Flow summary using POST: Request

To retrieve flow summary statistics from NDR clusters connected to the director, send the following request:

POST https://<IA_IP_address>:<port_number>/flowsummary/v2

Required header:

Cookie: px=<token>

Request body:

{
    "from" : "date-time",
    "to" : "date-time", 
    "bin" : "bin size" 
}

Note
The request body must be in JSON format.

Options

IA_IP_address—The IP address of the NDR appliance running the NDR API.
port_number—The port number of the NDR appliance running the NDR API.
token—This token authenticates the session. By default, the session times out after 24 hours.

Parameters

from—The UTC start time. The format is yyyy-MM-dd'T'HH:mm:ss.SSS'Z.
to—The UTC end time. The format is yyyy-MM-dd'T'HH:mm:ss.SSS'Z.
bin—The time range in minutes or hours. For example, 1m for 1 minute or 5h for 5 hours. The maximum number of bins is 1500.

Example

POST https://xxx.xxx.xxx.xxx:443/flowsummary/v2

Required header:

Cookie: px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Request body (must be in JSON):

{
    "from":"2017-04-01T16:51:00.821Z",
    "to":"2017-04-01T17:51:00.821Z",
    "bin":"1h"
}

Flow summary using POST: Response

HTTP/1.1 [Response Code] [Response Message]				
Server: [Server]
Date: [Date]				
Content-Type: [Content Type]
clusterName: [Cluster Name]
responseStatus: [Response Status]
egressBytes: [Egress Bytes]
egressPackets: [Egress Packets] 
ingressBytes: [Ingress Bytes]
ingressPackets: [Ingress Packets]
sessions: [Sessions]

Response fields

Response code—A standard HTTP response code.
Response message—A standard HTTP response message.
Server—The server being used.
Date—Standard HTML date format.
Content type—The response format.
Cluster name—The name of the NDR cluster.
Response status—A standard HTTP response message.
Egress bytes—The number of bytes of a protocol that was sent from the source IP address.
Egress packets—The number of packets of a protocol that was sent from the source IP address.
Ingress bytes—The number of bytes of a protocol that was sent from the destination IP address.
Ingress packets—The number of packets of a protocol that was sent from the destination IP address.
Sessions—The number of sessions of a particular protocol.

Example

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 06 Apr 2017 17:36:14 GMT
Content-Type: application/json; charset=utf-8

[
   {
	"clusterName": "ia-milp-74-179",
	"responseStatus": "OK",
	"flowStats": {
	   "2017-04-01T16:00:00.000Z": {
		"xxx.xxx.xxx.xxx": {
		   "flowCounters": {
			"DNS": {
			   "egressBytes": 0,
			   "egressPackets": 0,
			   "ingressBytes": 0,
			   "ingressPackets": 0,
			   "sessions": 0
			},
			"FTP": {
			   "egressBytes": 0,
			   "egressPackets": 0,
			   "ingressBytes": 0,
			   "ingressPackets": 0,
			   "sessions": 0
			},
			"HTTP": {
			   "egressBytes": 0,
			   "egressPackets": 0,
			   "ingressBytes": 0,
			   "ingressPackets": 0,
			   "sessions": 0
			},
			"HTTPS": {
			   "egressBytes": 0,
			   "egressPackets": 0,
			   "ingressBytes": 0,
			   "ingressPackets": 0,
			   "sessions": 0
			},
			"ICMP": {
			   "egressBytes": 0,
			   "egressPackets": 0,
			   "ingressBytes": 0,
			   "ingressPackets": 0,
			   "sessions": 0
			},
			"IMAP": {
			   "egressBytes": 0,
			   "egressPackets": 0,
			   "ingressBytes": 0,
			   "ingressPackets": 0,
			   "sessions": 0
			},
			"OTHER": {
			   "egressBytes": 1971230,
			   "egressPackets": 37223,
			   "ingressBytes": 188492,
			   "ingressPackets": 3848,
			   "sessions": 837
			},
			"POP3": {
			   "egressBytes": 0,
			   "egressPackets": 0,
			   "ingressBytes": 0,
			   "ingressPackets": 0,
			   "sessions": 0
			},
			"SMTP": {
			   "egressBytes": 0,
			   "egressPackets": 0,
			   "ingressBytes": 0,
			   "ingressPackets": 0,
			   "sessions": 0
			},
			"SSH": {
			   "egressBytes": 0,
			   "egressPackets": 0,
			   "ingressBytes": 0,
			   "ingressPackets": 0,
			   "sessions": 0
			},
			"TLS": {
			   "egressBytes": 0,
			   "egressPackets": 0,
			   "ingressBytes": 0,
			   "ingressPackets": 0,
			   "sessions": 0
			}
		   }
		}
	   },
	   "2017-04-01T17:00:00.000Z": {
		"xxx.xxx.xxx.xxx": {
		   "flowCounters": {
			"DNS": {
			   "egressBytes": 2280,
			   "egressPackets": 20,
			   "ingressBytes": 0,
			   "ingressPackets": 0,
			   "sessions": 4
			},
			"FTP": {
			   "egressBytes": 0,
			   "egressPackets": 0,
			   "ingressBytes": 0,
			   "ingressPackets": 0,
			   "sessions": 0
			},
			"HTTP": {
			   "egressBytes": 0,
			   "egressPackets": 0,
			   "ingressBytes": 0,
			   "ingressPackets": 0,
			   "sessions": 0
			},
			"HTTPS": {
			   "egressBytes": 0,
			   "egressPackets": 0,
			   "ingressBytes": 0,
			   "ingressPackets": 0,
			   "sessions": 0
			},
			"ICMP": {
			   "egressBytes": 0,
			   "egressPackets": 0,
			   "ingressBytes": 0,
			   "ingressPackets": 0,
			   "sessions": 0
			},
			"IMAP": {
			   "egressBytes": 0,
			   "egressPackets": 0,
			   "ingressBytes": 0,
			   "ingressPackets": 0,
			   "sessions": 0
			},
			"OTHER": {
			   "egressBytes": 13210198,
			   "egressPackets": 247159,
			   "ingressBytes": 895490,
			   "ingressPackets": 17875,
			   "sessions": 5349
			},
			"POP3": {
			   "egressBytes": 0,
			   "egressPackets": 0,
			   "ingressBytes": 0,
			   "ingressPackets": 0,
			   "sessions": 0
			},
			"SMTP": {
			   "egressBytes": 0,
			   "egressPackets": 0,
			   "ingressBytes": 0,
			   "ingressPackets": 0,
			   "sessions": 0
			},
			"SSH": {
			   "egressBytes": 748,
			   "egressPackets": 4,
			   "ingressBytes": 0,
			   "ingressPackets": 0,
			   "sessions": 2
			},
			"TLS": {
			   "egressBytes": 0,
			   "egressPackets": 0,
			   "ingressBytes": 0,
			   "ingressPackets": 0,
			   "sessions": 0
			}
		   }
		}
	   },
	   "2017-04-01T18:00:00.000Z": {
        
	   }
	}
   },
   {
	"clusterName": "performance",
	"responseStatus": "ERROR",
	"flowStats": {
      
	}
   }
]

cURL code sample: Flow summary using POST

curl -k https://xxx.xxx.xxx.xxx:443/flowsummary/v2 -X POST 
--data-binary '{"from":"2017-04-01T16:51:00.821Z","to":"2017-04-01T17:51:00.821Z","bin":"1h"}' 
--cookie "px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" 
-H "Accept: application/json" -H "Content-Type: application/json"

This cURL sample includes the following options:

-k—This option explicitly allows cURL to perform insecure SSL connections and transfers, which allows you to test your SSL connection without installing a CA certificate.
https://xxx.xxx.xxx.xxx:443/flowsummary/v2—The flow summary request URL. Replace xxx.xxx.xxx.xxx with the IP address of your NDR appliance.
-X POST—This option changes the HTTP method to POST.
--data-binary '{"from":"2017-04-01T16:51:00.821Z","to":"2017-04-01T17:51:00.821Z","bin":"1h"}'—The beginning and end of the time range to collect statistics.
--cookie "px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"—This option specifies the authentication token for this session.
-H "Accept: application/json"—This header specifies that the serverʼs response body is expected to be in JSON format.
-H "Content-Type: Application/json"—This header specifies that the request body is in JSON format.

Results

This example returns flow summary statistics from the NDR clusters connected to the director for the specified time range.