Create a query by name: Request

To create a new query or to update an existing query, send the following request:

PUT https://<IA_IP_address>:<port_number>/savedquery/v1/querybody/<user_name>/<query_name>

Required header:

Cookie: px=<token>

Request body:

{
  "queryTemplate":"fieldname: [
    "item1", 
    "item2", 
    "item3", 
    ...
  ]"
}

{
  "queryTemplate":"fieldname: {{[termlist|querybody]::<user_name>::[<query_name>|<term_list_name>]}}"
}

Note
If expanded, the queryTemplate field must be a syntactically valid Elasticsearch query_string field.

Options

IA_IP_address—The IP address of the NDR appliance running the NDR API.
port_number—The port number of the NDR appliance running the NDR API.
user_name—The name of the user. The user_name must match the name of the logged-in user.
query_name—The name of the query.
term_list_name—The name of the term list. The name must contain alphanumeric characters; it can contain underscores.
token—This token authenticates the session. By default, the session times out after 24 hours.
fieldname—The name of any valid field.

Parameters

itemx—Each item is a string. The maximum number of items is 1000.

Example

PUT https://xxx.xxx.xxx.xxx:443/savedquery/v1/querybody/npadmin/savedqueryplain

Required header:

Cookie: px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Request body:

{
  "queryTemplate":"dnsQName: [google.com, facebook.com.]"
}

Create a query by name: Response

HTTP/1.1 [Response Code] [Response Message]				
Server: [Server]
Date: [Date]				
Content-Type: [Content Type]

Response fields

Response code—A standard HTTP response code.
- 200—Request successful; the query has been updated.
- 201—Request successful; the query was created.
- 4xx—Request unsuccessful.
Response message—A standard HTTP response message.
- OK—Request successful; the query has been updated.
- Created—Request successful; the query was created.
- Error message—Request unsuccessful.
Server—The server being used.
Date—Standard HTML date format.
Content type—The response format.

Example

HTTP/1.1 201 Created
Server: nginx
Date: Thu, 28 Apr 2016 20:23:55 GMT
Content-Type: text/plain; charset=utf-8

cURL code sample: Create a query by name

curl -k https://xxx.xxx.xxx.xxx:443/savedquery/v1/querybody/npadmin/myfirstquery -X PUT 
--data-binary '{"queryTemplate":"dnsQName: {{termlist::npadmin::badDomains}}"}' 
--cookie "px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" 
-H "Accept: application/json" -H "Content-Type: application/json"

This cURL sample includes the following options:

-k—This option explicitly allows cURL to perform insecure SSL connections and transfers, which allows you to test your SSL connection without installing a CA certificate.
https://xxx.xxx.xxx.xxx:443/savedquery/v1/querybody/npadmin/myfirstquery—The saved query request URL. Replace xxx.xxx.xxx.xxx with the IP address of your NDR appliance.Replace npadmin with your user name. Replace myfirstquery with the new query name.
-X PUT—This option specifies using the PUT method.
--data-binary '{"queryTemplate":"dnsQName: {{termlist::npadmin::badDomains}}"}'—This option specifies the new query, which includes a reference to a term list that was previously created. Replace dnsQName with the name of the field of interest.
--cookie "px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"—This option specifies the authentication token for this session.
-H "Accept: application/json"—This header specifies that the serverʼs response body is expected to be in JSON format.
-H "Content-Type: Application/json"—This header specifies that the request body is in JSON format.

Results

This example creates a new query with the specified name. If the query already exists, the query is updated.