Chat now with support
Chat with Support

One Identity Safeguard for Privileged Sessions 7.5 - REST API Reference Guide

Introduction Using the SPS REST API Basic settings User management and access control Managing SPS General connection settings HTTP connections Citrix ICA connections MSSQL connections RDP connections SSH connections Telnet connections VNC connections Search, retrieve, download, and index sessions Reporting Health and maintenance Advanced authentication and authorization Completing the Welcome Wizard using REST Enable and configure analytics using REST REST API examples

Retrieving all sessions from the session database with the advanced search method

You can retrieve sessions from the session database by using a refined query, with the basic search method. However, the basic search method has limitations due to match count restraints and pagination methods. If you have to work outside these limitations, you can also retrieve all session metadata stored at a specified moment from the sessions database, with the advanced search method. This method builds on session database snapshots.

Using the advanced search method has the following workflow:

  1. Creating a new session database snapshot

  2. Querying the new session database snapshot

Creating a new session database snapshot

Before you can retrieve all sessions from the session database, you must create a new session database snapshot.

URL
GET https://<IP-address-of-SPS>/api/audit/sessions/_snapshot
Cookies
Cookie name Description Required Values
session_id Contains the authentication token of the user Required

The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For more information on authentication, see Authenticate to the SPS REST API.

NOTE: This session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format).
Prerequisites

Before creating a new snapshot, consider the following:

  • You must have search rights to create a new snapshot. For more information, see Assigning search privileges in the SPS Administration Guide.

  • You can use a cached snapshot for further queries if you included the Remote-Addr and User-Agent parameter values in the header of your request and the snapshot ID is associated with you. You can use a snapshot from the cache until it expires. Snapshots expire in 5 minutes, but all subsequent queries you make in a given snapshot extend its validity by 5 more minutes.

Limitations

Creating a new session database snapshot has the following limitations:

  • You can only have one snapshot open at the same time.

  • If you want to create a new snapshot, but you already have another snapshot open, you must not query the previously opened snapshot for at least 5 minutes.

  • If you do not set the Remote-Addr and the User-Agent parameters in the header, the endpoint creates the snapshot, but it associates the snapshot ID with an unknown user. If several unknown users use the endpoint, the endpoint can provide you a snapshot from the cache that was created by another unknown user.

Cache handling logic

If you create a snapshot, the snapshot ID is stored in an internal cache of the endpoint and the ID is associated with you.

You are identified by the values of the Remote-Addr and User-Agent header parameters.

NOTE: By default, the Remote-Addr and the User-Agent values are not included in the header of your request. Therefore, before sending the request, set the values for the Remote-Addr and the User-Agent parameters so that the endpoint can associate the snapshot ID with you.

If there is a cached snapshot ID associated with you, you can use the cached snapshot for further queries.

If there is no cached snapshot ID associated with you, the endpoint creates a new snapshot.

Sample request

The following example illustrates the sample request for creating a new session database snapshot.

Creating a new session database snapshot

Sample request:

curl --cookie cookies.txt 'https://<IP-address-of-SPS>/api/audit/sessions/_snapshot' \
-H "Remote-Addr: 10.10.10.10" \
-H "User-Agent: Agent-1/1.0"

Where:

  • Remote-Addr is your IP address.

  • User-Agent is the identifier of the application that you are using.

Sample response

The following example illustrates the sample response for creating a new session database snapshot.

Creating a new session database snapshot

Sample response:

{ 
  "body": {
    "snapshot": "55cdf68f6d"
  },
  "key": "_snapshot",
  "meta": {
    "href": "/api/audit/sessions/_snapshot",
    "parent": "/api/audit/sessions"
  }
}
HTTP response codes

HTTP response codes comprise of standard or endpoint-specific HTTP status and error codes. The following table lists the endpoint-specific HTTP response codes for creating a snapshot.

Code Description Notes
200 Ok

You have successfully opened the snapshot.

400 InvalidSearchClientId

The search client identifier is invalid.

The value you specified in the Remote-Addr request header is too long.

Provide a value for the Remote-Addr request header that it is at maximum 45 characters long.

400

InvalidSearchClientId

The search client identifier is invalid.

The value you specified in the User-Agent request header is too long.

Provide a value for the User-Agent request header that it is at the maximum 128characters long.

429

AdvancedSearchSnapshotQuotaExceeded

"time_to_elapse": 5,

An open snapshot already exists and you can not open a new one for at least 5 minutes.

500 SearchUnavailable

The search backend is inaccessible.

500 DatabaseConsistencyError

The search database returned an invalid response.

The standard HTTP response codes for this request are:

  • 401 Unauthenticated

  • 403 Unauthorized

For more information and a complete list of standard HTTP response codes, see Application level error codes.

Querying the new session database snapshot

After you have created a new session database snapshot, you can start querying it through the /api/audit/sessions endpoint.

NOTE: Before querying the newly created session database snapshot, consider the following:

  • Unsupported request parameters for the advanced search method

    • The offset parameter is not supported for the advanced search method.

      The offset parameter is not supported for the advanced search method. Instead, you can iterate between search results by specifying the search_after and tiebreaker parameters in your query. Also, One Identity recommends that you do not include the offset parameter in your configuration. If you do include it, you must set the value of offset to 0.

  • Shortcuts in the "meta" field of your response

    • When querying the session database snapshot, the value of the first, last, and previous fields in the response meta will always be null, as they cannot be computed. The "next" field in the response data, however, will always contain a link to the next search result set if there is more session data that can be retrieved.

  • Using search_after

    • The search_after parameter must have at least one sort key-value pair and exactly one tiebreaker key-value pair, in this exact order.

    • The tiebreaker key-value pair is required for the search_after parameter.

    • When used in the search_after parameter, the order of fields in the sort parameter and the keys in the search_after parameter must be exactly the same.

    • Within the search_after parameter, you cannot specify the same key twice.

    • The fields you specify in search_after must be specified in sort as well, in the exact same order (except for tiebreaker).

    • You must use colons (:) as separator values for the key-value pairs within search_after.

    • You must specify the value of date type fields within the search_after parameter in Epoch seconds.

  • Using sort

    • You can use the sort parameter with the same functions as for the basic search method.

  • Consistency of contents: search_after and sort

    • The fields specified in the sort parameter are reference points for the tiebreaker key-value pair.

    • The number and order of the fields specified in the sort parameter must match those specified in search_after (with the exception of tiebreaker, which is an additional required key-value pair element for the search_after parameter only).

Specifying these parameters incorrectly results in errors while querying the /api/audit/sessions endpoint. For more information, see the specific HTTP response codes.

URL
GET https://<IP-address-of-SPS>/api/audit/sessions
Cookies
Cookie name Description Required Values
session_id Contains the authentication token of the user Required

The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For more information on authentication, see Authenticate to the SPS REST API.

NOTE: This session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format).
Prerequisites

Querying the new session database snapshot has the following prerequisites:

  • For querying the session database snapshot, you must create a new session database snapshot first.

Limitations

Querying the new session database snapshot has the following limitations:

  • Displaying your query results in CSV format is possible with the basic search method, but not supported with the advanced search method. As a result, when using the advanced search method, you can only set your format parameter to display your query results in JSON format.

Use case scenarios with the advanced search method

The following examples illustrate the possible use case scenarios with the advanced search method, and their corresponding sample requests and responses:

Querying the session count

Using the _count endpoint, you can query the number of sessions in a snapshot if you include the snapshot ID in the request.

Using the _count endpoint, you can check the number of sessions without having to download the data or to browse through it page by page.

Querying the session count

Sample request:

curl --cookie cookies.txt --request GET https://<IP-address-of-SPS>/api/audit/sessions/_count?snapshot=55cdf68f6d
Querying the session count

Sample response: 

{
  "count": 4,
  "meta": {
     "href": "/api/audit/sessions/_count",
     "parent": "/api/audit/sessions"
   }
}

Using the _count endpoint and defining a snapshot ID and a filter in your query, you can query the number of sessions that match the filter criteria.

Using the _count endpoint, you can check the number of sessions without having to download the data or to browse through it page by page.

Querying the session count using a filter

Sample request:

curl --cookie cookies.txt --request GET https://<IP-address-of-SPS>/api/audit/sessions/_count?snapshot=55cdf68f6d&q=protocol%3ASSH
Querying the session count using a filter

Sample response: 

{
  "count": 2,
  "meta": {
    "href": "/api/audit/sessions/_count",
    "parent": "/api/audit/sessions"
  }
}
HTTP response codes

HTTP response codes comprise of standard or endpoint-specific HTTP status and error codes. The following table lists the endpoint-specific HTTP response codes for creating a snapshot.

Code Description Notes
400 InvalidAdvancedSearchCountQuery

The filter may be invalid. The backend of the sessions endpoint returned an error. Make sure that you enter a valid filter query. The snapshot ID should be the same you received in the response of the _snapshot endpoint. For more information on correct query syntax, see Searching in the session database with the basic search method.

400 InvalidSearchClientId

The search client identifier is invalid.

The value you specified in the Remote-Addr request header is too long.

Provide a value for the Remote-Addr request header that it is at maximum 45 characters long.

400

InvalidSearchClientId

The search client identifier is invalid.

The value you specified in the User-Agent request header is too long.

Provide a value for the User-Agent request header that it is at the maximum 128 characters long.

404

CountQuerySnapshotNotFound

Your count query is invalid. The snapshot you specified in the snapshot request parameter does not exist or has expired. For more information on how to create a valid request to retrieve the exact number of sessions matching a search query, see the REST API Reference Guide.

For more information and a complete list of standard HTTP response codes, see Application level error codes.

Iterating through query results

To retrieve all sessions from the session database snapshot, you have to iterate through the results until your response meta contains a null value for the "next" field.

To iterate through query results

  1. Send a GET request to the /api/audit/sessions endpoint.

    Sample request:

    curl --cookie cookies.txt 'https://<IP-address-of-SPS>/api/audit/sessions?limit=2&sort=start_time&snapshot=55cdf68f6d'

    Sample response:

    {
  "items": [
    {
      "key": "sid1",
      "meta": {
        "href": "/api/audit/sessions/sid1"
      }
    },
    {
      "key": "sid2",
      "meta": {
        "href": "/api/audit/sessions/sid2"
      }
    }
  ],
  "meta": {
    "fields": [],
    "first": null,
    "href": "/api/audit/sessions",
    "last": null,
    "limit": 2,
    "next": "/api/audit/sessions?limit=2&sort=start_time&snapshot=55cdf68f6d&search_after=start_time:1643677200,tiebreaker:4294967296",
    "parent": "/api/audit",
    "previous": null,
    "search_after": "start_time:1643677200,tiebreaker:4294967296"
  }
}

    The link in the "next": "/api/audit/sessions?limit=2&sort=start_time&snapshot=55cdf68f6d&search_after=start_time:1643677200,tiebreaker:4294967296" key-value pair is required for the next step in iterating.

  2. Iterate through your query results using the next link URL from your previous query result.

    Sample request:

    curl --cookie cookies.txt 'https://<IP-address-of-SPS><NEXT-LINK-FROM-PREVIOUS-RESPONSE>'

    Continue iterating your query results until your response contains a null value as a "next" link.

    Sample response:

    {
  "items": [],
  "meta": {
    "fields": [],
    "first": null,
    "href": "/api/audit/sessions",
    "last": null,
    "limit": 2,
    "next": null,
    "parent": "/api/audit",
    "previous": null,
    "search_after": null
  }
}
Retrieving sessions' metadata with start-end time filter

With the advanced search method, you can retrieve sessions' metadata with start-end time filter.

Sample request:

curl --cookie cookies.txt 'https://<IP-address-of-SPS>/api/audit/sessions?limit=2&sort=start_time&start=2022-01-15T00%3A00%3A00%2B00%3A00&end=2022-05-15T00%3A00%3A00%2B00%3A00&snapshot=55cdf68f6d'

Sample response:

{
  "items": [
    {"key": "sid2", "meta": {"href": "/api/audit/sessions/sid2"}},
    {"key": "sid3", "meta": {"href": "/api/audit/sessions/sid3"}}
  ],
  "meta": {
    "end": "2022-05-15T00:00:00+00:00",
    "fields": [],
    "first": null,
    "href": "/api/audit/sessions",
    "last": null,
    "limit": 2,
    "next": "/api/audit/sessions?limit=2&sort=start_time&start=2022-01-15T00%3A00%3A00%2B00%3A00&end=2022-05-15T00%3A00%3A00%2B00%3A00&snapshot=55cdf68f6d&search_after=start_time:1646096400,tiebreaker:4294967297",
    "parent": "/api/audit",
    "previous": null,
    "search_after": "start_time:1646096400,tiebreaker:4294967297",
    "start": "2022-01-15T00:00:00+00:00"
  }
}
Retrieving specific metadata from sessions with query filter

With the advanced search method, you can retrieve specific metadata from your sessions with query filter.

Sample request:

curl --cookie cookies.txt 'https://<IP-address-of-SPS>/api/audit/sessions?limit=2&sort=start_time&fields=protocol,verdict&q=protocol%3A%20SSH&snapshot=55cdf68f6d'

Sample response:

{
  "items": [
  {
    "body": {
      "protocol": "SSH",
      "verdict": "ACCEPT"
    },
    "key": "sid1",
    "meta": {
    "href": "/api/audit/sessions/sid1"
    }
  },
  {
    "body": {
      "protocol": "SSH",
      "verdict": "ACCEPT"
    },
    "key": "sid4",
    "meta": {
      "href": "/api/audit/sessions/sid4"
      }
    }
  ],
"meta": {
  "fields": [
    "protocol",
    "verdict"
  ],
  "first": null,
  "href": "/api/audit/sessions",
  "last": null,
  "limit": 2,
  "next": "/api/audit/sessions?limit=2&fields=protocol,verdict&q=protocol%3A%20SSH&sort=start_time&snapshot=55cdf68f6d&search_after=start_time:1648774800,tiebreaker:0",
  "parent": "/api/audit",
  "previous": null,
  "search_after": "start_time:1648774800,tiebreaker:0"
  }
}
Retrieving sessions' metadata with modified sort order

With the advanced search method, you can retrieve sessions' metadata with modified sort order.

Sample request:

curl --cookie cookies.txt 'https://<IP-address-of-SPS>/api/audit/sessions?limit=2&sort=-start_time&start=2022-02-15T00%3A00%3A00%2B00%3A00&snapshot=55cdf68f6d'

Sample response:

{
  "items": [
    {"key": "sid6", "meta": {"href": "/api/audit/sessions/sid6"}},
    {"key": "sid5", "meta": {"href": "/api/audit/sessions/sid5"}}
  ],
  "meta": {
    "fields": [],
    "first": null,
    "href": "/api/audit/sessions",
    "last": null,
    "limit": 2,
    "next": "/api/audit/sessions?limit=2&sort=-start_time&start=2022-02-15T00%3A00%3A00%2B00%3A00&snapshot=55cdf68f6d&search_after=start_time:1651366800,tiebreaker:12884901888",
    "parent": "/api/audit",
    "previous": null,
    "search_after": "start_time:1651366800,tiebreaker:12884901888",
    "start": "2022-02-15T00:00:00+00:00"
  }
}
Retrieving sessions' metadata with multiple sort fields

With the advanced search method, you can retrieve sessions' metadata with multiple sort fields.

Sample request:

curl --cookie cookies.txt 'https://<IP-address-of-SPS>/api/audit/sessions?limit=2&sort=-protocol,-start_time&snapshot=55cdf68f6d'

Sample response:

{
  "items": [
    {"key": "sid6", "meta": {"href": "/api/audit/sessions/sid6"}},
    {"key": "sid4", "meta": {"href": "/api/audit/sessions/sid4"}}
  ],
  "meta": {
    "fields": [],
    "first": null,
    "href": "/api/audit/sessions",
    "last": null,"limit": 2,
    "next": "/api/audit/sessions?limit=2&sort=-protocol,-start_time&snapshot=55cdf68f6d&search_after=protocol:SSH,start_time:1648774800,tiebreaker:0",
    "parent": "/api/audit",
    "previous": null,
    "search_after": "protocol:SSH,start_time:1648774800,tiebreaker:0"
  }
}
HTTP response codes

HTTP response codes comprise of standard or endpoint-specific HTTP status and error codes. The following table lists the HTTP response codes specifically for querying the sessions database snapshot.

NOTE: For more information about why you may encounter these HTTP response codes, see the rules and limitations of querying the session database snapshot with the advanced search method.

Code Description Notes
400 MissingSearchAfterSnapshot

The snapshot ID is missing from your query.

400 MissingSearchAfterSort

The sort parameter is missing from your query.

400 InvalidSearchAfterKeyValue

Possible scenario:

The value of one or more keys in the search_after parameter is not valid. Enter valid values for the keys in the search_after parameter.

The following request results in a 400 InvalidSearchAfterKeyValue error:

GET /api/audit/sessions?snapshot="55cdf68f6d"&sort=start_time&search_after=client.ip:<not-a-valid-ip-address>,tiebreaker:42348
400 DuplicatedSearchAfterKey

The search_after parameter contains one or more duplicated key-value pairs. Enter only one key-value pair for a key in the search_after parameter.

The following request results in a 400 DuplicatedSearchAfterKey error:

GET /api/audit/sessions?snapshot="55cdf68f6d"&sort=start_time&search_after=start_time:1666335341,start_time:1666335342,tiebreaker:42348
400 MissingSearchAfterTiebreaker

You have not specified the tiebreaker key-value pair in your search_after parameter.

Specify the tiebreaker key-value parameter for your query.

400

InvalidSearchAfterKeyValueFormat

The format of your search_after parameter is not a valid key-value format.

Specify key-value pairs for the search_after parameter by using a <key>:<value> format.

400

InconsistentSearchAfterParameters

Your search_after query is not valid.

The number of the sort values is inconsistent with the number of the search_after key-value pairs.

400

MissingSearchAfterKeyValue

There are one or more key-value pairs missing from the search_after parameter. Enter key-value pairs in the search_after parameter for the fields specified in the sort parameter.

The following request results in a 400 MissingSearchAfterKeyValue error:

GET /api/audit/sessions?snapshot="55cdf68f6d"&sort=start_time,protocol&search_after=start_time:1666335341,tiebreaker:42348

400

InconsistentSearchAfterOrder

Your search_after query is not valid. The order of the fields in the sort parameter must be the same as the order of the keys in the search_after parameter.

400

InvalidSearchAfterOffset

You have specified the value of offset to a number other than 0.

400

InvalidSearchAfterResponseFormat

You have requested an unsupported response format (for example, the unsupported csv format) for displaying your query results.

400

InvalidSearchAfterQuery

Possible scenarios:

  • Your tiebreaker key-value pair is not valid.

  • Your filter query is not valid.

400 InvalidSearchClientId

The search client identifier is invalid.

The value you specified in the Remote-Addr request header is too long.

Provide a value for the Remote-Addr request header that it is at maximum 45 characters long.

400

InvalidSearchClientId

The search client identifier is invalid.

The value you specified in the User-Agent request header is too long.

Provide a value for the User-Agent request header that it is at the maximum 128 characters long.

404

SearchQuerySnapshotNotFound

Your advanced search query is invalid.

The snapshot you specified in the snapshot request parameter does not exist or has expired.

For more information on how to create a valid request to query all session data, see the REST API Reference Guide.

The standard HTTP response codes for this request are:

  • 401 Unauthenticated

  • 403 Unauthorized

For more information and a complete list of standard HTTP response codes, see Application level error codes.

Retrieving user information from the recorded sessions

The api/audit/users endpoint provides user information extracted from recorded sessions.

Prerequisite

  • To retrieve user information, you must have 'Search in all users' ACL.

URL
GET https://<IP-address-of-SPS>/api/audit/users
Cookies
Cookie name Description Required Values
session_id Contains the authentication token of the user Required

The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For more information on authentication, see Authenticate to the SPS REST API.

NOTE: This session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format).

Endpoint

Description

api/audit/users/_count

You can retrieve the total number of users.
Sample request

The following command lists the available user information.

Querying audited users request

Response

The following is a sample response received when listing user information.

Querying audited users response

For more information on the meta object, see Message format.

Elements response message body include:

Element

Type

Description

items

List

Top level element, lists audited users.

id

String

The ID of the user.

last_seen

String

The date of the user's last activity.

score

String

The risk of the user's activity according to the baseline.

score_timestamp

String

The date when the score was calculated. Its value determines the value of the has_valid_score parameter.

has_valid_score

Boolean

This parameter shows if the user has a valid score or not. The valid values are true and false. The value of this parameter depends on the score_timestamp and score parameters. If the score_timestamp parameter is not too old and the user has a score, then has_valid_score will return a true value.

meta

JSON object

Top level element, contains metadata about the endpoint.

href

string (relative path)

Path of the resource that returned the response. When creating a new object, this is the URL of the created object.

limit

Integer

This parameter displays the number of users returned in the response body. The default value is 100.

parent

string (relative path)

Path of the parent of the current resource.

Sample request

The following command lists the user information and limits the search results in 1.

NOTE: The maximum value that you can give to the limit parameter is 25000.

Querying audited users using the `limit` parameter to limit the search results request

Response

The following is a sample response received when listing user information and limiting the search results in 1.

Querying audited users using the `limit` parameter to limit the search results response

Sample request

The following command sorts user information based on the score parameter.

NOTE: The default sorting method sorts the results based on the last_seen and the score parameters in a decreasing manner (-last_seen,-score).

Querying audited users using the `sort` parameter to sort the search results request

Response

The following is a sample response received when sorting user information based on the score parameter.

Querying audited users using the `sort` parameter to sort the search results response

Sample request

The following command filters user information based on the has_valid_score parameter.

Querying audited users using the `has_valid_score` parameter to filter the search results request

Response

The following is a sample response received when filtering user information based on the has_valid_score parameter.

Querying audited users using the `has_valid_score` parameter to filter the search results response

Querying the users count

api/audit/users/_count

Using this endpoint, you can check the total number of users in the recorded sessions.

Sample request

The following command counts the total number of users in the recorded sessions.

Querying the number of audited users request

Response

The following is a sample response received when counting the total number of users in the recorded sessions.

Querying the number of audited users response

Elements response message body include:

Element

Type

Description

count

Integer

Displays the total number of users in the recorded sessions.

For more information on the meta object, see Message format.

Status and error codes

The following table lists the typical status and error codes for this request. For a complete list of error codes, see Application level error codes.

Code

Description

Notes

200

Ok

The JSON file that contains the users information was retrieved successfully.

400

UsersRestNotAvailable

Querying users REST API endpoints on a cluster node with a search-minion role is not supported. To query users REST API endpoints, issue the same request on your search-master or search-local node.

400

DuplicatedParameterError

Invalid query: your query contains duplicated search parameter. Use each search parameter only once.

400

InvalidSort

Same field was given more than once.

400

InvalidSort

Invalid fields given.

400

InvalidQueryValue

Limit should be less than 25001.

400

InvalidQueryValue

You have entered an invalid value ('*value*') for the has_valid_score parameter. Specify a valid value. The valid values are true and false.

400

NotANumber

The limit request parameter you provided is invalid. To submit a valid request, provide a number for the limit request parameter.

400

NegativeValue

Limit should be greater than 0.

401

Unauthenticated

The requested resource cannot be retrieved because the client is not authenticated and the resource requires authorization to access it. The details section contains the path that was attempted to be accessed, but could not be retrieved.

403

Unauthorized

The requested resource cannot be retrieved because the client is not authorized to access it. The details section contains the path that was attempted to be accessed, but could not be retrieved.

Searching in connection content

You can search in the contents of individual connections at the api/audit/sessions/<session-id>/content/?q=<my-search-expression> endpoint.

URL
GET https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/content/?q=<my-search-expression>
Cookies
Cookie name Description Required Values
session_id Contains the authentication token of the user Required

The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For more information on authentication, see Authenticate to the SPS REST API.

NOTE: This session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format).
Sample request

The following command retrieves those events in the contents of a specific connection that match the search expression(s).

curl --cookie cookies.txt https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/content/?q=<my-search-expression>

NOTE: Make sure that you use the ?q option and that when you use it, you do not leave it empty. Not using the ?q option or an empty ?q will result in an empty "items" list returned in the response.

You can use the Apache Lucene query syntax to create the search expression, but note the following points.

  • You must format the search expression as a URL, and escape special characters accordingly. For example, if your search expression is man iptables, you must escape the whitespace: man%20iptables

  • Do not begin the expression with the * wildcard.

Response

The response contains a list of those events in the contents of the connection that match the search expression(s). The response also contains some meta fields.

If you specified a search expression using the ?q option and the response returns an empty "items" list, that can indicate that:

  • The search returned no results.

  • There is no content recorded for the connection.

The following is an example response:

{
    "items": [
        { 
            "channel.id": 5, 
            "end_time": "2017-08-14T10:35:43.957000", 
            "rank": 2.4756217002868652,
            "record_id": {
                "begin": 158,
                "end": 160,
                "for_screenshot": 158
            },
            "start_time": "2017-08-14T10:35:19.098000", 
            "trail_id": "12" 
        }
    ],
    "meta":
        { 
            "href": "/api/audit/sessions/2a620c1cfeb39c537a5e80280283d741/content", 
            "parent": "/api/audit/sessions/2a620c1cfeb39c537a5e80280283d741", 
            "remaining_seconds": 599 
        }
}
Element Type Description
items list Top-level element, a list containing the details of the matching session.
channel.id integer A reference to the ID of the channel in the session where the event occurred.
end_time string

The timestamp of when the content disappeared from the screen.

Starting with SPS 5 LTS, the timestamp is in ISO 8601 format, for example, 2018-10-11T09:23:38.000+02:00. In earlier versions, it was in UNIX timestamp format.

rank float

Indicates the relevance of the match.

If there are several results, the order of them is based on their relevance.

record_id integer The content element's exact position in the audit trail file.
begin integer The identifier of the screenshot in the audit trail file where the content element first appeared.
end integer The identifier of the screenshot in the audit trail file where the content element last appeared.
for_screenshot integer The identifier of the most relevant screenshot in the audit trail file. This is the screenshot on which the event in question is the most clearly visible. For details on how to generate and retrieve the screenshot, see Generate and retrieve screenshot for content search.
start_time string

The timestamp of when the content first appeared on the screen and recording started.

Starting with SPS 5 LTS, the timestamp is in ISO 8601 format, for example, 2018-10-11T09:23:38.000+02:00. In earlier versions, it was in UNIX timestamp format.

trail_id integer The unique identifier of the trail that contains the event.

In addition, search results can contain the usual meta elements of other endpoints:

Element Type Description
meta JSON object

Top-level element, a list containing meta information about the response.

For details about the type of information returned, see Message format.

Generate and retrieve screenshot for content search

To generate and download screenshots for a specific content search result, complete the following steps. For details on searching in the content of a session, see Searching in connection content.

  1. Perform a content search in a session.

    Use a GET request on the endpoint of a specific session, for example:

    GET https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/content/?q=<my-search-expression>

    For details, see Searching in connection content. If there are search results for the search keywords in the session, the response includes a record_id block, for example:

    "record_id": {
    "begin": 158,
    "end": 160,
    "for_screenshot": 158
},
  2. Generate a screenshot for the search result.

    Note the value of the for_screenshot key in the search response, and use it to generate a screenshot for that particular record_id. POST the value of the for_screenshot key to the https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/_generate?record_ids=<value-of-for_screenshot> endpoint.

  3. Download the screenshot.

    To download the screenshot in PNG format, GET the value of the for_screenshot key to the https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/screenshots/<value-of-for_screenshot> endpoint.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating