To run an Elasticsearch query from your NDR appliance, send the following request:
GET https://<IA_IP_address>:<port_number>/elasticsearch/<Elasticsearch_query>
Required header:
Cookie: px=<token>
Important
Trellix recommends caution when running an Elasticsearch query. Running complex queries across a wide range of data is resource intensive and can affect the performance of your NDR appliance.
Options
IA_IP_address—The IP address of the NDR appliance running the NDR API.
port_number—The port number of the NDR appliance running the NDR API.
Elasticsearch_query—The NDR API 1.2.0 supports Elasticsearch 1.7.x. See Elasticsearch: The Definitive Guide. The Elasticsearch API only accepts HTTP GET and HEAD methods. To focus your query, you can include the indices to be searched.
token—This token authenticates the session. By default, the session times out after 24 hours.
Example
GET "https://xxx.xxx.xxx.xxx:443/elasticsearch/nspector-2016.08.01,alert-2016.08.02/_search?count=1"
Required header:
Cookie: px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Elasticsearch query: Response
The response varies depending on the Elasticsearch query run.
HTTP/1.1 [Response Code] [Response Message] Date: [Date] Content-Type: [Content Type]
Response fields
Response code—A standard HTTP response code.
Response message—A standard HTTP response message.
Date—Standard HTML date format.
Content type—The response format.
Example
HTTP/1.1 200 OK
Date: Fri, 29 Apr 2016 15:45:20 GMT
Content-Type: application/json; charset=utf-8
{
"took":76,
"timed_out":false,
"_shards":{
"total":4,
"successful":4,
"failed":0
},
"hits":{
"total":969628,
"max_score":1.0,
"hits":[
{
"_index":"nspector-iavmcluster-0nqgu417tdshgyzr-2016.08.21",
"_type":"pxflow",
"_id":"AVaqZo4Xxfahs9car0oa",
"_score":1.0,
"_source":{
"protocolIdentifierName":"TCP",
"destinationTransportPort":40301,
"flowEndNanoseconds":"2016-08-21T00:00:18.000524070Z",
"octetDeltaCountReverse":1716,
"droppedPacketDeltaCount":0,
"sourceIPv4Address":"xxx.xxx.xxx.xxx",
"ethernetProtocol":8,
"tcpControlBitsReverse":17,
"portId":0,
"ipClassOfService":0,
"packetDeltaCountReverse":33,
"appType":4,"egressInterface":0,
"octetDeltaCount":46927,
"droppedPacketDeltaCountReverse":0,
"sortedHashValue":1677688670,
"sourceTransportPort":80,
"applicationName":"Unknown",
"destinationIPv4Address":"xxx.xxx.xxx.xxx",
"fragmentFlagsReverse":0,
"exporterIPv4Address":"xxx.xxx.xxx.xxx",
...cURL code sample: Elasticsearch query
curl -k -H 'Cookie: px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' "https://xxx.xxx.xxx.xxx:443/elasticsearch/nspector-2016.08.01,alert-2016.08.02/_search?count=1"
This cURL sample includes the following options:
-k—This option explicitly allows cURL to perform insecure SSL connections and transfers, which allows you to test your SSL connection without installing a CA certificate.-H 'Cookie: px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'—This option specifies the authentication token for this session."https://xxx.xxx.xxx.xxx:443/elasticsearch/nspector-2016.08.01,alert-2016.08.02/_search?count=1"—The Elasticsearch request URL. Replacexxx.xxx.xxx.xxxwith the IP address of your NDR appliance.
Results
This example returns the data from the Elasticsearch query. The output is in JSON format.
cURL code sample: Aggregation
curl -k -H 'Cookie: px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
"https://xxx.xxx.xxx.xxx:443/elasticsearch/nspector-2016.08.01"
--data-binary '{"sort": [{"@timestamp": {"order": "desc"}}],"query":
{"filtered": {"query": {"match_all": {}},"filter": {"bool": {"must":
[{"range": {"@timestamp": {"gte": "2016-11-02T21:04:41.470+00:00","lte":
"2016-11-02T21:09:41.470+00:00"}}}]}}}},"from": 0,"size": 0,
"aggs": {"TopSourceIPs": {"terms": {"field": "sourceIPv4Address","size": "10","exclude": [0],
"order": {"_count": "desc"}},"aggs": {"byte_count": {"sum": {"field": "octetDeltaCount"}},
"packet_count": {"sum": {"field": "packetDeltaCount"}}}}}}'This cURL sample includes the following options:
-k—This option explicitly allows cURL to perform insecure SSL connections and transfers, which allows you to test your SSL connection without installing a CA certificate.-H 'Cookie: px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'—This option specifies the authentication token for this session."https://xxx.xxx.xxx.xxx:443/elasticsearch/nspector-2016.08.011"—The Elasticsearch request URL. Replacexxx.xxx.xxx.xxxwith the IP address of your NDR appliance.--data-binary '{"sort": [{"@timestamp": {"order": "desc"}}],"query": {"filtered": {"query": {"match_all": {}},"filter": {"bool": {"must": [{"range": {"@timestamp": {"gte": "2016-11-02T21:04:41.470+00:00","lte": "2016-11-02T21:09:41.470+00:00"}}}]}}}},"from": 0,"size": 0,"aggs": {"TopSourceIPs": {"terms": {"field": "sourceIPv4Address","size": "10","exclude": [0],"order": {"_count": "desc"}},"aggs": {"byte_count": {"sum": {"field": "octetDeltaCount"}},"packet_count": {"sum": {"field": "packetDeltaCount"}}}}}}'—Requests the top 10 IP addresses and their corresponding byte and packet size.
Results
This example returns the top 10 IP addresses and their corresponding byte and packet size.