To retrieve flow summary statistics from a specific NDR cluster for a defined time range, send the following request:
POST https://<IA_IP_address>:<port_number>/flowsummary/v2/<cluster_name>
Required header:
Cookie: px=<token>
Request body:
{
"from": "date-time",
"to": "date-time",
"bin": "bin size"
}Note
You must run this request in director mode.
The request body must be in JSON format.
Options
IA_IP_address—The IP address of the NDR appliance running the NDR API.
port_number—The port number of the NDR appliance running the NDR API.
cluster_name—The name of the NDR cluster.
token—This token authenticates the session. By default, the session times out after 24 hours.
Parameters
from—The UTC start time. The format isyyyy-MM-dd'T'HH:mm:ss.SSS'Z.to—The UTC end time. The format isyyyy-MM-dd'T'HH:mm:ss.SSS'Z.bin—The time range in minutes or hours. For example,1mfor 1 minute or5hfor 5 hours. The maximum number of bins is 1500.
Example
POST https://xxx.xxx.xxx.xxx:443/flowsummary/v2/ia-milp-74-179
Required header:
Cookie: px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Request body (must be in JSON):
{
"from": "2017-04-01T16:51:00.821Z",
"to": "2017-04-01T17:51:00.821Z",
"bin": "1h"
}Flow summary for a cluster using POST: Response
HTTP/1.1 [Response Code] [Response Message] Server: [Server] Date: [Date] Content-Type: [Content Type] clusterName: [Cluster Name] responseStatus: [Response Status] egressBytes: [Egress Bytes] egressPackets: [Egress Packets] ingressBytes: [Ingress Bytes] ingressPackets: [Ingress Packets] sessions: [Sessions]
Response fields
Response code—A standard HTTP response code.
Response message—A standard HTTP response message.
Server—The server being used.
Date—Standard HTML date format.
Content type—The response format.
Cluster name—The name of the IA cluster.
Response status—A standard HTTP response message.
Egress bytes—The number of bytes of a protocol that was sent from the source IP address.
Egress packets—The number of packets of a protocol that was sent from the source IP address.
Ingress bytes—The number of bytes of a protocol that was sent from the destination IP address.
Ingress packets—The number of packets of a protocol that was sent from the destination IP address.
Sessions—The number of sessions of a particular protocol.
Example
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 06 Apr 2017 18:08:37 GMT
Content-Type: application/json; charset=utf-8
[
{
"clusterName": "ia-milp-74-179",
"responseStatus": "OK",
"flowStats": {
"2017-04-01T16:00:00.000Z": {
"xxx.xxx.xxx.xxx": {
"flowCounters": {
"DNS": {
"egressBytes": 0,
"egressPackets": 0,
"ingressBytes": 0,
"ingressPackets": 0,
"sessions": 0
},
"FTP": {
"egressBytes": 0,
"egressPackets": 0,
"ingressBytes": 0,
"ingressPackets": 0,
"sessions": 0
},
"HTTP": {
"egressBytes": 0,
"egressPackets": 0,
"ingressBytes": 0,
"ingressPackets": 0,
"sessions": 0
},
"HTTPS": {
"egressBytes": 0,
"egressPackets": 0,
"ingressBytes": 0,
"ingressPackets": 0,
"sessions": 0
},
"ICMP": {
"egressBytes": 0,
"egressPackets": 0,
"ingressBytes": 0,
"ingressPackets": 0,
"sessions": 0
},
"IMAP": {
"egressBytes": 0,
"egressPackets": 0,
"ingressBytes": 0,
"ingressPackets": 0,
"sessions": 0
},
"OTHER": {
"egressBytes": 1971230,
"egressPackets": 37223,
"ingressBytes": 188492,
"ingressPackets": 3848,
"sessions": 837
},
"POP3": {
"egressBytes": 0,
"egressPackets": 0,
"ingressBytes": 0,
"ingressPackets": 0,
"sessions": 0
},
"SMTP": {
"egressBytes": 0,
"egressPackets": 0,
"ingressBytes": 0,
"ingressPackets": 0,
"sessions": 0
},
"SSH": {
"egressBytes": 0,
"egressPackets": 0,
"ingressBytes": 0,
"ingressPackets": 0,
"sessions": 0
},
"TLS": {
"egressBytes": 0,
"egressPackets": 0,
"ingressBytes": 0,
"ingressPackets": 0,
"sessions": 0
}
}
}
},
"2017-04-01T17:00:00.000Z": {
"xxx.xxx.xxx.xxx": {
"flowCounters": {
"DNS": {
"egressBytes": 2280,
[ . . . ]
}
}
}
}
}
]cURL code sample: Flow summary for a cluster using POST
curl -k https://xxx.xxx.xxx.xxx:443/flowsummary/v2/ia-milp-74-179 -X POST
--data-binary '{"from":"2017-04-01T16:51:00.821Z","to":"2017-04-01T17:51:00.821Z","bin":"1h"}'
--cookie "px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
-H "Accept: application/json" -H "Content-Type: application/json"This cURL sample includes the following options:
-k—This option explicitly allows cURL to perform insecure SSL connections and transfers, which allows you to test your SSL connection without installing a CA certificate.https://xxx.xxx.xxx.xxx:443/flowsummary/v2/ia-milp-74-179—The flow summary request URL. Replacexxx.xxx.xxx.xxxwith the IP address of your NDR appliance. Replaceia-milp-74-179with the name of the cluster of interest.-X POST—This option changes the HTTP method to POST.--data-binary '{"from":"2017-04-01T16:51:00.821Z","to":"2017-04-01T17:51:00.821Z","bin":"1h"}'—The beginning and end of the time range to collect statistics.--cookie "px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"—This option specifies the authentication token for this session.-H "Accept: application/json"—This header specifies that the serverʼs response body is expected to be in JSON format.-H "Content-Type: application/json"—This header specifies that the request body is in JSON format.
Results
This example returns flow statistics from the specified cluster for the given time range.