Chat now with support
Chat with Support

One Identity Safeguard for Privileged Sessions 5.9.0 - REST API Reference Guide

Introduction Using the SPS REST API Basic settings User management and access control Managing SPS General connection settings HTTP connections Citrix ICA connections RDP connections SSH connections Telnet connections VNC connections Search, download, and index sessions Reporting Advanced authentication and authorization Completing the Welcome Wizard using REST Enable and configure analytics using REST About us Third-party contributions

Session events

The api/audit/sessions/<session-id>/events endpoint lists the events extracted from a session (if any). Events are available only if the session is indexed. For details on configuring indexing, see Local services: configuring the indexer.

URL
GET https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/events
Headers
Header name Description Required Values
session_id Contains the authentication token of the user Required

The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API.

Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format).

Sample request

The following command lists the events of a session.

curl --cookie cookies "https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/events"
Response

The following is a sample response received when listing the events of a session. For details of the meta object, see Introduction.

{
    "items": [
        {
            "psm.channels.id": "0",
            "psm.events.content": "myuser@examplehost:~$ ls",
            "psm.events.record_id": 46,
            "psm.events.time": "2017-04-11T09:21:10.832",
            "psm.events.type": "adp.event.command"
        },
        {
            "psm.channels.id": "0",
            "psm.events.content": "myuser@examplehost:~$ cd /var",
            "psm.events.record_id": 64,
            "psm.events.time": "2017-04-11T09:21:15.488",
            "psm.events.type": "adp.event.command"
        },
        {
            "psm.channels.id": "0",
            "psm.events.content": "myuser@examplehost:/var$ ls",
            "psm.events.record_id": 78,
            "psm.events.time": "2017-04-11T09:21:18.017",
            "psm.events.type": "adp.event.command"
        },
        {
            "psm.channels.id": "0",
            "psm.events.content": "myuser@examplehost:/var$ ls -la",
            "psm.events.record_id": 95,
            "psm.events.time": "2017-04-11T09:21:21.04",
            "psm.events.type": "adp.event.command"
        },
        {
            "psm.channels.id": "0",
            "psm.events.content": "myuser@examplehost:/var$ ls -la",
            "psm.events.record_id": 113,
            "psm.events.time": "2017-04-11T09:21:23.353",
            "psm.events.type": "adp.event.command"
        },
        {
            "psm.channels.id": "0",
            "psm.events.content": "myuser@examplehost:/var$ man sudo",
            "psm.events.record_id": 148,
            "psm.events.time": "2017-04-11T09:21:27.017",
            "psm.events.type": "adp.event.command"
        }
    ],
    "meta": {
        "first": "/api/audit/sessions/7930f4308efe8aecd710202d815b76ff/events?limit=500&offset=0",
        "href": "/api/audit/sessions/7930f4308efe8aecd710202d815b76ff/events",
        "last": "/api/audit/sessions/7930f4308efe8aecd710202d815b76ff/events?limit=500&offset=0",
        "limit": 500,
        "next": null,
        "offset": 0,
        "parent": "/api/audit/sessions/7930f4308efe8aecd710202d815b76ff",
        "previous": null
    }
}
Element Type Description
items list Top level element, a list containing the alerts of the session.
psm.channels.id integer A reference to the ID of the channel in the session where the event occurred.
psm.events.content text The event that occurred in the session. Note that this value contains the context of the event as well. For example, for command events in terminal sessions, the value contains the entire command line, including the command prompt. For example, myuser@examplehost:~$ man sudo
psm.events.record_id integer The ID number of the event within the session.
psm.events.type string

The type of the event. Possible values:

  • adp.event.command: A command entered in SSH or Telnet.

  • adp.event.screen.content: Screen content.

  • adp.event.screen.creditcard: Credit card numbers detected. Displayed only as an alert, not visible in the events.

  • adp.event.screen.windowtitle: The title of the window in graphic protocols.

psm.events.time string The timestamp when the event occurred, for example, 2017-04-25T13:26:39.144356.
Changing the display limit

You can use the ?limit option to change the number of items displayed at once. The default limit is 500.

?limit=1000

To navigate beyond the displayed set, use the offset option.

Navigating large datasets

You can use the ?offset option to navigate data sets that extend beyond the display limit. The default value of the offset is 0, this is the initially displayed set. To move to other items beyond the initial set, increase the value to a number that corresponds to the item where you want to start displaying results from.

Example: the display limit is the default 500, and the number of sessions is 1012. The initial 500 sessions are listed at:

?offset=0

To view sessions from 501 to 1000, change the offset to 501:

?offset=501

To display the remaining 12 sessions, change the offset to 1001:

?offset=1001
Filtering

You can filter events at the /api/audit/sessions/<session-id>/events endpoint. Use the ?q option to filter the list using one or more properties (elements) of the sessions.

?q=psm.events.content:sudo

You can escape special characters using the backslash character.

?q=psm.events.content:\"Copying Files\"

To add multiple elements to the filter, you can use the AND, AND NOT, and OR operators.

psm.events.content:ls AND psm.events.content:cp AND NOT psm.events.content:mv

You can create groups using () (parentheses).

?q=(psm.events.content:rm OR psm.events.content:mv) AND psm.channels.id:5

You can also use () (parentheses) to add multiple possible values for a property.

?q=psm.events.content:(sudo rm)

You can use the * (asterisk) and ? (question mark) wildcards for string-type values.

?q=psm.events.content:?dmi*

You can define ranges using [] (brackets) or {} (braces) and the TO operator. This only works for numeric (int) values.

  • [ means equal or higher than the following value

  • ] means equal or lower than the preceding value

  • { means higher than the following value

  • }means lower than the preceding value

For example, the following range resolves to 2:

?q=psm.channels.id:{1 TO 3}

You can also use the * (asterisk) wildcard in the range.

?q=psm.channels.id:[* TO 5]

Note that not all connection data can be used for filtering. The available elements are:

  • psm.channels.id

    Integer, the channel in the session where the event occurred.

  • psm.events.content

    Text, the event that occurred in the session.

  • psm.events.record_id

    Integer, the identifier of the event in the session.

  • psm.events.time

    String, the timestamp when the event occurred.

  • psm.events.type

    String, the type of the event:

    • adp.event.command: A command entered in SSH or Telnet.

    • adp.event.screen.content: Screen content.

    • adp.event.screen.creditcard: Credit card numbers detected. Displayed only as an alert, not visible in the events.

    • adp.event.screen.windowtitle: The title of the window in graphic protocols.

Related Documents