Query results using POST: Request

To get the results for a saved query or term list, send the following request:

POST https://<IA_IP_address>:<port_number>/savedquery/v1/resolution

Required header:

Cookie: px=<token>

Request body:

{
  efSavedQueryId:querybody::<user_name>::<query_name>
}

{
  "efQueryTemplate": "<field_name>: {{termlist::<user_name>::<term_list_name>}}"
}

Note
The request body must be in JSON format.

Options

IA_IP_address—The IP address of the NDR appliance running the NDR API.
port_number—The port number of the NDR appliance running the NDR API.
token—This token authenticates the session. By default, the session times out after 24 hours.
user_name—The name of the user. The user_name must match the name of the logged-in user.
query_name—The name of the query. The query must have been created by the logged-in user.
field_name—The name of any valid field.
term_list_name—The name of the term list. The term list must have been created by the logged-in user.

Example

POST https://<IA_IP_address>:<port_number>/savedquery/v1/resolution

Required header:

Cookie: px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Request body (must be in JSON):

{
   "efQueryTemplate" : "dnsQNames: {{termlist::npadmin::badDomains}}"
}

Query results using POST: Response

HTTP/1.1 [Response Code] [Response Message]				
Server: [Server]
Date: [Date]				
Content-Type: [Content Type]
resolvedQuery: [Resolved Query]

Response fields

Response code—A standard HTTP response code.
Response message—A standard HTTP response message.
Server—The server being used.
Date—Standard HTML date format.
Content type—The response format.
Resolved query—The results for the query or term list.

Example

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 28 Apr 2016 21:14:28 GMT
Content-Type: application/json; charset=utf-8
{
  "resolvedQuery":"dnsQName: (www.danger123.com www.donotvisit.net www.warning.biz)"
}

cURL code sample: Query results using POST

curl -k https://xxx.xxx.xxx.xxx:443/savedquery/v1/resolution -X POST 
--data-binary '{"efSavedQueryId" : "querybody::npadmin::mythirdquery"}' 
--cookie "px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" 
-H "Accept: application/json" -H "Content-Type: application/json"

This cURL sample includes the following options:

-k—This option explicitly allows cURL to perform insecure SSL connections and transfers, which allows you to test your SSL connection without installing a CA certificate.
https://xxx.xxx.xxx.xxx:443/savedquery/v1/resolution—The saved query request URL. Replace xxx.xxx.xxx.xxx with the IP address of your NDR appliance.
-X POST—This option changes the HTTP method to POST.
--data-binary '{"efSavedQueryId" : "querybody::npadmin::mythirdquery"}'—This option specifies which query to get results for. Replace npadmin with the name of the user who created the query. Replace mythirdquery with the name of the query of interest.
--cookie "px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"—This option specifies the authentication token for this session.
-H "Accept: application/json"—This header specifies that the serverʼs response body is expected to be in JSON format.
-H "Content-Type: application/json"—This header specifies that the request body is in JSON format.

Results

This example returns the results of the specified query.