Flow summary for a cluster using GET: Request

To retrieve flow summary statistics from a specific NDR cluster for a defined time range, send the following request:

GET https://<IA_IP_address>:<port_number>/flowsummary/v2/<cluster_name>

Required header:

Cookie: px=<token>

Request body:

{
   "from" : "date-time",
   "to" : "date-time", 
   "bin" : "bin size" 
}

Note
You must run this request in director mode.

Options

IA_IP_address—The IP address of the NDR appliance running the NDR API.
port_number—The port number of the NDR appliance running the NDR API.
cluster_name—The name of the NDR cluster.
token—This token authenticates the session. By default, the session times out after 24 hours.

Query parameters

from—The UTC start time. The format is yyyy-MM-dd'T'HH:mm:ss.SSS'Z.
to—The UTC end time. The format is yyyy-MM-dd'T'HH:mm:ss.SSS'Z.
bin—The time range in minutes or hours. For example, 1m for 1 minute or 5h for 5 hours. The maximum number of bins is 1500.

Example

GET https://xxx.xxx.xxx.xxx:443/flowsummary/v2/ia-milp-74-179

Required header:

Cookie: px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Request body:

{
  "from":"2017-04-01T16:51:00.821Z",
  "to":"2017-04-01T17:51:00.821Z",
  "bin":"1h"
}

Flow summary for a cluster using GET: Response

HTTP/1.1 [Response Code] [Response Message]				
Server: [Server]
Date: [Date]				
Content-Type: [Content Type]
clusterName: [Cluster Name]
responseStatus: [Response Status]
egressBytes: [Egress Bytes]
egressPackets: [Egress Packets] 
ingressBytes: [Ingress Bytes]
ingressPackets: [Ingress Packets]
sessions: [Sessions]

Response fields

Response code—A standard HTTP response code.
Response message—A standard HTTP response message.
Server—The server being used.
Date—Standard HTML date format.
Content type—The response format.
Cluster name—The name of the IA cluster.
Response status—A standard HTTP response message.
Egress bytes—The number of bytes of a protocol that was sent from the source IP address.
Egress packets—The number of packets of a protocol that was sent from the source IP address.
Ingress bytes—The number of bytes of a protocol that was sent from the destination IP address.
Ingress packets—The number of packets of a protocol that was sent from the destination IP address.
Sessions—The number of sessions of a particular protocol.

Example

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 06 Apr 2017 18:08:37 GMT
Content-Type: application/json; charset=utf-8
[
  {
    "clusterName": "ia-milp-74-179",
    "responseStatus": "OK",
    "flowStats": {
      "2017-04-01T16:00:00.000Z": {
        "xxx.xxx.xxx.xxx": {
          "flowCounters": {
            "DNS": {
              "egressBytes": 0,
              "egressPackets": 0,
              "ingressBytes": 0,
              "ingressPackets": 0,
              "sessions": 0
            },
            "FTP": {
              "egressBytes": 0,
              "egressPackets": 0,
              "ingressBytes": 0,
              "ingressPackets": 0,
              "sessions": 0
            },
            "HTTP": {
              "egressBytes": 0,
              "egressPackets": 0,
              "ingressBytes": 0,
              "ingressPackets": 0,
              "sessions": 0
            },
            "HTTPS": {
              "egressBytes": 0,
              "egressPackets": 0,
              "ingressBytes": 0,
              "ingressPackets": 0,
              "sessions": 0
            },
            "ICMP": {
              "egressBytes": 0,
              "egressPackets": 0,
              "ingressBytes": 0,
              "ingressPackets": 0,
              "sessions": 0
	     },
            "IMAP": {
              "egressBytes": 0,
              "egressPackets": 0,
              "ingressBytes": 0,
              "ingressPackets": 0,
              "sessions": 0
            },
            "OTHER": {
              "egressBytes": 1971230,
              "egressPackets": 37223,
              "ingressBytes": 188492,
              "ingressPackets": 3848,
              "sessions": 837
            },
            "POP3": {
              "egressBytes": 0,
              "egressPackets": 0,
              "ingressBytes": 0,
              "ingressPackets": 0,
              "sessions": 0
            },
            "SMTP": {
              "egressBytes": 0,
              "egressPackets": 0,
              "ingressBytes": 0,
              "ingressPackets": 0,
              "sessions": 0
            },
            "SSH": {
              "egressBytes": 0,
              "egressPackets": 0,
              "ingressBytes": 0,
              "ingressPackets": 0,
              "sessions": 0
            },
            "TLS": {
              "egressBytes": 0,
              "egressPackets": 0,
              "ingressBytes": 0,
              "ingressPackets": 0,
              "sessions": 0
            }
          }
        }
      },
      "2017-04-01T17:00:00.000Z": {
        "xxx.xxx.xxx.xxx": {
          "flowCounters": {
            "DNS": {
              "egressBytes": 2280,
 
		[ . . . ]	  

        }
      }
    }
  }
]

cURL code sample: Flow summary for a cluster using GET

curl -k -H "Content-Type: application/json" 
--cookie "px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" 
https://xxx.xxx.xxx.xxx:443/flowsummary/v2/ia-milp-74-179 
-d '{"from":"2017-04-01T16:51:00.821Z","to":"2017-04-01T17:51:00.821Z","bin":"1h"}'

This cURL sample includes the following options:

-k—This option explicitly allows cURL to perform insecure SSL connections and transfers, which allows you to test your SSL connection without installing a CA certificate.
-H "Content-Type: application/json"—This header specifies that the request body is in JSON format.
--cookie "px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"—This option specifies the authentication token for this session.
https://xxx.xxx.xxx.xxx:443/flowsummary/v2/ia-milp-74-179—The flow summary request URL. Replace xxx.xxx.xxx.xxx with the IP address of your NDR appliance. Replace ia-milp-74-179 with the name of the cluster of interest.
-d '{"from":"2017-04-01T16:51:00.821Z","to":"2017-04-01T17:51:00.821Z","bin":"1h"}'—The beginning and end of the time range to collect statistics.

Results

This example returns flow statistics from the specified cluster for the given time range.