Search result report by scheduled search: Request

To retrieve all search result reports for a specific scheduled search, send the following request:

GET https://<IA_IP_address>:<port_number>/ scheduledsearch/v1/watchreport/<user_name>/<scheduled_search_name>

Required header:

Cookie: px=<token>

Options

IA_IP_address—The IP address of the NDR appliance running the NDR API.
port_number—The port number of the NDR appliance running the NDR API.
user_name—The name of the user. The user_name must be for a currently logged-in user.
scheduled_search_name—The name of the scheduled search. It must be already created.
token—This token authenticates the session. By default, the session times out after 24 hours.

Example

GET https://xxx.xxx.xxx.xxx:443/scheduledsearch/v1/watchreport/npadmin/test

Required header:

Cookie: px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Search result report by scheduled search: Response

HTTP/1.1 [Response Code] [Response Message]				
Server: [Server]
Date: [Date]				
Content-Type: [Content Type]

id: [Report ID]
userName: [User Name]
watchName: [Scheduled Search Name]
search_type: [Search Type]
indices: [Indices]
type: [Lookback Type]
lowercase_expanded_terms: [Lowercase Expanded Terms]
query: [Query]
analyze_wildcard: [Analyze Wildcard]
executionTime: [Execution Time]
totalHitCount: [Total Hit Count]
topHits: [Top Hits]
conditionMet: [Condition Met]

Response fields

Response Code—A standard HTTP response code.
- 200—Request successful; the requested information is returned.
- 4xx—Request unsuccessful.
Response Message—A standard HTTP response message.
- OK—Request successful; the requested information is returned.
- Error message—Request unsuccessful.
Date—Standard HTML date format.
Content Type—The response format.
Report ID—The unique identifier of the search result report.
User Name—The name of the user that created the scheduled search. The User Name must match the name of the logged-in user.
Scheduled Search Name—The name of the scheduled search.
Search Type—* indicates that everything is searched.
Indices—The index type that is searched.
Lookback Type—The start time of the period examined by the query. The start time is AUTO if the start time is the last invocation of the query or CUSTOM if the start time is provided with the period field.
Lowercase Expanded Terms—Whether the terms are converted to lowercase letters.
Query—Query string.
Analyze Wildcard—Whether wildcards are used in the query.
Execution Time—The time when the query was run; the value is in ISO 8601 format.
Total Hit Count—The number of search results for the query.
Top Hits—The top documents that matched the query. The number is 10 by default.
Condition Met—Whether this query matched the specified condition.

Example

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 28 Apr 2016 17:55:14 GMT
Content-Type: application/json; charset=utf-8
[
  {
    "id": "7f87abaa-599b-47f4-b69d-73148ee31321",
    "userName": "npadmin",
    "watchName": "test",
    "query": {
      "search_type": "*",
      "indices": [
        "nspector-2016.04.21",
        "alert-2016.04.21"
      ],
      "lookback_period": {
        "type": "AUTO"
      },
      "body": {
        "query": {
          "query_string": {
            "lowercase_expanded_terms": false,
            "query": "(doc_values_type:fileinfo) AND (@timestamp: [2016-04-21T23:38:00.715Z TO 2016-04-21T23:40:00.715Z])",
            "analyze_wildcard": true
          }
        }
      }
    },
    "executionTime": "2016-04-21T23:40:00.715Z",
    "totalHitCount": 13689,
    "topHits": [+],
    "conditionMet": true
  },
  {
    "id": "7c45bf07-52e3-4b6a-afd8-011c6f579fbe",
    "userName": "npadmin",
    "watchName": "test",
    "query": {+},
    "executionTime": "2016-04-21T23:38:00.715Z",
    "totalHitCount": 2542,
    "topHits": [+],
    "conditionMet": true
  }
]

cURL code sample: Search result report by scheduled search

curl -k -H "Content-Type: application/json" --cookie "px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" https://xxx.xxx.xxx.xxx:443/scheduledsearch/v1/watchreport/npadmin/test

This cURL sample includes the following options:

-k—This option explicitly allows cURL to perform insecure SSL connections and transfers, which allows you to test your SSL connection without installing a CA certificate.
-H "Content-Type: application/json"—This header specifies that the request body is in JSON format.
--cookie "px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"—This option specifies the authentication token for this session.
https://xxx.xxx.xxx.xxx:443/scheduledsearch/v1/watchreport/npadmin/test—The scheduled search request URL. Replace xxx.xxx.xxx.xxx with the IP address of your NDR appliance. Replace npadmin with the name of the user who created the scheduled search. Replace test with the name of the scheduled search of interest.

Results

This example returns all search result reports for the specified scheduled search. The output is in JSON format.