Chat now with support
Chat with Support

One Identity Safeguard for Privileged Sessions 6.0.5 - REST API Reference Guide

Introduction Using the SPS REST API Basic settings User management and access control Managing SPS General connection settings HTTP connections Citrix ICA connections RDP connections SSH connections Telnet connections VNC connections Search, download, and index sessions Reporting Health and maintenance Advanced authentication and authorization Completing the Welcome Wizard using REST Enable and configure analytics using REST

Searching in the session database

You can list, search, and filter the SPS session database at the /api/audit/sessions endpoint. You can use the following actions:

  • ?start

    Display sessions that started after the specified date. Use the ISO 8601 format for the date, for example, 2017-01-25T10:00.

  • ?q

    Filter the list using one or more property (element) of the sessions.

  • ?content

    Search in the content of indexed sessions.

  • ?end

    Display sessions that ended before the specified date. Use the ISO 8601 format for the date, for example, 2017-01-25T10:00.

  • ?fields

    Display the selected properties (elements and values) of the listed sessions.

  • ?limit

    Configure the pagination of the displayed results using the ?offset and ?limit parameters.

    The ?limit parameter allows you to configure the maximum number of results to display on a page at once.

    The default value of ?limit is 500.

    		 NOTE:

    The default value of 500 is the maximum permitted value you can set for ?limit. If you set the ?limit parameter to a value bigger than 500, only the first 500 results will be displayed.

  • ?offset

    Configure the pagination of the displayed results using the ?offset and ?limit parameters.

    The ?offset parameter allows you to configure the offset from the first result that is displayed. This can be useful if the number of items returned exceeds the number of items displayed on the first page, and you want to navigate to any of the subsequent items displayed on other pages.

    The default value of ?offset is null.

    		 NOTE:

    The maximum number of search results in One Identity Safeguard for Privileged Sessions is 10000. As a result, any ?offset values set to larger than 10000 will be ignored and the results exceeding the value of 10000 will not be displayed.

  • ?sort

    Sort the results based on the values of the fields.

  • ?format

    Configure the format of the displayed results.

    The default value of ?format is json. If you do not configure the ?format parameter, the results will be displayed in JSON format.

    To display search results in a CSV format, enter csv as a value.

To combine multiple expressions, use the & (ampersand) character, for example:

Display the target server and port of each active session:

curl --cookie cookies "https://<IP-address-of-SPS>/api/audit/sessions?fields=psm.target.address,psm.target.port&q=active:true"

Display 10 sessions at once, and navigate to 31-40:

curl --cookie cookies "https://<IP-address-of-SPS>/api/audit/sessions?limit=10&offset=31"

Search in metadata and session content at the same time:

curl --cookie cookies "https://<IP-address-of-SPS>/api/audit/sessions?q=protocol:ssh&content=sudo"

 NOTE:

If you use curl, use quotation marks for the URL to avoid problems with the & (ampersand) character.

Response

The response to search or filtering action contains a list of the matching sessions, as well as some additional meta fields. For example:

{
    "items": [
        {
            "body": {
                "duration": 0,
                "name": "myname",
                "start_time": "2017-01-25T11:11:52.000+01:00"
            },
            "key": "2",
            "meta": {
                "href": "/api/audit/sessions/2"
            }
        },
        {
            "body": {
                "duration": 34,
                "name": "myname",
                "start_time": "2017-01-25T11:11:11.000+01:00"
            },
            "key": "10",
            "meta": {
                "href": "/api/audit/sessions/10"
            }
        }
    ],
    "meta": {
        "fields": [
            "start_time",
            "name",
            "duration"
        ],
        "first": "/api/audit/sessions?limit=500&offset=0&fields=start_time,name,duration&q=name%3Amyname&=duration",
        "href": "/api/audit/sessions",
        "last": "/api/audit/sessions?limit=500&offset=0&fields=start_time,name,duration&q=name%3Amyname&sort=duration",
        "limit": 500,
        "match_count": 2,
        "next": null,
        "offset": 0,
        "parent": "/api/audit",
        "previous": null
    }
Element Type Description
items list Top level element, a list containing the details of the matching sessions.
body JSON object

Contains the information returned about a session, that is, the fields selected with the ?fields expression. For example, if you used the fields=start_time,psm.gateway_username,duration expression in your query, then the body element contains these fields for each returned session:

"body": {
                "duration": 0,
                "name": null,
                "start_time": "2017-01-25T11:11:52.000+01:00"
            },

For details about the returned fields, see Element .

key string

A globally unique string that identifies the session. This session ID has the following format: svc/<unique-random-hash>/<name-of-the-connection-policy>:<session-number-since-service-started>/<protocol>, for example, svc/5tmEaM7xdNi1oscgVWpbZx/ssh_console:1/ssh.

Log messages related to the session also contain this ID. For example:

2015-03-20T14:29:15+01:00 demo.example
zorp/scb_ssh[5594]: scb.audit(4):
(svc/5tmEaM7xdNi1oscgVWpbZx/ssh_console:0/ssh):
Closing connection; connection='ssh_console',
protocol='ssh', connection_id='409829754550c1c7a27e7d',
src_ip='10.40.0.28', src_port='39183',
server_ip='10.10.20.35', server_port='22',
gateway_username='', remote_username='example-username',
verdict='ZV_ACCEPT'

Note that when using the session ID in a REST call, you must replace the special characters in the ID with the hyphen (-) character. For example, if the session ID in the log message is svc/fNLgRmAyf5EtycgUYnKc1B/ssh_demo2:2, use the svc-fNLgRmAyf5EtycgUYnKc1B-ssh_demo2-2 ID in REST calls.

In addition to the usual meta elements of other endpoints, search results can contain the following additional elements.

Element Type Description
meta JSON object Top level element, a list containing meta information about the response.
fields list

Contains the list of data fields returned about each session, that is, the fields selected with the ?fields expression. For example, if you used the fields=start_time,psm.gateway_username,duration expression in your query, then the body element contains these fields for each returned session:

"fields": [
            "start_time",
            "name",
            "duration"
        ],

For details about the returned fields, see Element .

limit integer The maximum number of sessions returned in a the response (by default, 500).
match_count integer The number of results matching the query.
next string A query to retrieve the next set of search results, if match_count is higher than limit.
offset integer Indicates the position of the results in this response, relative to the total number of results (match_count). Otherwise, its value is null.
previous string A query to retrieve the previous set of search results, if match_count is higher than limit, and offset is higher than 0. Otherwise, its value is null.
Filtering

You can use the ?q option to filter the list using one or more property (element) of the sessions.

?q=protocol:ssh

You can escape special characters using the backslash character.

?q=server_username:\"Windows User\"

To add multiple elements to the filter, you can use the AND, AND NOT, and OR operators.

?q=protocol:ssh AND verdict:accept AND NOT name:admin

You can create groups using () (parentheses).

?q=(client.address:10.20.30.40 OR target.address:10.20.30.40) AND verdict:accept

You can also use () (parentheses) to add multiple possible values for a property.

?q=protocol:(ssh rdp)

You can use the * (asterisk) and ? (question mark) wildcards for string-type values.

?q=name:?dmi*

You can define ranges using [] (brackets) or {} (braces) and the TO operator. This only works for numeric (int) values.

  • [ means equal or higher than the following value

  • ] means equal or lower than the preceding value

  • { means higher than the following value

  • }means lower than the preceding value

For example, the following range resolves to 22:

?q=port:{21 TO 23}

You can also use the * (asterisk) wildcard in the range.

?q=start_time:[* TO 1461654799]

Note that not all connection data can be used for filtering. The available elements are:

  • active

    Boolean, true means the session is ongoing (it is still active).

  • auth_method

    String, the authentication method used.

  • channel_policy

    String, the key of the channel policy.

  • client.address

    String, the IP address of the client.

  • client.port

    Integer, the port of the client.

  • psm.connection_policy

    String, the key of the connection policy.

  • end_time

    The date of the end of the session in ISO 8601 format.

  • name

    String, the username used for authenticating against the gateway.

  • protocol

    String, the protocol of the session.

  • server.address

    String, the IP of the remote server.

  • psm.server_local.address

    String, the IP of SPS.

  • psm.server_local.port

    String, the port of SPS.

  • server.port

    String, the port of the remote server.

  • server_username

    String, the username used for authenticating on the remote server.

  • session_id

    String, the identifier of the session.

  • start_time

    The date of the start of the session in ISO 8601 format.

  • target.address

    String, the IP the client targeted in the session.

  • target.port

    Integer, the port the client targeted in the session.

  • verdict

    String, the connection verdict. Possible values are:

    • accept

      The connection attempt was successful.

    • accept-terminated

      The connection violated a content policy, and was terminated by SPS.

    • auth-fail

      Authentication failure.

    • deny

      The connection was denied.

    • fail

      The connection attempt failed.

    • gw-auth-fail

      Gateway authentication failure.

    • key-error

      The connection attempt failed due to a hostkey mismatch.

    • user-mapping-fail

      The connection attempt failed due to a user mapping failure.

Content search in indexed audit trails

You can use the ?content option to search for keywords that appear in the content of the audit trails. Such content is any text that appeared on the screen in terminal or graphical sessions, or commands that the user typed in terminal sessions. Note that content search works only if:

  • Indexing was enabled in the connection policy related to the audit trail during the session, and

  • the audit trail has already been indexed.

?content="my-search-expression"

You can use the Apache Lucene query syntax to create the search expression, but note the following points.

  • You must format the search expression as an URL, and escape special characters accordingly. For example, if your search expression is man iptables, you must escape the whitespace: man%20iptables

    For a list of special (reserved) URL characters, see RFC3986.

  • Do not begin the expression with the * wildcard.

Examples:

Search for the word example

?content=example

Search for the words example, examples, and so on:

?content=example%3F

Search for the words example, examine, and so on:

?content=exam%2A

Search in metadata and session content at the same time:

curl --cookie cookies "https://<IP-address-of-SPS>/api/audit/sessions?q=protocol:ssh&content=sudo"

For further details and examples, see "Using the content search" in the Administration Guide.

Displaying session data

You can use the ?fields option to display the selected data (body elements) of each session.

?fields=protocol

To list multiple elements, use the , (comma) character. Note that the response includes the selected fields in alphabetic order, not in the order they were specified.

?fields=protocol,name

To list all possible elements, use the fields=* expression.

?fields=*

Note that not all connection data can be displayed in the generated list. The available elements are:

  • active

    Boolean, true means the connection is ongoing.

  • archived

    Boolean, true means the session has been archived.

  • auth_method

    String, the authentication method used.

  • channel_policy

    String, the key of the channel policy.

  • client.address

    String, the IP address of the client.

  • client.port

    Integer, the port of the client.

  • connection_policy

    String, the key of the connection policy.

  • duration

    Integer, the duration of the session. Computed value.

  • end_time

    The date of the end of the session in ISO 8601 format.

  • name

    String, the username used for authenticating against the gateway.

  • protocol

    String, the protocol of the session.

  • server.address

    String, the IP of the remote server.

  • server_local.address

    String, the IP of SPS.

  • server_local.port

    Integer, the port of SPS.

  • server.port

    Integer, the port of the remote server.

  • server_username

    String, the username used for authenticating on the remote server.

  • session_id

    String, the identifier of the session.

  • start_time

    The date of the start of the session in ISO 8601 format.

  • target.address

    String, the IP the client targeted in the session.

  • target.port

    Integer, the port the client targeted in the session.

Date-specific search

To display search results only for specific date intervals, you can use the ?start and ?end options.

  • The ?start option selects the sessions that started after the specified date (based on the value of the start_time field).

  • The ?end option selects the sessions that ended before the specified date (based on the value of the end_time field).

  • Both options accept the date in ISO 8601 format.

?start=2017-01-25T11:11:52.000+01:00
?end=2017-01-25T11:41:52.000+01:00
?start=2017-01-24&end=2017-01-25
Examples:

Select sessions that started on January 20, 2017, or later:

?start=2017-01-20

Select sessions that started on 11:00 January 20, 2017, or later:

?start=2017-01-20T11:00

Select sessions that ended on January 20, 2017:

?end=2017-01-20

Select sessions started and ended on January 20, 2017:

?start=2017-01-20&end=2017-01-20

Select sessions started after 11:00, January 20, 2017, and ended before 09:00, January 21, 2017:

?start=2017-01-20T11:00&end=2017-01-21T09:00
Changing the display limit

You can use the ?limit option to change the number of items displayed at once. The default limit is 500.

?limit=1000

To navigate beyond the displayed set, use the offset option.

Navigating large datasets

You can use the ?offset option to navigate data sets that extend beyond the display limit. The default value of the offset is 0, this is the initially displayed set. To move to other items beyond the initial set, increase the value to a number that corresponds to the item where you want to start displaying results from.

Example: the display limit is the default 500, and the number of sessions is 1012. The initial 500 sessions are listed at:

?offset=0

To view sessions from 501 to 1000, change the offset to 501:

?offset=501

To display the remaining 12 sessions, change the offset to 1001:

?offset=1001
Sort the results

You can sort the search results using the sort expression, for example, based on the length of the sessions:

?sort=duration

You can use any field to sort the results. By default, sorting returns the results in ascending order, if you use ?sort=duration, then the shortest session is at the beginning of the list. To sort the results in descending order, add the minus sign (-) before the field name. For example, the response to the following expression starts with the longest session:

?sort=-duration

You can specify multiple fields to order the list. In this case, the list is first ordered using the first field, then the second, and so on. For example, to order the list first by duration, then by start time, use the following expression.

?sort=duration,start_time

The following example sorts the results by duration, and displays the start time, gateway username, and duration fields.

curl --cookie cookies "https://<IP-address-of-SPS>/api/audit/sessions?sort=duration&fields=start_time,psm.gateway_username,duration"
Configure the format of the displayed results

The default value of ?format is json. If you do not configure the ?format parameter, the results will be displayed in JSON format.

?format=json

To display search results in a CSV format, enter csv as a value.

?format=csv
Example: querying sessions in CSV result format

Given that the following sessions were recorded:

{
  "1": {
    "channel": [
      {"channel_id": 1},
      {"channel_id": 2}
    ],
    "recording": {
      "session_id": 1,
      "archived": false,
      "channel_policy": "policy1",
      "content_reference_id": 1,
      "connection_policy": "connection1",
      "auth_method": "password",
      "target": {
        "port": 2222,
        "ip": "1.1.1.1",
        "name": "1.1.1.1"
      },
      "server_local": {
        "port": 46,
        "ip": "1.1.1.1",
        "name": "1.1.1.1"
      }
    },
    "user": {
      "server_username": "user1",
      "gateway_username": "user1"
    },
    "client": {
      "port": 48679,
      "ip": "2.2.2.2",
      "name": "2.2.2.2"
    },
    "active": false,
    "start_time": 1,
    "duration": 4,
    "server": {
      "port": 22,
      "ip": "2.2.2.2",
      "name": "2.2.2.2"
    },
    "end_time": 5,
    "protocol": "ssh"
  },
  "2": {
    "channel": [
      {"channel_id": 3},
      {"channel_id": 4}
    ],
    "recording": {
      "session_id": 2,
      "archived": false,
      "channel_policy": "policy2",
      "content_reference_id": 2,
      "connection_policy": "connection2",
      "auth_method": "password",
      "target": {
        "port": 2222,
        "ip": "1.1.1.1",
        "name": "1.1.1.1"
      },
      "server_local": {
        "port": 46,
        "ip": "1.1.1.1",
        "name": "1.1.1.1"
      }
    },
    "user": {
      "server_username": "user2",
      "gateway_username": "user2"
    },
    "client": {
      "port": 48680,
      "ip": "3.3.3.3",
      "name": "3.3.3.3"
    },
    "active": false,
    "start_time": 1,
    "duration": 4,
    "server": {
      "port": 24,
      "ip": "2.2.2.2",
      "name": "2.2.2.2"
    },
    "end_time": 7,
    "protocol": "ssh"
  }
}

When the query is the following:

curl --cookie cookies "https://<IP-address-of-SPS>/api/audit/sessions?format=csv&fields=protocol,end_time,user.gateway_username,server.ip,client.ip,client.port"

The response is the following:

"Key","Protocol","End time","Gateway username","Server IP","Client IP","Client port"
"2","ssh","7","user2","2.2.2.2","3.3.3.3","48680"
"1","ssh","5","user1","2.2.2.2","2.2.2.2","48679"
Example: querying sessions in CSV result format with interesting events

Given that the following sessions were recorded:

{
  "1":{
    "origin": "RECORDING",
    "protocol": "SSH",
    "analytics": {
      "interesting_events": ["ssh", "sudo"],
      "similar_sessions": []
    },
    "recording": {
      "session_id": "1",
      "verdict": "ACCEPT",
      "audit_trail": "/var/lib/zorp/audit/532078660569910c6542b2/01/audit-scb_ssh-1451900800-1.zat",
      "connection_policy": "ssh1",
      "content_reference_id": 1
    }
  },
  "2":{
    "origin": "RECORDING",
    "protocol": "SSH",
    "analytics": {
      "interesting_events": ["sudo", "systemctl"],
      "similar_sessions": []
    },
    "recording": {
      "session_id": "2",
      "verdict": "ACCEPT",
      "connection_policy": "ssh2",
      "content_reference_id": 2
    }
  }
}

When the query is the following:

curl --cookie cookies "https://<IP-address-of-SPS>/api/audit/sessions?sort=recording.session_id&format=csv&fields=recording.session_id,analytics.interesting_events,analytics.similar_sessions"

The response is the following:

"Key","Recording Session ID","Analytics Interesting events","Similar Sessions"
"1","1","ssh",""
"1","1","sudo",""
"2","2","sudo",""
"2","2","systemctl",""
Example: querying sessions in CSV result format with audit trail link

Given that the following sessions were recorded:

{
  "svc-paKzcMJwXghEFJ9UvsdqFU-sid-1": {
    "origin": "RECORDING",
    "protocol": "SSH",
    "recording": {
      "session_id": "1",
      "verdict": "ACCEPT",
      "audit_trail": "/var/lib/zorp/audit/532078660569910c6542b2/01/audit-scb_ssh-1451900800-1.zat",
      "connection_policy": "ssh1",
      "content_reference_id": 1
    }
  },
  "svc-paKzcMJwXghEFJ9UvsdqFU-sid-2": {
   "origin": "RECORDING",
    "protocol": "SSH",
    "recording": {
      "session_id": "2",
      "verdict": "ACCEPT",
      "connection_policy": "ssh2",
      "content_reference_id": 2
    }
  }
}

When the query is the following:

curl --cookie cookies "https://<IP-address-of-SPS>/api/audit/sessions?format=csv&fields=trail_download_link"

The response is the following:

"Key","Audit trail download link"
"svc-paKzcMJwXghEFJ9UvsdqFU-sid-2",""
"svc-paKzcMJwXghEFJ9UvsdqFU-sid-1","https://127.0.0.1/api/audit/sessions/svc-paKzcMJwXghEFJ9UvsdqFU-sid-1/audit_trail"

Searching in connection content

You can search in the contents of individual connections at the api/audit/sessions/<session-id>/content/?q=<my-search-expression> endpoint.

URL
GET https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/content/?q=<my-search-expression>
Cookies
Cookie name Description Required Values
session_id Contains the authentication token of the user Required

The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API.

Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format).
Sample request

The following command retrieves those events in the contents of a specific connection that match the search expression(s).

curl --cookie cookies https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/content/?q=<my-search-expression>

 NOTE:

Make sure that you use the ?q option and that when you use it, you do not leave it empty. Not using the ?q option or an empty ?q will result in an empty "items" list returned in the response.

You can use the Apache Lucene query syntax to create the search expression, but note the following points.

  • You must format the search expression as a URL, and escape special characters accordingly. For example, if your search expression is man iptables, you must escape the whitespace: man%20iptables

  • Do not begin the expression with the * wildcard.

Response

The response contains a list of those events in the contents of the connection that match the search expression(s). The response also contains some meta fields.

If you specified a search expression using the ?q option and the response returns an empty "items" list, that can indicate that:

  • The search returned no results.

  • There is no content recorded for the connection.

The following is an example response:

{
    "items": [
        { 
            "channel.id": 5, 
            "end_time": "2017-08-14T10:35:43.957000", 
            "rank": 2.4756217002868652,
            "record_id": {
                "begin": 158,
                "end": 160,
                "for_screenshot": 158
            },
            "start_time": "2017-08-14T10:35:19.098000", 
            "trail_id": "12" 
        }
    ],
    "meta":
        { 
            "href": "/api/audit/sessions/2a620c1cfeb39c537a5e80280283d741/content", 
            "parent": "/api/audit/sessions/2a620c1cfeb39c537a5e80280283d741", 
            "remaining_seconds": 599 
        }
}
Element Type Description
items list Top-level element, a list containing the details of the matching session.
channel.id integer A reference to the ID of the channel in the session where the event occurred.
end_time string

The timestamp of when the content disappeared from the screen.

Starting with SPS 5 LTS, the timestamp is in ISO 8601 format, for example, 2018-10-11T09:23:38.000+02:00. In earlier versions, it was in UNIX timestamp format.

rank float

Indicates the relevance of the match.

If there are several results, the order of them is based on their relevance.

record_id integer The content element's exact position in the audit trail file.
begin integer The identifier of the screenshot in the audit trail file where the content element first appeared.
end integer The identifier of the screenshot in the audit trail file where the content element last appeared.
for_screenshot integer The identifier of the most relevant screenshot in the audit trail file. This is the screenshot on which the event in question is the most clearly visible.
start_time string

The timestamp of when the content first appeared on the screen and recording started.

Starting with SPS 5 LTS, the timestamp is in ISO 8601 format, for example, 2018-10-11T09:23:38.000+02:00. In earlier versions, it was in UNIX timestamp format.

trail_id integer The unique identifier of the trail that contains the event.

In addition, search results can contain the usual meta elements of other endpoints:

Element Type Description
meta JSON object

Top-level element, a list containing meta information about the response.

For details about the type of information returned, see Message format.

Session statistics

The api/audit/sessions/stats endpoint provides statistics about recorded sessions (active and closed).

URL
GET https://<IP-address-of-SPS>/api/audit/sessions/stats?field=<field-name>
Cookies
Cookie name Description Required Values
session_id Contains the authentication token of the user Required

The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API.

Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format).
Sample request

The following command retrieves statistical data about sessions.

curl --cookie cookies https://<IP-address-of-SPS>/api/audit/sessions/stats?field=<field-name>
Request parameters

Use the following parameters to fine-tune your request for statistics:

  • ?q: Narrow down the scope of statistics using one or more properties (elements) of the sessions.

  • ?field: Request statistics for the selected properties (elements and values) of sessions (for example, protocol).

    Using this parameter is mandatory.

  • ?sub_fields: Request sub statistics for the selected properties (elements and values) of sessions (for example, protocol).

    This parameter only accepts a single parameter. If more than one parameter is listed, only the first will be considered.

  • ?size: Limit the range of values displayed in the statistics for a given field. Statistics will be shown only for the top size number of most frequently occurring values (that is, values with the highest number of counts).

    Take the following example. If you query "/api/audit/sessions/stats?field=protocol&size=2", and the following sessions were recorded:

    ...
{
  "Alpha": {
    "protocol": "http"
  },
  "Bravo": {
    "protocol": "ssh"
  },
  "Charlie": {
    "protocol": "rdp"
  },
  "Delta": {
    "protocol": "rdp"
  },
  "Echo": {
    "protocol": "rdp"
  },
  "Foxtrot": {
    "protocol": "http"
  },
  "Golf": {
    "protocol": "http"
  }
}
...

    The response contains:

    ...
{
 "meta": {
    "href": "/api/audit/sessions/stats",
    "parent": "/api/audit/sessions",
    "others": 1,
    "field": "protocol",
    "size": 2
 }
}
...

    And the response items look like the snippet below. That is, in this example, there will be no statistics for "protocol": "ssh". The top 2 values are "rdp" and "http", with a count of 3 each. "ssh" occurred only once, so it did not make it to the top 2 most frequent values.

    ...
[
 {"count": 3, "value": "http"},
 {"count": 3, "value": "rdp"}
...

  • ?start: Statistics are returned for sessions that started after the specified date. Use the ISO 8601 format for the date, for example, 2017-01-25T10:00.

  • ?end: Statistics are returned for sessions that ended before the specified date. Use the ISO 8601 format for the date, for example, 2017-01-25T11:00.

  • ?content: Statistics are returned for indexed sessions that contain the type of content specified.

    		 NOTE:

    When performing a content query, the maximum number of results returned is 3000. When this limit is exceeded, the scope of statistics is limited to the first 3000 sessions (even if there are more than 3000 sessions that match your criteria).

Response

The following snippet is a sample response received when retrieving statistics about the protocol field.

For details of the meta object, see Message format.

Those fields of the meta object that are specific to statistics are collected in table Element .

{
    "items": [
        {
            "count": 7,
            "value": "ssh"
        }
    ],
    "meta": {
        "field": "protocol",
        "href": "/api/audit/sessions/stats",
        "others": 0,
        "parent": "/api/audit/sessions",
        "remaining_seconds": 600,
        "size": 10
    }
}
Element Type Description
body, or items when a list is returned Top-level element (string) Contains the properties that are in the scope of the requested statistics.
count integer Indicates the number of sessions included in the scope of statistics.
value string Contains the value of the field that you requested statistics about.
meta Top-level element Contains links to different parts of the REST service.
field string Contains the name of the field that you requested statistics about.
sub_fields string Contains the name of the sub field that you requested statistics about.
others integer

Some values of the field that you specified in your query are not included in the scope of statitics. This happens when a specific value occurs fewer times in the examined sessions than the aggregation size.

The others field indicates the number of those distinct values that are not included in the statistics.

For a detailed explanation with an example, see ?size.

size integer The size that you specified in your query.
Example 1:

If you query "/api/audit/sessions/stats?field=protocol", and the following sessions were recorded:

...
{
  "Alpha": {
    "protocol": "ssh"
  },
  "Bravo": {
    "protocol": "ssh"
  },
  "Charlie": {
    "protocol": "rdp"
  },
  "Delta": {
    "protocol": "rdp"
  },
  "Echo": {
    "protocol": "rdp"
  },
  "Foxtrot": {
    "protocol": "ssh"
  },
  "Golf": {
    "protocol": "ssh"
  }
}
...

The response contains:

...
{
  "meta": {
    "href": "/api/audit/sessions/stats",
    "parent": "/api/audit/sessions",
    "others": 0,
    "field": "protocol"
  }
}
...

The response items contain:

...
[
 {"count": 4, "value": "ssh"},
 {"count": 3, "value": "rdp"}  
...
Example 2:

If you query "/api/audit/sessions/stats?field=protocol&content=login&start=2017-01-02&end=2017-01-03&q=psm.content_reference_id%3A%5B3%20TO%206%5D", and the following sessions were recorded:

{
  "Alpha": {
    "protocol": "ssh",
    "start_time": "2017-01-01",
    "end_time": "2017-01-02",
    "recording": {
      "content_reference_id": 1
    }
  },
  "Bravo": {
    "protocol": "ssh",
    "start_time": "2017-01-01",
    "end_time": "2017-01-02",
    "recording": {
      "content_reference_id": 2
    }
  },
  "Charlie": {
    "protocol": "rdp",
    "start_time": "2017-01-01",
    "end_time": "2017-01-02",
    "recording": {
      "content_reference_id": 3
    }
  },
  "Delta": {
    "protocol": "rdp",
    "start_time": "2017-01-03",
    "end_time": "2017-01-04",
    "psm": {
      "content_reference_id": 4
    }
  },
  "Echo": {
    "protocol": "rdp",
    "start_time": "2017-01-03",
    "end_time": "2017-01-04",
    "recording": {
      "content_reference_id": 5
    }
  },
  "Foxtrot": {
    "protocol": "ssh",
    "start_time": "2017-01-04",
    "end_time": "2017-01-06",
    "recording": {
      "content_reference_id": 6
    }
  },
  "Golf": {
    "protocol": "ssh",
    "start_time": "2017-01-02",
    "end_time": "2017-01-10",
    "recording": {
      "content_reference_id": 7
    }
  }
}

And the following sessions match when running the content query:

| trail_id | rank  | hits_count |
|    1     | 1.555 | 1          |
|    2     | 1.555 | 1          |
|    3     | 1.555 | 1          |
|    4     | 1.555 | 1          |
|    6     | 1.555 | 1          |

The response contains:

...
{
  "meta": {
    "href": "/api/audit/sessions/stats",
    "parent": "/api/audit/sessions",
    "others": 0,
    "field": "protocol"
  }
}
...

The response items contain:

...
[
 {"count": 2, "value": "rdp"} 
...
Example 3:

If you query "/api/audit/sessions/stats?field=user.gateway_username&?sub_fields=protocol&?size=1", and the following sessions were recorded:

...
{
  "Alpha": {
    "protocol": "ssh",
    "user": {
      "gateway_username": "user-Alpha"
    }
  },
  "Bravo": {
    "protocol": "ssh",
    "user": {
      "gateway_username": "user-Bravo"
    }
  },
  "Charlie": {
    "protocol": "rdp",
    "user": {
      "gateway_username": "user-Charlie"
    }
  },
  "Delta": {
    "protocol": "rdp",
    "user": {
      "gateway_username": "user-Alpha"
    }
  },
  "Echo": {
    "protocol": "rdp",
    "user": {
      "gateway_username": "user-Alpha"
    }
  },
  "Foxtrot": {
    "protocol": "ssh",
    "user": {
      "gateway_username": "user-Alpha"
    }
  },
  "Golf": {
    "protocol": "ssh",
    "user": {
      "gateway_username": "user-Alpha"
    }
  },
  "Hotel": {
    "protocol": "ssh",
    "user": {
      "gateway_username": "user-Delta"
    }
  }
}
...

The response contains:

...
{
  "meta": {
    "href": "/api/audit/sessions/stats",
    "parent": "/api/audit/sessions",
    "others": 3
  }
}
...

The response items contain:

...
[
  {
    "buckets": [
      {
        "count": 3,
        "value": "ssh"
      }
    ],
    "count": 5,
    "others": 2,
    "value": "user-Alpha"
  }
]  
...
Status and error codes

The following table lists the typical status and error codes for this request. For a complete list of error codes, see Application level error codes.

Code Description Notes
200 OK The query was well-formed and statistics have been successfully retrieved.
400 InvalidQueryValue The query is invalid, for example, it has an invalid value.
500 SearchUnavailable The search backend is inaccessible.

Session histogram

The api/audit/sessions/histogram endpoint provides a histogram about the recorded sessions.

URL
GET https://<IP-address-of-SPS>/api/audit/sessions/histogram
Cookies
Cookie name Description Required Values
session_id Contains the authentication token of the user Required

The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API.

Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format).
Sample request

The following command retrieves statistical data about sessions.

curl --cookie cookies https://<IP-address-of-SPS>/api/audit/sessions/histogram
Request parameters

Use the following parameters to fine-tune your request for statistics:

  • ?q: Narrow down the scope of the histogram using one or more properties (elements) of the sessions.

  • ?field: Create a histogram for the selected properties (elements and values) of sessions (for example, protocol).

    Using this parameter is mandatory.

  • ?bin-size: Determines the size of the unit for the histogram, for example, hour. SPS splits the queried period to intervals of this unit, and returns the number of sessions to each interval. For example, if you query an histogram from 2018-02-12:14:40 to 2018-02-16:14:40, and you set the bin-size to day, then SPS will return five datasets (one for each day). If you set the bin-size to week, then SPS will return only one dataset.

  • ?start: Create a histogram from the sessions that started after the specified date. Use the ISO 8601 format for the date, for example, 2017-01-25T10:00. By default, this is the one month before the date of the request.

  • ?end: Create a histogram from the sessions that ended before the specified date. Use the ISO 8601 format for the date, for example, 2017-01-25T11:00. By default, this is the date of the request.

  • ?size: Limit the range of values displayed in the histogram for a given field. The histogram will only be created for the top size number of most frequently occurring values (that is, values with the highest number of counts).

Response

The following snippet is a sample response received when retrieving a histogram about the audited sessions.

For details of the meta object, see Message format.

Those fields of the meta object that are specific to histograms are described in table Element .

{
"body": {
    "buckets": [
        { "active_count": 61, "id": "2018-01-15T12:00:00.000Z", "start_count": 61 },
        { "active_count": 99, "id": "2018-01-15T13:00:00.000Z", "start_count": 89 },
        { "active_count": 39, "id": "2018-01-15T14:00:00.000Z", "start_count": 24 },
        { "active_count": 62, "id": "2018-01-15T15:00:00.000Z", "start_count": 62 },
        { "active_count": 92, "id": "2018-01-15T16:00:00.000Z", "start_count": 81 },
        { "active_count": 27, "id": "2018-01-15T17:00:00.000Z", "start_count": 19 }
    ]
},

"key": "histogram",
"meta":
    {
        "bin_size": "month",
        "field": "recording.connection_policy",
        "href": "/api/audit/sessions/histogram",
        "parent": "/api/audit/sessions",
        "remaining_seconds": 599,
        "time_zone": "Etc/UTC",
        "size": "10"
    }
}
Element Type Description
body Top-level element (string) Contains the properties that are in the scope of the requested histogram.
buckets list Contains the details of the histogram.
active_count integer The number of sessions that were active in this interval.
id date The starting date of the interval in ISO 8601 format.
start_count integer The number of sessions that were started in this interval.
meta Top-level element (JSON object) Contains metadata about the endpoint and the histogram.
bin_size string The size of the intervals used to create the histogram. You can change this using the ?bin_size parameter of the request. Default value: month. Possible values: second, minute, hour, day, week, month, year
field string Contains the name of the field that you requested statistics about.
end date The date set in the ?end parameter of the request. By default, this is the date of the request.
start date The date set in the ?start parameter of the request. By default, this is one month before the date of the request.
time_zone string The time zone to use when calculating the intervals of the histogram, for example, Etc/UTC. By default, SPS uses UTC+0 (Zulu Time Zone). For the list of available time zones, see Element .
size integer The size that you specified in your query.
Status and error codes

The following table lists the typical status and error codes for this request. For a complete list of error codes, see Application level error codes.

Code Description Notes
200 OK The query was well-formed and the histogram has been successfully retrieved.
400 TooMuchBucketsInResult Using the requested bin_size would result in too many intervals for the queried period.
400 NotSupportedContentOption This endpoint does not support filtering in the content of sessions.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating