Chat now with support
Chat with Support

One Identity Safeguard for Privileged Sessions 6.0.5 - REST API Reference Guide

Introduction Using the SPS REST API Basic settings User management and access control Managing SPS General connection settings HTTP connections Citrix ICA connections RDP connections SSH connections Telnet connections VNC connections Search, download, and index sessions Reporting Health and maintenance Advanced authentication and authorization Completing the Welcome Wizard using REST Enable and configure analytics using REST

Session statistics

The api/audit/sessions/stats endpoint provides statistics about recorded sessions (active and closed).

URL
GET https://<IP-address-of-SPS>/api/audit/sessions/stats?field=<field-name>
Cookies
Cookie name Description Required Values
session_id Contains the authentication token of the user Required

The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API.

Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format).

Sample request

The following command retrieves statistical data about sessions.

curl --cookie cookies https://<IP-address-of-SPS>/api/audit/sessions/stats?field=<field-name>
Request parameters

Use the following parameters to fine-tune your request for statistics:

  • ?q: Narrow down the scope of statistics using one or more properties (elements) of the sessions.

  • ?field: Request statistics for the selected properties (elements and values) of sessions (for example, protocol).

    Using this parameter is mandatory.

  • ?sub_fields: Request sub statistics for the selected properties (elements and values) of sessions (for example, protocol).

    This parameter only accepts a single parameter. If more than one parameter is listed, only the first will be considered.

  • ?size: Limit the range of values displayed in the statistics for a given field. Statistics will be shown only for the top size number of most frequently occurring values (that is, values with the highest number of counts).

    Take the following example. If you query "/api/audit/sessions/stats?field=protocol&size=2", and the following sessions were recorded:

    ...
    {
      "Alpha": {
        "protocol": "http"
      },
      "Bravo": {
        "protocol": "ssh"
      },
      "Charlie": {
        "protocol": "rdp"
      },
      "Delta": {
        "protocol": "rdp"
      },
      "Echo": {
        "protocol": "rdp"
      },
      "Foxtrot": {
        "protocol": "http"
      },
      "Golf": {
        "protocol": "http"
      }
    }
    ...

    The response contains:

    ...
    {
     "meta": {
        "href": "/api/audit/sessions/stats",
        "parent": "/api/audit/sessions",
        "others": 1,
        "field": "protocol",
        "size": 2
     }
    }
    ...

    And the response items look like the snippet below. That is, in this example, there will be no statistics for "protocol": "ssh". The top 2 values are "rdp" and "http", with a count of 3 each. "ssh" occurred only once, so it did not make it to the top 2 most frequent values.

    ...
    [
     {"count": 3, "value": "http"},
     {"count": 3, "value": "rdp"}
    ...
  • ?start: Statistics are returned for sessions that started after the specified date. Use the ISO 8601 format for the date, for example, 2017-01-25T10:00.

  • ?end: Statistics are returned for sessions that ended before the specified date. Use the ISO 8601 format for the date, for example, 2017-01-25T11:00.

  • ?content: Statistics are returned for indexed sessions that contain the type of content specified.

    NOTE:

    When performing a content query, the maximum number of results returned is 3000. When this limit is exceeded, the scope of statistics is limited to the first 3000 sessions (even if there are more than 3000 sessions that match your criteria).

Response

The following snippet is a sample response received when retrieving statistics about the protocol field.

For details of the meta object, see Message format.

Those fields of the meta object that are specific to statistics are collected in table Element .

{
    "items": [
        {
            "count": 7,
            "value": "ssh"
        }
    ],
    "meta": {
        "field": "protocol",
        "href": "/api/audit/sessions/stats",
        "others": 0,
        "parent": "/api/audit/sessions",
        "remaining_seconds": 600,
        "size": 10
    }
}
Element Type Description
body, or items when a list is returned Top-level element (string) Contains the properties that are in the scope of the requested statistics.
count integer Indicates the number of sessions included in the scope of statistics.
value string Contains the value of the field that you requested statistics about.
meta Top-level element Contains links to different parts of the REST service.
field string Contains the name of the field that you requested statistics about.
sub_fields string Contains the name of the sub field that you requested statistics about.
others integer

Some values of the field that you specified in your query are not included in the scope of statitics. This happens when a specific value occurs fewer times in the examined sessions than the aggregation size.

The others field indicates the number of those distinct values that are not included in the statistics.

For a detailed explanation with an example, see ?size.

size integer The size that you specified in your query.
Example 1:

If you query "/api/audit/sessions/stats?field=protocol", and the following sessions were recorded:

...
{
  "Alpha": {
    "protocol": "ssh"
  },
  "Bravo": {
    "protocol": "ssh"
  },
  "Charlie": {
    "protocol": "rdp"
  },
  "Delta": {
    "protocol": "rdp"
  },
  "Echo": {
    "protocol": "rdp"
  },
  "Foxtrot": {
    "protocol": "ssh"
  },
  "Golf": {
    "protocol": "ssh"
  }
}
...

The response contains:

...
{
  "meta": {
    "href": "/api/audit/sessions/stats",
    "parent": "/api/audit/sessions",
    "others": 0,
    "field": "protocol"
  }
}
...

The response items contain:

...
[
 {"count": 4, "value": "ssh"},
 {"count": 3, "value": "rdp"}  
...
Example 2:

If you query "/api/audit/sessions/stats?field=protocol&content=login&start=2017-01-02&end=2017-01-03&q=psm.content_reference_id%3A%5B3%20TO%206%5D", and the following sessions were recorded:

{
  "Alpha": {
    "protocol": "ssh",
    "start_time": "2017-01-01",
    "end_time": "2017-01-02",
    "recording": {
      "content_reference_id": 1
    }
  },
  "Bravo": {
    "protocol": "ssh",
    "start_time": "2017-01-01",
    "end_time": "2017-01-02",
    "recording": {
      "content_reference_id": 2
    }
  },
  "Charlie": {
    "protocol": "rdp",
    "start_time": "2017-01-01",
    "end_time": "2017-01-02",
    "recording": {
      "content_reference_id": 3
    }
  },
  "Delta": {
    "protocol": "rdp",
    "start_time": "2017-01-03",
    "end_time": "2017-01-04",
    "psm": {
      "content_reference_id": 4
    }
  },
  "Echo": {
    "protocol": "rdp",
    "start_time": "2017-01-03",
    "end_time": "2017-01-04",
    "recording": {
      "content_reference_id": 5
    }
  },
  "Foxtrot": {
    "protocol": "ssh",
    "start_time": "2017-01-04",
    "end_time": "2017-01-06",
    "recording": {
      "content_reference_id": 6
    }
  },
  "Golf": {
    "protocol": "ssh",
    "start_time": "2017-01-02",
    "end_time": "2017-01-10",
    "recording": {
      "content_reference_id": 7
    }
  }
}

And the following sessions match when running the content query:

| trail_id | rank  | hits_count |
|    1     | 1.555 | 1          |
|    2     | 1.555 | 1          |
|    3     | 1.555 | 1          |
|    4     | 1.555 | 1          |
|    6     | 1.555 | 1          |

The response contains:

...
{
  "meta": {
    "href": "/api/audit/sessions/stats",
    "parent": "/api/audit/sessions",
    "others": 0,
    "field": "protocol"
  }
}
...

The response items contain:

...
[
 {"count": 2, "value": "rdp"} 
...
Example 3:

If you query "/api/audit/sessions/stats?field=user.gateway_username&?sub_fields=protocol&?size=1", and the following sessions were recorded:

...
{
  "Alpha": {
    "protocol": "ssh",
    "user": {
      "gateway_username": "user-Alpha"
    }
  },
  "Bravo": {
    "protocol": "ssh",
    "user": {
      "gateway_username": "user-Bravo"
    }
  },
  "Charlie": {
    "protocol": "rdp",
    "user": {
      "gateway_username": "user-Charlie"
    }
  },
  "Delta": {
    "protocol": "rdp",
    "user": {
      "gateway_username": "user-Alpha"
    }
  },
  "Echo": {
    "protocol": "rdp",
    "user": {
      "gateway_username": "user-Alpha"
    }
  },
  "Foxtrot": {
    "protocol": "ssh",
    "user": {
      "gateway_username": "user-Alpha"
    }
  },
  "Golf": {
    "protocol": "ssh",
    "user": {
      "gateway_username": "user-Alpha"
    }
  },
  "Hotel": {
    "protocol": "ssh",
    "user": {
      "gateway_username": "user-Delta"
    }
  }
}
...

The response contains:

...
{
  "meta": {
    "href": "/api/audit/sessions/stats",
    "parent": "/api/audit/sessions",
    "others": 3
  }
}
...

The response items contain:

...
[
  {
    "buckets": [
      {
        "count": 3,
        "value": "ssh"
      }
    ],
    "count": 5,
    "others": 2,
    "value": "user-Alpha"
  }
]  
...
Status and error codes

The following table lists the typical status and error codes for this request. For a complete list of error codes, see Application level error codes.

Code Description Notes
200 OK The query was well-formed and statistics have been successfully retrieved.
400 InvalidQueryValue The query is invalid, for example, it has an invalid value.
500 SearchUnavailable The search backend is inaccessible.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating