One Identity Safeguard for Privileged Sessions 5.7.0 - REST API Reference Guide

Session events

The api/audit/sessions/<session-id>/events endpoint lists the events extracted from a session (if any). Events are available only if the session is indexed. For details on configuring indexing, see Local services: configuring the indexer.

URL

GET https://<IP-address-of-Safeguard for Privileged Sessions>/api/audit/sessions/<session-id>/events

Headers

Sample request

The following command lists the events of a session.

curl --cookie cookies "https://<IP-address-of-Safeguard for Privileged Sessions>/api/audit/sessions/<session-id>/events"

Response

The following is a sample response received when listing the events of a session. For details of the meta object, see Introduction.

{
    "items": [
        {
            "psm.channels.id": "0",
            "psm.events.content": "myuser@examplehost:~$ ls",
            "psm.events.record_id": 46,
            "psm.events.time": "2017-04-11T09:21:10.832",
            "psm.events.type": "adp.event.command"
        },
        {
            "psm.channels.id": "0",
            "psm.events.content": "myuser@examplehost:~$ cd /var",
            "psm.events.record_id": 64,
            "psm.events.time": "2017-04-11T09:21:15.488",
            "psm.events.type": "adp.event.command"
        },
        {
            "psm.channels.id": "0",
            "psm.events.content": "myuser@examplehost:/var$ ls",
            "psm.events.record_id": 78,
            "psm.events.time": "2017-04-11T09:21:18.017",
            "psm.events.type": "adp.event.command"
        },
        {
            "psm.channels.id": "0",
            "psm.events.content": "myuser@examplehost:/var$ ls -la",
            "psm.events.record_id": 95,
            "psm.events.time": "2017-04-11T09:21:21.04",
            "psm.events.type": "adp.event.command"
        },
        {
            "psm.channels.id": "0",
            "psm.events.content": "myuser@examplehost:/var$ ls -la",
            "psm.events.record_id": 113,
            "psm.events.time": "2017-04-11T09:21:23.353",
            "psm.events.type": "adp.event.command"
        },
        {
            "psm.channels.id": "0",
            "psm.events.content": "myuser@examplehost:/var$ man sudo",
            "psm.events.record_id": 148,
            "psm.events.time": "2017-04-11T09:21:27.017",
            "psm.events.type": "adp.event.command"
        }
    ],
    "meta": {
        "first": "/api/audit/sessions/7930f4308efe8aecd710202d815b76ff/events?limit=500&offset=0",
        "href": "/api/audit/sessions/7930f4308efe8aecd710202d815b76ff/events",
        "last": "/api/audit/sessions/7930f4308efe8aecd710202d815b76ff/events?limit=500&offset=0",
        "limit": 500,
        "next": null,
        "offset": 0,
        "parent": "/api/audit/sessions/7930f4308efe8aecd710202d815b76ff",
        "previous": null
    }
}

Changing the display limit

You can use the ?limit option to change the number of items displayed at once. The default limit is 500.

?limit=1000

To navigate beyond the displayed set, use the offset option.

Navigating large datasets

You can use the ?offset option to navigate data sets that extend beyond the display limit. The default value of the offset is 0, this is the initially displayed set. To move to other items beyond the initial set, increase the value to a number that corresponds to the item where you want to start displaying results from.

Example: the display limit is the default 500, and the number of sessions is 1012. The initial 500 sessions are listed at:

?offset=0

To view sessions from 501 to 1000, change the offset to 501:

?offset=501

To display the remaining 12 sessions, change the offset to 1001:

?offset=1001

Filtering

You can filter events at the /api/audit/sessions/<session-id>/events endpoint. Use the ?q option to filter the list using one or more properties (elements) of the sessions.

?q=psm.events.content:sudo

You can escape special characters using the backslash character.

?q=psm.events.content:\"Copying Files\"

To add multiple elements to the filter, you can use the AND, AND NOT, and OR operators.

psm.events.content:ls AND psm.events.content:cp AND NOT psm.events.content:mv

You can create groups using () (parentheses).

?q=(psm.events.content:rm OR psm.events.content:mv) AND psm.channels.id:5

You can also use () (parentheses) to add multiple possible values for a property.

?q=psm.events.content:(sudo rm)

You can use the * (asterisk) and ? (question mark) wildcards for string-type values.

?q=psm.events.content:?dmi*

You can define ranges using [] (brackets) or {} (braces) and the TO operator. This only works for numeric (int) values.

• [ means equal or higher than the following value

• ] means equal or lower than the preceding value

• { means higher than the following value

• }means lower than the preceding value

For example, the following range resolves to 2:

?q=psm.channels.id:{1 TO 3}

You can also use the * (asterisk) wildcard in the range.

?q=psm.channels.id:[* TO 5]

Note that not all connection data can be used for filtering. The available elements are:

• psm.channels.id

  Integer, the channel in the session where the event occurred.

• psm.events.content

  Text, the event that occurred in the session.

• psm.events.record_id

  Integer, the identifier of the event in the session.

• psm.events.time

  String, the timestamp when the event occurred.

• psm.events.type

  String, the type of the event:

  • adp.event.command: A command entered in SSH or Telnet.

  • adp.event.screen.content: Screen content.

  • adp.event.screen.creditcard: Credit card numbers detected. Displayed only as an alert, not visible in the events.

  • adp.event.screen.windowtitle: The title of the window in graphic protocols.

Local services: configuring the indexer

Indexing is a resource intensive (CPU and hard disk) operation, and depending on the number of processed audit trails and parallel connections passing Safeguard for Privileged Sessions, may affect the performance of Safeguard for Privileged Sessions. Test it thoroughly before enabling it in a production environment that is under heavy load. If your Safeguard for Privileged Sessions appliance cannot handle the connections and the indexing, consider using external indexers (see "HTTP indexer configuration format" in the Administration Guide) to decrease the load on Safeguard for Privileged Sessions. For sizing recommendations, ask your One Identity partner or contact our Support Team.

URL

GET https://<IP-address-of-Safeguard for Privileged Sessions>/api/configuration/local_services/indexer

Headers

Sample request

The following command lists the configuration options.

curl --cookie cookies https://<IP-address-of-Safeguard for Privileged Sessions>/api/configuration/local_services/indexer

Response

The following is a sample response received when external indexers are disabled. For details of the meta object, see Introduction.

{
    "body": {
        "decryption_keys": [
            {
                "key": "e38d47bd-5374-4d7c-b683-e26ea77142e2",
                "meta": {
                    "href": "/api/configuration/x509/e38d47bd-5374-4d7c-b683-e26ea77142e2"
                }
            }
        ],

        "number_of_workers": 1,
        "remote_access": {
            "enabled": false
        },
        "selection": "integrated"
    },
    "key": "indexer",
    "meta": {
        "first": "/api/configuration/local_services/admin_web",
        "href": "/api/configuration/local_services/indexer",
        "last": "/api/configuration/local_services/user_web",
        "next": "/api/configuration/local_services/postgresql",
        "parent": "/api/configuration/local_services",
        "previous": "/api/configuration/local_services/admin_web",
        "transaction": "/api/transaction"
    }
}

A sample response when external indexers are enabled:

{
    "body": {
        "decryption_keys": [],
        "number_of_workers": 1,
        "remote_access": {
            "access_restriction": {
                "allowed_from": [
                    "10.40.0.0/16"
                ],
                "enabled": true
            },
            "enabled": true,
            "listen": [
                {
                    "address": {
                        "key": "nic1.interfaces.ff7574025754b3df1647001.addresses.1",
                        "meta": {
                            "href": "/api/configuration/network/nics/nic1#interfaces/ff7574025754b3df1647001/addresses/1"
                        }
                    },
                    "port": 12345
                }
            ],
            "ssl_config": {
                "ca": {
                    "key": "52735ce4-4a43-458d-8803-c23c715640a5",
                    "meta": {
                        "href": "/api/configuration/x509/52735ce4-4a43-458d-8803-c23c715640a5"
                    }
                },
                "service": {
                    "key": "60eacdba-d889-4cb4-bdb0-cbbd4054f01c",
                    "meta": {
                        "href": "/api/configuration/x509/60eacdba-d889-4cb4-bdb0-cbbd4054f01c"
                    }
                },
                "worker": {
                    "key": "93198544-1e82-4661-90b7-e01b0b1e2ed9",
                    "meta": {
                        "href": "/api/configuration/x509/93198544-1e82-4661-90b7-e01b0b1e2ed9"
                    }
                }
            }
        },
        "selection": "integrated"
    },
    "key": "indexer",
    "meta": {
        "first": "/api/configuration/local_services/admin_web",
        "href": "/api/configuration/local_services/indexer",
        "last": "/api/configuration/local_services/user_web",
        "next": "/api/configuration/local_services/postgresql",
        "parent": "/api/configuration/local_services",
        "previous": "/api/configuration/local_services/admin_web",
        "transaction": "/api/transaction"
    }
}

{
    "body": {
        "interfaces": {
            "@order": [
                "ff7574025754b3df1647001"
            ],
            "ff7574025754b3df1647001": {
                "addresses": {
                    "1": "10.40.255.171/24",
                    "@order": [
                        "1"
                    ]
                },
                "name": "default",
                "vlantag": 0
            }
        },
        "name": "eth0",
        "speed": "auto"
    },
    "key": "nic1",
    "meta": {
        "first": "/api/configuration/network/nics/nic1",
        "href": "/api/configuration/network/nics/nic1",
        "last": "/api/configuration/network/nics/nic3",
        "next": "/api/configuration/network/nics/nic2",
        "parent": "/api/configuration/network/nics",
        "previous": null,
        "transaction": "/api/transaction"
    }
    }

nic1.interfaces.ff7574025754b3df1647001.addresses.1

"address": "nic1.interfaces.ff7574025754b3df1647001.addresses.1"

"address": {
    "key": "nic1.interfaces.ff7574025754b3df1647001.addresses.1",
    "meta": {
        "href": "/api/configuration/network/nics/nic1#interfaces/ff7574025754b3df1647001/addresses/1"
    }
    },

Status and error codes

The following table lists the typical status and error codes for this request. For a complete list of error codes, see Using the Safeguard for Privileged Sessions REST API.

Updating the indexer configuration

To update the configuration of the indexer, you have to PUT the updated configuration in JSON format to the endpoint, for example:

{
    "decryption_keys": ["216b33dd-a1cd-41b1-85c5-66290b7a043d"],
    "number_of_workers": 2,
    "remote_access": {
        "access_restriction": {
            "allowed_from": [
                "10.40.0.0/16"
            ],
            "enabled": true
        },
        "enabled": true,
        "listen": [
            {
                "address": "nic1.interfaces.ff7574025754b3df1647001.addresses.1",
                "port": 12354
            }
        ],
        "ssl_config": {
            "ca": "773ed50d-3066-44f1-84ec-cbef59111702",
            "service": "a8b6c791-c24a-466d-ac50-a425a5253d46",
            "worker": "c54c436f-63c5-4a2e-a59e-7ad904bbf0f2"
            }
    },
    "selection": "integrated"
}

Indexer policies

Indexer policies allow you to configure the Optical Character Recognition (OCR) engine of Safeguard for Privileged Sessions, and specify which languages it should use. Only graphical protocols (RDP, Citrix ICA, VNC) are affected.

If you specify the languages manually, note the following:

• Specifying only one language provides the best results in terms of performance and precision.

• The English language is always detected along with the non-English languages that you have configured. However, if you want the OCR to only recognize the English language, you have to select it from the list of languages.

• There are certain limitations in the OCR engine when recognizing languages with very different character sets. For this reason, consider the following:

  • When selecting Asian languages (Simplified Chinese, Traditional Chinese, Korean), avoid adding languages that use the Latin alphabet.

  • When selecting the Arabic language, avoid selecting any other languages.

  • The Thai language is currently not supported. If you are interested in using Safeguard for Privileged Sessions to index Thai texts, contact our Sales Team.

URL

GET https://<IP-address-of-Safeguard for Privileged Sessions>/api/configuration/policies/indexing

Headers

Sample request

The following command lists the available indexer policies.

curl --cookie cookies https://<IP-address-of-Safeguard for Privileged Sessions>/api/configuration/policies/indexing

The following command displays a specific indexer policy.

curl --cookie cookies https://<IP-address-of-Safeguard for Privileged Sessions>/api/configuration/policies/indexing/<id-of-the-policy>

Response

The following is a sample response received when querying the /api/configuration/policies/indexing/ endpoint. For details of the meta object, see Introduction.

{
    "items": [
        {
            "key": "-50000",
            "meta": {
                "href": "/api/configuration/policies/indexing/-50000"
            }
        },
        {
            "key": "13442970955825a89b55e46",
            "meta": {
                "href": "/api/configuration/policies/indexing/13442970955825a89b55e46"
            }
        }
    ],

    "meta": {
        "first": "/api/configuration/policies/audit_policies",
        "href": "/api/configuration/policies/indexing",
        "last": "/api/configuration/policies/usermapping_policies",
        "next": "/api/configuration/policies/ldap_servers",
        "parent": "/api/configuration/policies",
        "previous": "/api/configuration/policies/credentialstores",
        "transaction": "/api/transaction"
    }
}

A sample response when querying a specific indexer policy:

{
    "body": {
        "name": "english-german-russian",
        "ocr": {
            "custom_languages": true,
            "languages": [
                "eng",
                "deu",
                "rus"
            ]
        }
    },
    "key": "-50000",
    "meta": {
        "first": "/api/configuration/policies/indexing/-50000",
        "href": "/api/configuration/policies/indexing/-50000",
        "last": "/api/configuration/policies/indexing/-50000",
        "next": null,
        "parent": "/api/configuration/policies/indexing",
        "previous": null,
        "transaction": "/api/transaction"
    }
}

Status and error codes

The following table lists the typical status and error codes for this request. For a complete list of error codes, see Using the Safeguard for Privileged Sessions REST API.

Add an indexing policy

To add an indexing policy, you have to:

1. Open a transaction.

   For details, see Open a transaction.

2. Create the JSON object for the new indexing policy.

   You can find a detailed description of the available parameters listed in Indexer policies.

   POST the JSON object to the https://<IP-address-of-Safeguard for Privileged Sessions>/api/configuration/policies/indexing endpoint. If the POST request is successful, the response includes the key of the new ticketing policy. For example:

   {
     "key": "aa423b72-0d0f-4275-be30-494e9a99ffad",
     "meta": {
       "href": "/api/configuration/policies/indexing/aa423b72-0d0f-4275-be30-494e9a99ffad",
       "parent": "/api/configuration/policies/indexing",
       "transaction": "/api/transaction"
     }
   }

3. Commit your changes.

   For details, see Commit a transaction.

Reporting