To get a specific saved query, send the following request:
GET https://<IA_IP_address>:<port_number>/savedquery/v1/querybody/<user_name>/<query_name>
Required header:
Cookie: px=<token>
Options
IA_IP_address—The IP address of the NDR appliance running the NDR API.
port_number—The port number of the NDR appliance running the NDR API.
user_name—The name of the user. The user_name must match the name of the logged-in user.
query_name—The name of the query.
token—This token authenticates the session. By default, the session times out after 24 hours.
Example
GET https://xxx.xxx.xxx.xxx:443/savedquery/v1/querybody/npadmin/savedquerywithtermlist
Required header:
Cookie: px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Query by name: Response
HTTP/1.1 [Response Code] [Response Message] Server: [Server] Date: [Date] Content-Type: [Content Type] ownerName: [Owner Name] name: [Query Name] delimiterStringStart: [Delimiter Start String ] delimiterStringEnd: [Delimiter End String] queryTemplate: [Query Template]
Response fields
Response code—A standard HTTP response code.
200—Request successful; the requested information is returned.
4xx—Request unsuccessful.
Response message—A standard HTTP response message.
OK—Request successful; the requested information is returned.
Error message—Request unsuccessful.
Server—The server being used.
Date—Standard HTML date format.
Content type—The response format.
Owner name—The user who created the query.
Query name—The unique name of the query.
Delimiter start string—The starting delimiter for references to term lists and other saved queries. If this value is not defined, the default is
{{.Delimiter end string—The ending delimiter for references to term lists and other saved queries. If this value is not defined, the default is
}}.Query template—The query. Queries can contain references to term lists and other saved queries.
Example
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 28 Apr 2016 20:02:49 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 331
[
{
"ownerName": "npadmin",
"name": "test",
"delimiterStringStart": "{{",
"delimiterStringEnd": "}}",
"queryTemplate": "destinationIPv4Address: [192.168.1.0 TO 192.168.1.255]"
},
]cURL code sample: Query by name
curl -k --cookie "px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" https://xxx.xxx.xxx.xxx:443/savedquery/v1/querybody/npadmin/savedquerywithtermlist
This cURL sample includes the following options:
-k—This option explicitly allows cURL to perform insecure SSL connections and transfers, which allows you to test your SSL connection without installing a CA certificate.--cookie "px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"—This option specifies the authentication token for this session.https://xxx.xxx.xxx.xxx:443/savedquery/v1/querybody/npadmin/savedquerywithtermlist—The saved query request URL. Replacexxx.xxx.xxx.xxxwith the IP address of your NDR appliance. Replacenpadminwith the user name who created the query. Replacesavedquerywithtermlistwith the name of the query to retrieve.
Results
This example returns the specified query.