Scheduled search by name: Request

To retrieve a specific scheduled search, send the following request:

GET https://<IA_IP_address>:<port_number>/scheduledsearch/v1/watch/<user_name>/<scheduled_search_name>

Required header:

Cookie: px=<token>

Options

IA_IP_address—The IP address of the NDR appliance running the NDR API.
port_number—The port number of the NDR appliance running the NDR API.
user_name—The name of the user. The user_name must be for a user who is logged in.
scheduled_search_name—The name of the scheduled search. It must be already created.
token—This token authenticates the session. By default, the session times out after 24 hours.

Example

GET https://xxx.xxx.xxx.xxx:443/scheduledsearch/v1/watch/npadmin/test

Required header:

Cookie: px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Scheduled search by name: Response

HTTP/1.1 [Response Code] [Response Message]				
Server: [Server]
Date: [Date]				
Content-Type: [Content Type]

name: [Scheduled Search Name]
state: [Scheduled Search State]
interval: [Trigger Interval]
schedule: [Trigger Schedule]
hourly: [Hourly]
daily: [Daily]
weekly: [Weekly]
daysOfWeek: [Days of Week]
at: [Weekly At]
search_type: [Search Type]
indices: [Indices]
type: [Lookback Type]
period: [Lookback Period]
query: [Query]
hitCount: [Hit Count]
operator: [Condition Operator]

Response fields

Response Code—A standard HTTP response code.
- 200—Request successful; the requested information is returned.
- 404—Request unsuccessful because the name was not found.
Response Message—A standard HTTP response message.
- OK—Request successful; the requested information is returned.
- Not Found—Request unsuccessful because the name was not found.
Server—The server being used.
Date—Standard HTML date format.
Content Type—The response format.
Scheduled Search Name—The name of the scheduled search.
Scheduled Search State—The state of the scheduled search. The state can be ACTIVE if the query runs at scheduled intervals or INACTIVE if no queries are run.
Trigger Interval—The interval between scheduled searches. Valid values are 1m–59m or 1h–23h. For example, a value of 5h means to run the query every 5 hours from now, and a value of 20m means to run the query every 20 minutes from now.
Trigger Schedule—When the query will run. Valid values are hourly, daily, or weekly.
Hourly—Valid values are 1–59; for example, 10 means to run the query every 10th minute of every hour.
Daily—The valid value is the time of day in hour:minute format. For example, 13:40 means to run the query every 14th hour at 40 minutes, and 01:01 means to run the query every second hours at 1 second.
Weekly—The query is run for the specified days of the week at the specified time.
Days of Week—Valid values are MONDAY, TUESDAY, WEDNESDAY, THURSDAY, FRIDAY, SATURDAY, and SUNDAY.
Weekly At—The time of day in hour:minute format.
Search Type—* indicates that everything is searched.
Indices—The index type that is searched.
Lookback Type—The start time of the period examined by the query. The start time is AUTO if the start time is the last invocation of the query or CUSTOM if the start time is provided with the period field.
Lookback Period—Valid values are 1h–23h or 1d–31d, indicating the number of hours or days before now to start searching. For example, {"type": "CUSTOM", "period": "4h"} indicates that the query examines the four hours before now.
Query—The Elasticsearch query to run or the name of a saved query to run.Query—The Elasticsearch query to run or the name of a saved query to run.
Hit Count—The number of search results returned before the query results are saved.
Condition Operator—The operator to be evaluated with the hitCount value. Valid vales are EQUAL, NOTEQUAL, LESSTHAN, LESSTHANOREQUAL, and GREATERTHANOREQUAL.

Example

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 28 Apr 2016 17:30:04 GMT
Content-Type: application/json; charset=utf-8
{
  "name": "test",
  "state": "ACTIVE",
  "trigger": {
    "interval": "2m"
  },
  "input": {
    "search": {
      "request": {
        "search_type": "*",
        "indices": [
          "nspector",
          "alert"
        ],
        "lookback_period": {
          "type": "AUTO"
        },
        "body": {
          "query": {
            "query_string": {
              "lowercase_expanded_terms": false,
              "query": "doc_values_type:fileinfo",
              "analyze_wildcard": true
            }
          }
        }
      }
    }
  },
  "condition": {
    "hitCount": 1,
    "operator": "GREATERTHAN"
  }
}

cURL code sample: Scheduled search by name

curl -k --cookie "px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" https://xxx.xxx.xxx.xxx:443/scheduledsearch/v1/watch/npadmin/test

This cURL sample includes the following options:

-k—This option explicitly allows cURL to perform insecure SSL connections and transfers, which allows you to test your SSL connection without installing a CA certificate.
--cookie "px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"—This option specifies the authentication token for this session.
https://xxx.xxx.xxx.xxx:443/scheduledsearch/v1/watch/npadmin/test—The scheduled search request URL. Replace xxx.xxx.xxx.xxx with the IP address of your NDR appliance. Replace npadmin with the name of the user who created the scheduled search. Replace test with the scheduled search of interest.

Results

This example returns the specified scheduled search.