Add an event filter request

Creates one or more new event filters.

POST https://<cm_address>/wsapis/v2.0.0/config/network/eventfilter/add

Availability

This command is available on the following appliances:

Network Security

Required headers:

X-FeApi-Token: [API-Token]
X-FeClient-Token: [Client-Token]

Optional header:

Accept: application/json

Parameters

address—The IP address of the Trellix appliance running the Web Services API.
API-Token—This token authenticates the session. By default, the session times out after 15 minutes of inactivity.
Client-Token—(Optional) This client token is provided by Trellix. For more information about the client token, contact your sales representative.
Content-Type—(Optional) Specify this option to receive events in JSON format.

Request body:

Pass the following parameters as the options field in the request submission:

[
  {
    "filter_name" : "<filter-name1>",
    "field_name" : "<field-1>",
    "field_value" : <value1>,
    "operation_type": "<operation-type1>"
  },
  {
    "filter_name" : "<filter-name2>",
    "field_name" : "<field-2>",
    "field_value" : <value2>,
    "operation_type": "<operation-type2>"
  }
]

Default values for filter-name:

all
dcerpc    
dnp3      
dns       
fileinfo  
flow      
ftp       
http      
imap      
irc       
krb5      
modbus    
mysql     
pop3      
radius    
rdp       
rtsp      
smb       
smb2      
smtp      
socks     
ssh       
tls

Default values for operation_type:

begins_with          
ends_with           
contains            
equals              
regex              
cidr

Example request

Note

In this example, the searchʼs duration filter is set to 12_hours (default), and the end_time filter is set to the current time (default).

POST https://xxx.xxx.xxx.xxx/wsapis/v2.0.0/config/network/eventfilter/add

Request headers:

X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
X-FeClient-Token: BigDataInc

Add an event filter response

After the event request is received, your appliance validates the API-Token and returns the requested data.

HTTP/1.1 [Response Code] [Response Message]
Date: [Date]
Content-Type: application/json
X-FeApi-Token: [API-Token]
X-FeClient-Token: [Client-Token]

Response fields

Response Code—A standard HTML response code.
- 200—Request successful.
- 404—Request unsuccessful because the filter value was invalid.
- 500—Request unsuccessful because the server encountered a problem.
Response Message—A standard HTML response message.
- OK—Request successful.
- Bad Request—Request unsuccessful because the filter value was invalid.
- Internal Server Error—Request unsuccessful because the server encountered a problem.
Date—Standard HTML date format.

Example response

HTTP/1.1 200 OK
Date: Fri, 23 Sep 2018 08:00:00 GMT

{
  "http http.url regex google.com" : "Filter already configured",
  "http http.url regex fireeye.com":"Operation was successful.\n"
}

cURL code sample: add an event filter

The following code sample can be copied and executed from any command-line interface that includes the cURL library. This sample builds on the authentication cURL code sample.

curl -X POST -qgsSk --header 'X-FeApi-Token: XXXXXXXXXXXXXX' -F 'options=[{"filter_name":"my_new_filter","field_name":"http:url", "field_value" : "example.com", "operation_type": "regex"}]' https://xxx.xxx.xxx.xxx/wsapis/v2.0.0/config/network/eventfilter/add

This cURL sample includes the following options:

-q—This option specifies that the curlrc configuration file will not be read or used. Although this is an optional setting, Trellix recommends that you include this option.
-g—This option turns off the URL globbing parser. Although this is an optional setting, Trellix recommends that you include this option.
-s—This option turns off the progress meter and error message. Although this is an optional setting, Trellix recommends that you include this option.
-S—When used with the -s option, this option shows error messages if your cURL switch fails. Although this is an optional setting, Trellix recommends that you include this option.
-k—This option explicitly allows cURL to perform insecure SSL connections and transfers. This allows you to test your SSL connection without installing a CA certificate.
-H—This option allows you to specify a custom header with the --header switch.
https://xxx.xxx.xxx.xxx/wsapis/v2.0.0/config/network/eventfilter/add—The event filter request URL. Replace the IP address xxx.xxx.xxx.xxx with the IP address of your appliance.
-X 'POST'—This option specifies using the POST method.
--header "X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"—This custom header includes the API-Token that was returned by your appliance during the authentication request. In the authentication cURL code sample, this token was included in the auth.txt file. Replace the token in the sample with the token received in the response to your authentication request.
--header "Accept: application/json"—This header specifies that the serverʼs response body is expected to be in JSON format.

-F 'options=[{"filter_name":"my_new_filter","field_name":"http:url", "field_value" : "example.com", "operation_type": "regex"}]'—This set of options defines the parameters for the new event filters. For more information, see Add an event filter request.

Results

This code sample creates a new event filter called my_new_filter.