All scheduled searches: Request

To list all scheduled searches, send the following request:

GET https://<IA_IP_address>:<port_number>/scheduledsearch/v1/watch

Required header:

Cookie: px=<token>

Note
To use this request, your user account must be assigned to the Admin role.

Options

IA_IP_address—The IP address of the NDR appliance running the NDR API.
port_number—The port number of the NDR appliance running the NDR API.
token—This token authenticates the session. By default, the session times out after 24 hours.

Example

GET https://xxx.xxx.xxx.xxx:443/scheduledsearch/v1/watch

Required header:

Cookie: px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

All scheduled searches: Response

HTTP/1.1 [Response Code] [Response Message]				
Server: [Server]
Date: [Date]				
Content-Type: [Content Type]

name: [Scheduled Search Name]
state: [Scheduled Search State]
interval: [Trigger Interval]
schedule: [Trigger Schedule]
hourly: [Hourly]
daily: [Daily]
weekly: [Weekly]
daysOfWeek: [Days of Week]
at: [Weekly At]
search_type: [Search Type]
indices: [Indices]
type: [Lookback Type]
period: [Lookback Period]
query: [Query]
hitCount: [Hit Count]
operator: [Condition Operator]
webhook: [Web Information]

Response fields

Response Code—A standard HTTP response code.
- 200—Request successful; the requested information is returned.
- 404—Request unsuccessful because the scheduled searches were not found.
Response Message—A standard HTTP response message.
- OK—Request successful; the requested information is returned.
- Not Found—Request unsuccessful because the scheduled searches were not found.
Server—The server being used.
Date—Standard HTML date format.
Content Type—The response format.
Scheduled Search Name—The name of the scheduled search.
Scheduled Search State—The state of the scheduled search. The state can be ACTIVE if the query runs at scheduled intervals or INACTIVE if no queries are run.
Trigger Interval—The interval between scheduled searches. Valid values are 1m–59m or 1h–23h. For example, a value of 5h means to run the query every 5 hours from now, and a value of 20m means to run the query every 20 minutes from now.
Trigger Schedule—When the query will run. Valid values are hourly, daily, or weekly.
Hourly—Valid values are 1–59; for example, 10 means to run the query every 10th minute of every hour.
Daily—The valid value is the time of day in hour:minute format. For example, 13:40 means to run the query every 14th hour at 40 minutes, and 01:01 means to run the query every second hours at 1 second.
Weekly—The query is run for the specified days of the week at the specified time.
Days of Week—Valid values are MONDAY, TUESDAY, WEDNESDAY, THURSDAY, FRIDAY, SATURDAY, and SUNDAY.
Weekly At—The time of day in hour:minute format.
Search Type—* indicates that everything is searched.
Indices—The index type that is searched.
Lookback Type—The start time of the period examined by the query. The start time is AUTO if the start time is the last invocation of the query or CUSTOM if the start time is provided with the period field.
Lookback Period—Valid values are 1h–23h or 1d–31d, indicating the number of hours or days before now to start searching. For example, {"type": "CUSTOM", "period": "4h"} indicates that the query examines the four hours before now.
Query—The Elasticsearch query to run or the name of a saved query to run.
Hit Count—The number of search results returned before the query results are saved.
Condition Operator—The operator to be evaluated with the hitCount value. Valid vales are EQUAL, NOTEQUAL, LESSTHAN, LESSTHANOREQUAL, and GREATERTHANOREQUAL.
Web Information—Information about the API request and its source.

Example

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 05 Apr 2017 17:30:04 GMT
Content-Type: application/json; charset=utf-8
{
  "threat_intel": [
    {
      "name": "IP_LONG_WATCH_0",
      "state": "INACTIVE",
      "trigger": {
        "schedule": {
          "daily": {
            "at": "11:21"
          }
        }
      },
      "input": {
        "search": {
          "request": {
            "search_type": "*",
            "indices": [
              "nspector"
            ],
            "lookback_period": {
              "type": "CUSTOM",
              "period": "16d"
            },
            "hitsizelimit": 1000,
            "body": {
              "query": {
                "ef_saved_query_id": "querybody::threat_intel::IP_LONG"
              }
            }
          }
        }
      },
      "condition": {
        "hitCount": 0,
        "operator": "GREATERTHANOREQUAL"
      },
      "otherActions": [
        {
          "webhook": {
            "name": "IP_LONG_WATCH_0",
            "method": "POST",
            "scheme": "http",
            "host": "xxx.xxx.xxx.xxx",
            "port": 9090,
            "path": "\/webhook\/IP_LONG_WATCH_0",
            "insecure": false
          }
        }
      ]
    },
    {
      "name": "MD5_LONG_WATCH_0",
      "state": "INACTIVE",
      "trigger": {
        "schedule": {
          "daily": {
            "at": "11:21"
          }
        }
      },
      "input": {
        "search": {
          "request": {
            "search_type": "*",
            "indices": [
              "nspector"
            ],
            "lookback_period": {
              "type": "CUSTOM",
              "period": "16d"
            },
            "hitsizelimit": 1000,
            "body": { 
              "query": {
                "ef_saved_query_id": "querybody::threat_intel::MD5_LONG"
              }
            }
          }
        }
      },
      "condition": {
        "hitCount": 0,
        "operator": "GREATERTHANOREQUAL"
      },
      "otherActions": [
        {
          "webhook": {
            "name": "MD5_LONG_WATCH_0",
            "method": "POST",
            "scheme": "http",
            "host": "xxx.xxx.xxx.xxx",
            "port": 9090,
            "path": "\/webhook\/MD5_LONG_WATCH_0",
            "insecure": false
          }
        }
      ]
    }
  ]
}

cURL code sample: All scheduled searches

curl -k --cookie "px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" https://xxx.xxx.xxx.xxx:443/scheduledsearch/v1/watch

This cURL sample includes the following options:

-k—This option explicitly allows cURL to perform insecure SSL connections and transfers, which allows you to test your SSL connection without installing a CA certificate.
--cookie "px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"—This option specifies the authentication token for this session.
https://xxx.xxx.xxx.xxx:443/scheduledsearch/v1/watch—The scheduled search request URL. Replace xxx.xxx.xxx.xxx with the IP address of your NDR appliance.

Results

This example returns a list of all scheduled searches.