One Identity Safeguard for Privileged Sessions 6.0 LTS - REST API Reference Guide

Contains a link to the details of the alerts. For details, see Session alerts.

An event is listed as alert only if the Actions > Store in Connection Database option is selected in the Content Policy used to handle the session.

"alerts": {
    "href": "/api/audit/sessions/7930f4308efe8aecd710202d815b76ff/alerts"
},

Contains a link to the details of the channel.

"channels": {
    "href": "/api/audit/sessions/svc-rUhhQZ3jYsY1NDWYp9DEpq-kecske-29/channels"
},

The timestamp of the end of the connection. For ongoing connection, the value is null.

Starting with SPS 5 LTS, the timestamp is in ISO 8601 format, for example, 2018-10-11T09:23:38.000+02:00. In earlier versions, it was in UNIX timestamp format.

Contains a link to the details of the events. For details, see Session events.

"events": {
    "href": "/api/audit/sessions/7930f4308efe8aecd710202d815b76ff/events"
},

Contains the details of indexing. For details on configuring indexing, see Local services: configuring the indexer.

"indexer": {
    "href": "/api/audit/sessions/rUhhQZ3jYsY1NDWYp9DEpq/indexer"
},

How SPA received this session. The following values are possible:

• PSM for sessions based on an audit trail recorded by SPS.

• LOG for sessions built from log data.

Authentication method: The authentication method used in the connection. For example, password

Channel's indexing status: Shows if the channel has been indexed. The following values are possible:

• CHANNEL_OPEN (0): The connection of the channel is still open (indexer is waiting for the connection to close).

• NOT_INDEXED (1): All channels of the connection have been closed which belong to the connection. The channel is ready for indexing, unless the audit trail was placed in the skipped_connections queue.

• INDEXING_IN_PROGRESS (2): The channel is being indexed (indexing in progress). Note that SPS will return search results for the parts of the channel are already indexed.

• INDEXED (3): Indexing the channel is complete.

• INDEXING_NOT_REQUIRED (4): Indexing not required (indexing is not enabled for the connection).

• INDEXING_FAILED (5): Indexing failed. The indexer service writes the corresponding error message in the error_message column of the indexer_jobs table. Note that SPS will return search results for the parts of the channel that were successfully indexed before the error occurred. For example, if the error occurred at the end of a long audit trail, you can still search for content from the first part of the audit trail.

• NO_TRAIL (6): Auditing is not enabled for the channel.

The connection verdict. Possible values are:

• accept

  The connection attempt was successful.

• accept-terminated

  The connection violated a content policy, and was terminated by SPS.

• auth-fail

  Authentication failure.

• deny

  The connection was denied.

• fail

  The connection attempt failed.

• gw-auth-fail

  Gateway authentication failure.

• key-error

  The connection attempt failed due to a hostkey mismatch.

• user-mapping-fail

  The connection attempt failed due to a user mapping failure.

Contains a link to the details of the audit-trail downloads in this session (if any).

"trail_downloads": {
    "href": "/api/audit/sessions/rUhhQZ3jYsY1NDWYp9DEpq/trail_downloads"
},

The timestamp of the start of the connection.

Starting with SPS 5 LTS, the timestamp is in ISO 8601 format, for example, 2018-10-11T09:23:38.000+02:00. In earlier versions, it was in UNIX timestamp format.

Contains analytics details of the connection. For example:

"analytics": {
    "interesting_events": [],
    "scripted": false,
    "scripted_results": {},
    "similar_sessions": [],
    "tags": []
},

The risk score that SPA assigned to the session. Values range from 0 to 100, with 100 representing the highest risk.

A key-value pair, where key=<algorithm-name>, value=<reason-of-the-decision>. The algorithm can be clockmaster or gapminder.

Result: True/False. Reason: Either the reason behind the result, or if no result is avalialble, an error message (for example, the baseline has not been built yet).

Indicates whether the audit trail has been archived or not. If the audit trail has not been archived yet, the value of the element is null. For example:

"audit_trail": {
    "archive": {
        "date": "2018-11-25T12:00:05.000Z",
        "path": "2018-11-23/",
        "policy": "8106930065bf7eb4c3cf59",
        "server": "\\\\10.20.30.40\\archive\\abc123 (user: myuser)"
    },
    "download": {
        "href": "/api/audit/sessions/10/audit_trail"
    }
},

The type of the channel. Additional elements might be used with certain ICA, SSH and RDP channel types.

The channel's connection verdict. Possible values are:

• accept

  The connection attempt was successful.

• deny

  The connection attempt was denied.

• four-eyes-deferred

  Four-eyes authorization is unable to progress as it is waiting for a remote username.

• four-eyes-error

  An internal error occurred during four-eyes authorization.

• four-eyes-reject

  The connection attempt was rejected by a four-eyes agent on SPS.

• four-eyes-timeout

  Four-eyes authorization timed out.

Used with the session exec SSH channel type.

The executed command.

Used with the session exec scp SSH channel type.

The folder used for Secure Copy.

Used with the session subsystem sftp SSH channel type.

The name of the used subsystem.

Used with the local forward and remote forward SSH channel types.

The source address of the forwarded traffic.

Used with the local forward and remote forward SSH channel types.

The source port of the forwarded traffic.

Used with the local forward and remote forward SSH channel types.

The target address of the forwarded traffic.

Used with the local forward and remote forward SSH channel types.

The target port of the forwarded traffic.

Used with the dynamic virtual RDP channel type.

The name of the dynamic channel.

Used with the serial redirect, parallel redirect, printer redirect, disk redirect, and scard redirect RDP channel types.

The name of the device.

Used with ICA connections.

The name of the application accessed in a seamless Citrix ICA connection.

The username of the user who authorized the session.

Available only if four-eyes authorization is required for the channel.

The IP address and port number of the client. For example:

"client": {
    "ip": "10.20.30.40",
    "port": 59125
},

The IP address and port number of the remote server. For example:

"server": {
    "ip": "10.20.30.40",
    "port": 55386
},

The IP address and port number of SPS. For example:

"server_local": {
    "ip": "10.20.30.40",
    "port": 55386
},

The IP address and port number the client targeted for connection. For example:

"target": {
    "ip": "10.20.30.40",
    "port": 221
},