Layer-7 metadata using GET: Request

To retrieve the Layer-7 metadata across your network for a specified interval, send the following request:

GET https://<IA_IP_address>/config/v1/l7metadata

Required header:

--user <username>:<password>

Request body:

 {
    "startTime":"HH:MM", 
    "endTime":"HH:MM",
    "endDate":"YYYY.MM.DD",
    "startDate":"YYYY.MM.DD",
    "query": "query_string"
		}

Options

IA_IP_address—The IP address of the NDR appliance running the NDR API.
username—Your username.
password—Your password.

Parameters

startTime (string)—The UTC time of the NDR appliance that specifies the start time of an interval. The format is HH:mm.
endTime (string)—The UTC time of the Network Detection and Response appliance that specifies the end time of an interval. The format is HH:mm.
startDate (string)—The start day of an interval. The format is YYYY.MM.DD.
endDate (string)—The end day of an interval. The format is YYYY.MM.DD.
query (string, optional)—A single term or a phrase to retrieve the metadata for all the sessions that match your query. You can also combine multiple terms or phrases together with Boolean operators and special characters to form a complex query similar to how you construct a query in the Web UI. For the list of terms that a query can take, see the "Metadata Fields Definitions" section in the Network Detection and Response User Guide.

Example

GET https://xxx.xxx.xxx.xxx/config/v1/l7metadata

Required header:

--user npadmin:hammerhead

Request body:

{
  "startTime":"10:50", 
  "endTime":"10:58",
  "endDate":"2021.07.21",
  "startDate":"2021.07.21", 
  "query": "sourceIPv4Address: 10.20.20.4 OR sourceIPv4Address: 161.69.226.182"
}

Layer-7 metadata using GET: Response

HTTP/1.1 [Response Code] [Response Message]				
Server: [Server]
Date: [Date]				
Content-Type: [Content Type]

Response fields

Response code—A standard HTTP response code.
Response message—A standard HTTP response message.
Server—The server being used.
Date—Standard HTML date format.
Content type—The response format.

Example

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 06 Apr 2017 17:36:14 GMT
Content-Type: application/json; charset=utf-8
[
   {
     "_shards": {
		"failed": 0,
		"successful": 4,
		"total": 4
	},
	"aggregations": {
	        "first_event": {
		   "value": null
		},
		"last_event": {
		    "value": null
		}
	},
	"hits": {
	     "hits": [],
	     "max_score": null,
	      "total": 0
	},
	"timed_out": false,
	"took": 2
  }
]

cURL code sample: Layer-7 metadata using GET

 curl -k -u npadmin:hammerhead -H "Content-Type: application/json" 
-X GET https://xxx.xxx.xxx.xxx/config/v1/l7metadata -d{"startTime":"10:50", 
"endTime":"10:58","endDate":"2021.05.31","startDate":"2021.05.31",
"query":"sourceIPv4Address: 10.20.20.4 OR sourceIPv4Address: 161.69.226.182"}

This cURL sample includes the following options:

-k—This option explicitly allows cURL to perform insecure SSL connections and transfers, which allows you to test your SSL connection without installing a CA certificate.
--user npadmin:hammerhead—Replace npadmin with your user name. Replace hammerhead with your password.
-H "Content-Type: application/json"—This header specifies that the request body is in JSON format.
-X GET—This option specifies using the GET method.
https://xxx.xxx.xxx.xxx/config/v1/l7metadata—The Layer-7 Metadata request URL. Replace xxx.xxx.xxx.xxx with the IP address of your NDR appliance.
-d{"startTime":"10:50", "endTime":"10:58","endDate":"2021.05.31","startDate":"2021.05.31", "query":"sourceIPv4Address: 10.20.20.4 OR sourceIPv4Address: 161.69.226.182"}—Replace timestamps as required to specify the interval. Replace sourceIPv4Address: 10.20.20.4 OR sourceIPv4Address: 161.69.226.182 with a query string to retrieve the metadata of all the sessions that match your query.

Results

This example returns Layer-7 metadata of all the sessions that match your query.