Query results using GET: Request

To get the results for a saved query or term list, send the following request:

GET https://<IA_IP_address>:<port_number>/savedquery/v1/resolution

Required header:

Cookie: px=<token>

Options

IA_IP_address—The IP address of the NDR appliance running the NDR API.
port_number—The port number of the NDR appliance running the NDR API.
token—This token authenticates the session. By default, the session times out after 24 hours.

Query parameters

efSavedQueryId=[termlist|querybody]::<user_name>::<term_list_name>|<query_name>]—Specify the name of the term list or query that you want results for. The term list or query must have been created by the logged-in user.

Example

GET https://xxx.xxx.xxx.xxx:443/savedquery/v1/resolution?efSavedQueryId=termlist::npadmin::badDomains

Required header:

Cookie: px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Query results using GET: Response

HTTP/1.1 [Response Code] [Response Message]				
Server: [Server]
Date: [Date]				
Content-Type: [Content Type]
resolvedQuery: [Resolved Query]

Response fields

Response code—A standard HTTP response code.
Response message—A standard HTTP response message.
Server—The server being used.
Date—Standard HTML date format.
Content type—The response format.
Resolved query—The results for the query or term list.

Example

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 28 Apr 2016 21:14:28 GMT
Content-Type: application/json; charset=utf-8
{"resolvedQuery":"dnsQName: (www.danger123.com www.donotvisit.net www.warning.biz)"}

cURL code sample: Query results using GET

curl -k -H "Content-Type: Application/Json" 
--cookie "px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" 
https://xxx.xxx.xxx.xxx:443/savedquery/v1/resolution?efSavedQueryId=querybody::npadmin::savedquerywithtermlist

This cURL sample includes the following options:

-k—This option explicitly allows cURL to perform insecure SSL connections and transfers, which allows you to test your SSL connection without installing a CA certificate.
-H "Content-Type: Application/json"—This header specifies that the request body is in JSON format.
--cookie "px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"—This option specifies the authentication token for this session.
https://xxx.xxx.xxx.xxx:443/savedquery/v1/resolution?efSavedQueryId=querybody::npadmin::savedquerywithtermlist—The saved query request URL. Replace xxx.xxx.xxx.xxx with the IP address of your NDR appliance. Replace npadmin with the name of the user who created the query. Replace savedquerywithtermlist with the query name of interest.

Results

This example returns the results of the specified query.