/configuration/local_services/indexer",
        "last": "/api/configuration/local_services/user_web",
        "next": "/api/configuration/local_services/postgresql",
        "parent": "/api/configuration/local_services",
        "previous": "/api/configuration/local_services/admin_web",
        "remaining_seconds": 599,
        "transaction": "/api/transaction"
    }
}

A sample response when external indexers are enabled:

{
    "body": {
        "decryption_keys": [],
        "number_of_workers": 1,
        "number_of_workers": 0,
        "remote_access": {
            "access_restriction": {
                "allowed_from": [
                    "10.40.0.0/16"
                ],
                "enabled": true
            },
            "enabled": true,
            "listen": [
                {
                    "address": {
                        "key": "nic1.interfaces.ff7574025754b3df1647001.addresses.1",
                        "meta": {
                            "href": "/api/configuration/network/nics/nic1#interfaces/ff7574025754b3df1647001/addresses/1"
                        }
                    },
                    "port": 12345
                }
            ],
            "ssl_config": {
                "ca": {
                    "key": "52735ce4-4a43-458d-8803-c23c715640a5",
                    "meta": {
                        "href": "/api/configuration/x509/52735ce4-4a43-458d-8803-c23c715640a5"
                    }
                },
                "service": {
                    "key": "60eacdba-d889-4cb4-bdb0-cbbd4054f01c",
                    "meta": {
                        "href": "/api/configuration/x509/60eacdba-d889-4cb4-bdb0-cbbd4054f01c"
                    }
                },
                "worker": {
                    "key": "93198544-1e82-4661-90b7-e01b0b1e2ed9",
                    "meta": {
                        "href": "/api/configuration/x509/93198544-1e82-4661-90b7-e01b0b1e2ed9"
                    }
                }
            }
        },
        "selection": "integrated"
    },
    "key": "indexer",
    "meta": {
        "first": "/api/configuration/local_services/admin_web",
        "href": "/api/configuration/local_services/indexer",
        "last": "/api/configuration/local_services/user_web",
        "next": "/api/configuration/local_services/postgresql",
        "parent": "/api/configuration/local_services",
        "previous": "/api/configuration/local_services/admin_web",
        "remaining_seconds": 599,
        "transaction": "/api/transaction"
    }
}

Element			Type	Description
key			string	Top level element, contains the ID of the endpoint.
body			Top level element (string)	Contains the configuration options of the indexer service.
	decryption_keys		list	Indexing encrypted audit trails requires the X.509 certificates and the matching private keys. The certificates must in PEM format, and use RSA keys. This parameter lists the reference IDs of the configured decryption keys. When configuring the indexer, you must first upload the keys before you can configure the decryption keys. For details, see Private keys stored on SPS.
		key	reference	The ID of the referenced decryption key. You can upload private keys at the /api/configuration/private_key endpoint. For details, see Private keys stored on SPS.
	number_of_near_realtime_workers		integer	The number of indexer workers configured to perform near-realtime indexing. For details, see "Configuring the external indexer" in the Administration Guide.
	number_of_workers		integer	This option determines the maximum number of parallel indexing tasks that the SPS appliance performs. The default value is set to the number of detected CPU cores. Note that indexing audit trails requires about 50-100 Mbytes of memory for terminal sessions (SSH, Telnet, TN3270), and 150-300 Mbytes for graphical sessions (RDP, ICA, VNC, X11). Consider the memory usage of your SPS host before modifying this value.
	remote_access		JSON object	Enables external indexers to access the SPS host, and configures access restrictions and other parameters.
	selection		string	The value of this option must be integrated.

Element

Type

Description

access_restriction

JSON object

Enables and configures limitations on the clients that can access the web interface, based on the IP address of the clients.

allowed_from

list

The list of IP networks from where the administrators are permitted to access this management interface. To specify the IP addresses or networks, use the IPv4-Address/prefix format, for example, 10.40.0.0/16.

enabled

boolean

Set it to true to restrict access to the specified client addresses.

enabled

boolean

Enables the remote access for the external indexers. That way, indexer services running on external hosts can access the audit trails, index them, and upload the indexed data to SPS. If this option is set to False, SPS ignores every other option of this object. For details on installing and configuring external indexers, see "Configuring external indexers" in the Administration Guide.

Caution:

Disabling an already configured remote indexer access causes SPS to delete every related certificate. If you re-enable remote indexer access, SPS generates new certificates, and you have to import them to the external indexer hosts.

listen

list

Selects the network interface, IP address, and port where the clients can access the web interface.

address

JSON object

A reference to a configured network interface and IP address where this local service accepts connections. For example, if querying the interface /api/configuration/network/nics/nic1#interfaces/ff7574025754b3df1647001/addresses/ returns the following response:

{
    "body": {
        "interfaces": {
            "@order": [
                "ff7574025754b3df1647001"
            ],
            "ff7574025754b3df1647001": {
                "addresses": {
                    "1": "10.40.255.171/24",
                    "@order": [
                        "1"
                    ]
                },
                "name": "default",
                "vlantag": 0
            }
        },
        "name": "eth0",
        "speed": "auto"
    },
    "key": "nic1",
    "meta": {
        "first": "/api/configuration/network/nics/nic1",
        "href": "/api/configuration/network/nics/nic1",
        "last": "/api/configuration/network/nics/nic3",
        "next": "/api/configuration/network/nics/nic2",
        "parent": "/api/configuration/network/nics",
        "previous": null,
        "transaction": "/api/transaction"
    }
    }

Then the listening address of the local service is the following.

nic1.interfaces.ff7574025754b3df1647001.addresses.1

This is the format you have to use when configuring the address of the local service using REST:

"address": "nic1.interfaces.ff7574025754b3df1647001.addresses.1"

When querying a local services endpoint, the response will contain a reference to the IP address of the interface in the following format:

"address": {
    "key": "nic1.interfaces.ff7574025754b3df1647001.addresses.1",
    "meta": {
        "href": "/api/configuration/network/nics/nic1#interfaces/ff7574025754b3df1647001/addresses/1"
    }
    },

port

integer

The port number where this local service accepts connections.

ssl_config

JSON object

Contains references to the certificates used to encrypt the communication between SPS and the external indexer hosts. SPS generates these certificates automatically when you enable the indexer service.

reference

The ID of the CA certificate used to sign the certificates used to communicate between SPS and the external indexers.

service

reference

The ID of the certificate that SPS shows to the external indexer hosts.

worker

reference

The ID of the certificate that the external indexer hosts must show to SPS.

Status and error codes

The following table lists the typical status and error codes for this request. For a complete list of error codes, see Application level error codes.

Code	Description	Notes
401	Unauthenticated	The requested resource cannot be retrieved because the client is not authenticated and the resource requires authorization to access it. The details section contains the path that was attempted to be accessed, but could not be retrieved.
401	AuthenticationFailure	Authenticating the user with the given credentials has failed.
404	NotFound	The requested object does not exist.

Updating the indexer configuration

To update the configuration of the indexer, you have to PUT the updated configuration in JSON format to the endpoint, for example:

{
    "decryption_keys": ["216b33dd-a1cd-41b1-85c5-66290b7a043d"],
    "number_of_near_realtime_workers": 0,
    "number_of_workers": 2,
    "remote_access": {
        "access_restriction": {
            "allowed_from": [
                "10.40.0.0/16"
            ],
            "enabled": true
        },
        "enabled": true,
        "listen": [
            {
                "address": "nic1.interfaces.ff7574025754b3df1647001.addresses.1",
                "port": 12354
            }
        ],
        "ssl_config": {
            "ca": "773ed50d-3066-44f1-84ec-cbef59111702",
            "service": "a8b6c791-c24a-466d-ac50-a425a5253d46",
            "worker": "c54c436f-63c5-4a2e-a59e-7ad904bbf0f2"
            }
    },
    "selection": "integrated"
}

Please select your product:

To serve you better, please complete the Purpose of your Chat:

Recommended Solutions for Your Problem

One Identity Safeguard for Privileged Sessions 6.0.2 - REST API Reference Guide

Session events

URL

Cookies

Sample request

Response

Changing the display limit

Navigating large datasets

Filtering

Indexing sessions

URL

Cookies

Sample request

Response

Changing the display limit

Navigating large datasets

Session audit trail downloads

URL

Cookies

Sample request

Response

Changing the display limit

Navigating large datasets

Local services: configuring the indexer

URL

Cookies

Sample request

Response

Status and error codes

Updating the indexer configuration