Logon Tracker provides an API for programmatically retrieving data from the database. The API is a GraphQL interface that provides the ability to:
query for events
retrieve health and status
retrieve and update module configuration
add, update, and remove alerting rules
The GraphQL interface uses standard GraphQL schema. It is recommended to use a tool such as Postman or Insomnia to inspect the schema, create queries, and test the interfaces. The API is available at the following location.
https[:]//<HX_IP>:3000/hx/api/plugins/logontracker/graphql
The following example demonstrates a GraphQL query to retrieve logon events.
{
hostsByFields(
search_terms: {
},
search_options: {
limit: 10
}
) {
event_timestamp
source_acct
source_addr
source_host
target_acct
target_addr
target_host
category
description
event_id
logon_type
status
}
}