One Identity Safeguard for Privileged Sessions 6.14 - REST API Reference Guide

You can monitor the traffic of certain connections in real time, and execute various actions if a certain pattern (for example, a particular command or text) appears in the command line or on the screen, or if a window with a particular title appears in a graphical protocol. Since content-monitoring is performed real-time, One Identity Safeguard for Privileged Sessions (SPS) can prevent harmful commands from being executed on your servers. SPS can also detect numbers that might be credit card numbers. The patterns to find can be defined as regular expressions. In case of ICA, RDP, and VNC connections, SPS can detect window title content.

The following actions can be performed:

• Log the event in the system logs.

• Immediately terminate the connection.

• Send an e-mail or SNMP alerts about the event.

• Store the event in the connection database of SPS.

SPS currently supports content monitoring in SSH session-shell connections, Telnet connections, RDP and Citrix ICA Drawing channels, and in VNC connections.

To list the available Content policies, use the following command.

curl --cookie cookies https://<IP-address-of-SPS>/api/configuration/policies/content_policies

The following sections detail the properties of Content policy objects.

URL

GET https:<IP-address-of-SPS>/api/configuration/policies/content_policies/<object-id>

Cookies

Sample request

The following command lists the properties of a specific Content policy object.

curl --cookie cookies -https:<IP-address-of-SPS>/api/configuration/policies/content_policies/<object-id>

Response

The following is a sample response received, showing the properties of Content policy objects.

For details of the meta object, see Message format.

{
  "body": {
    "name": "example-content-policy-window-title",
    "rules": [
      {
        "actions": {
          "log": true,
          "notify": true,
          "store_in_connection_database": true,
          "terminate": false
        },
        "event": {
          "ignore": [],
          "match": [
            "mmc.exe"
          ],
          "selection": "window_title"
        },
        "gateway_groups": [],
        "remote_groups": []
      }
    ]
  }
}

"gateway_groups": ["group1", "group2"],

"remote_groups": ["group1", "group3"],

"ignore": [
"mmc.exe",
"cmd.exe"
                            
Use Perl Compatible Regular Expressions (PCRE).
The following characters must be escaped using a backslash character: '(single-quote). For example, instead of .*' use .*\'
SPS uses substring search to find the expression in the content. That is, SPS finds the expression even if there is more content before or after the matching part. For example, the conf pattern will match the following texts: conf, configure, reconfigure, arcconf, and so on.
Using complicated regular expressions or using many regular expressions will affect the performance of SPS.
If the multiple expressions are set, SPS processes them one after the other, and stops processing the content if the first match is found, even if other expressions would also match the content. Therefore, when using multiple expressions, start with the most specific one, and add general expressions afterward.

"match": [
"mmc.exe",
"cmd.exe"
                            
Use Perl Compatible Regular Expressions (PCRE).
The following characters must be escaped using a backslash character: '(single-quote). For example, instead of .*' use .*\'
SPS uses substring search to find the expression in the content. That is, SPS finds the expression even if there is more content before or after the matching part. For example, the conf pattern will match the following texts: conf, configure, reconfigure, arcconf, and so on.
Using complicated regular expressions or using many regular expressions will affect the performance of SPS.
If the multiple expressions are set, SPS processes them one after the other, and stops processing the content if the first match is found, even if other expressions would also match the content. Therefore, when using multiple expressions, start with the most specific one, and add general expressions afterward.

"selection": "window_title"

Add a content policy

To add a content policy, you have to:

1. Open a transaction.

   For more information, see Open a transaction.

2. Create the JSON object for the new content policy.

   POST the JSON object to the https://<IP-address-of-SPS>/api/configuration/policies/content_policies endpoint. You can find a detailed description of the available parameters listed in Element .

   If the POST request is successful, the response includes the key of the new policy. For example:

   {
     "key": "1e089e2a-76b4-4079-94e3-c83ebc74dc2e",
     "meta": {
       "href": "/api/configuration/policies/content_policies/1e089e2a-76b4-4079-94e3-c83ebc74dc2e",
       "parent": "/api/configuration/policies/content_policies",
       "transaction": "/api/transaction"
     }
   }

3. Commit your changes.

   For more information, see Commit a transaction.

Modify a content policy

To modify a content policy, you have to:

1. Open a transaction.

   For more information, see Open a transaction.

2. Modify the JSON object of the content policy.

   PUT the modified JSON object to the https://<IP-address-of-SPS>/api/configuration/policies/content_policies/<policy-key> endpoint. You can find a detailed description of the available parameters listed in Element .

3. Commit your changes.

   For more information, see Commit a transaction.

Status and error codes

The following table lists the typical status and error codes for this request. For a complete list of error codes, see Application level error codes.