Press CTRL+K to open search

Statistics request

  • Published on Sep 3, 2026
  • 10 minute(s) read
Prev Next

Retrieves performance statistics for a specified time range. On Email Security — Server appliances, email statistics are returned. On Network Security appliances, protocol-related statistics are returned. The statistics are fetched locally.

Note

You must have the api_analyst or api_monitor role.

The WSAPI service must be enabled on the appliance using the wsapi enable CLI command. See the CLI Reference for more information.

GET https://<IP_address>/wsapis/v2.0.0/statistics?start_time=2019-04-01T03:02:13.552-00:00&end_time=2019-05-22T03:02:13.552-00:00

Availability

This command is available on the following appliances:

  • Email Security — Server

  • Network Security

Required headers:

X-FeApi-Token: [API-Token]

Options

  • IP_address—This is the IP address of the appliance running the Web Services API.

  • API-Token—This token authenticates the session. By default, the session times out after 15 minutes of inactivity.

  • Client-Token (Optional)— This client token is provided by Trellix. For more information about the client token, contact your sales representative.

  • start_time and end_time—Searches between two specified time frames. Both the start time and end time must be in UTC format:

    "yyyy-MM-ddTHH:mm:ss.SSS-XX:XX" For example: start_time="2001-07-04T12:08:56.235-07:00"

    • yyyy—Year (1900 and later)

    • MM—Month (01-12)

    • dd—Day (01-31)

    • HH—Hour (01-24)

    • mm—Minutes (01-59)

    • ss.sss—Seconds (01-59.999)

    • XX:XX—Time offset from UTC.

  • include_submission_stats—(Boolean) Provides statistics on completed, queued, and malicious submissions. Optional.

Usage

Statistics are collected every 10 minutes; it is recommended that you collect statistics up to the last 10 minutes. If you plan to use the statistics API in a script to pull data continuously, it is recommended that:

  • start_time should be currentTime – 20 minutes.

  • end_time should be currentTime – 10 minutes.

  • When the adjusted end time is returned, it should be used as the start time for the next iteration.

For example:

GET https://172.16.172.234:443/wsapis/v2.0.0/statistics?start_time=2019-04-29T22:02:00.000-00:00&end_time=2019-04-29T22:12:55.248-00:00&include_submission_stats=true

{
  "applianceStats": {
    "FeExTotalEmailsWithRetroDetection": 0,
    "FeExTotalEmails": 1662,
    "FeExTotalEmailsWithRiskwareMatch": 0,
    "FeExTotalEmailsWithBadUrls": 2,
    "FeExTotalEmailsWithRiskwareBlock": 0,
    "FeExTotalEmailsBypassed": 0,
    "FeExTotalEmailsAnalyzed": 657,
    "FeExTotalBadEmails": 5,
    "FeExTotalEmailBypassAnalysisTimeout": 2,
    "FeExTotalEmailsWithAttachments": 118,
    "FeExTotalEmailsQuarantined": 5,
    "FeExTotalEmailsWithUrls": 582,
    "FeExTotalEmailsWithBadAttachments": 3
  },
  "adjustedEndTime": "2019-04-29T22:12:00",
  "adjustedStartTime": "2019-04-29T22:02:00",
  "currentTime": "2019-04-29T22:22:55.32074" 
  "submissionStats": {
    "FeComCompletedSubmissions": {
      "file": 0,
      "url": 0
    },
    "FeComMaliciousSubmissions": {
      "file": 0,
      "url": 0
    },
    "FeComQueuedSubmissions": {
      "file": 102,
      "url": 40
    }
  }
}

Use the value of adjustedEndTime from the results of the above call as the start_time in the following call:

GET https://172.16.172.234:443/wsapis/v2.0.0/statistics?start_time=2019-04-29T22:12:00.000-00:00&end_time=2019-04-29T22:22:55.568-00:00

{
  "applianceStats": {
    "FeExTotalEmailsWithRetroDetection": 0,
    "FeExTotalEmails": 1662,
    "FeExTotalEmailsWithRiskwareMatch": 0,
    "FeExTotalEmailsWithBadUrls": 4,
    "FeExTotalEmailsWithRiskwareBlock": 0,
    "FeExTotalEmailsBypassed": 0,
    "FeExTotalEmailsAnalyzed": 658,
    "FeExTotalBadEmails": 6,
    "FeExTotalEmailBypassAnalysisTimeout": 2,
    "FeExTotalEmailsWithAttachments": 117,
    "FeExTotalEmailsQuarantined": 6,
    "FeExTotalEmailsWithUrls": 581,
    "FeExTotalEmailsWithBadAttachments": 2
  },
  "adjustedEndTime": "2019-04-29T22:22:00",
  "adjustedStartTime": "2019-04-29T22:12:00",
  "currentTime": "2019-04-29T22:32:55.652528"
}

Next iteration:

GET https://172.16.172.234:443/wsapis/v2.0.0/statistics?start_time=2019-04-29T22:22:00.000-00:00&end_time=2019-04-29T22:32:55.887-00:00

{
  "applianceStats": {
    "FeExTotalEmailsWithRetroDetection": 0,
    "FeExTotalEmails": 1665,
    "FeExTotalEmailsWithRiskwareMatch": 0,
    "FeExTotalEmailsWithBadUrls": 1,
    "FeExTotalEmailsWithRiskwareBlock": 0,
    "FeExTotalEmailsBypassed": 0,
    "FeExTotalEmailsAnalyzed": 650,
    "FeExTotalBadEmails": 5,
    "FeExTotalEmailBypassAnalysisTimeout": 15,
    "FeExTotalEmailsWithAttachments": 120,
    "FeExTotalEmailsQuarantined": 5,
    "FeExTotalEmailsWithUrls": 583,
    "FeExTotalEmailsWithBadAttachments": 4
  },
  "adjustedEndTime": "2019-04-29T22:32:00",
  "adjustedStartTime": "2019-04-29T22:22:00",
  "currentTime": "2019-04-29T22:42:56.000417"
}

Statistics response

Response fields

  • Response Code—A standard HTML response code.

    • 200—Request successful.

    • 400—Invalid inputs

    • 404—Statistics not found

    • 500—Request unsuccessful because the server has encountered a problem; retry later.

    • 503—The WSAPI service was not enabled on the appliance

  • Response Message—A standard HTML response message.

    • OK—Request successful.

    • Error trying to process submission—Request unsuccessful because the server has encountered a problem; retry later.

    • Not found

    • Server error

    • Service unavailable

  • currentTime—The time the request was submitted. All timestamps in the response are in UTC format.

  • adjustedEndTime—The end timestamp that data was pulled from the DB.

  • adjustedStartTime—The start timestamp that data was pulled from the DB.

    If the request time range is more than 24 hours ago, the data will be pulled from the hourly rollups. If the time window is within the last 24 hours, the stored procedure will pull the data from min-rollups table.

Note

If the time range is more than 24 hours ago, the adjusted start time and end time will be truncated to the hour. When both the adjusted start time and end time are the same, there will be no measures for those segments.

Example

GET https://<IP_address>/wsapis/v2.0.0/statistics?start_time=2019-04-25T09:00:00.000-00:00&end_time=2019-04-25T09:59:00.000-00:00

{
  "applianceStats": {
    "FeExTotalEmailsWithRetroDetection": 0,
    "FeExTotalEmails": 0,
    "FeExTotalEmailsWithRiskwareMatch": 0,
    "FeExTotalEmailsWithBadUrls": 0,
    "FeExTotalEmailsWithRiskwareBlock": 0,
    "FeExTotalEmailsBypassed": 0,
    "FeExTotalEmailsAnalyzed": 0,
    "FeExTotalBadEmails": 0,
    "FeExTotalEmailBypassAnalysisTimeout": 2,
    "FeExTotalEmailsWithAttachments": 0,
    "FeExTotalEmailsQuarantined": 0,
    "FeExTotalEmailsWithUrls": 0,
    "FeExTotalEmailsWithBadAttachments": 0
  },
  "adjustedEndTime": "2019-04-25T09:00:00",
  "adjustedStartTime": "2019-04-25T09:00:00",
  "currentTime": "2019-04-13T22:11:52.475053"
}

In the above example, both the adjusted start time and end time are truncated to the same hour: 2019/04/26 09:00:00.

Another example: Using a start time and end time of 04/26/2019 08:59:00 to 04/26/2019 09:59:00, the API returns data for the adjusted start time and end time: 04/26/2019 08:00:00 to 04/26/2019 09:00:00, so the actual results are for almost an hour earlier.

GET https://<IP_address>/wsapis/v2.0.0/statistics?start_time=2019-04-25T08:59:00.000-00:00&end_time=2019-04-25T09:59:00.000-00:00

{
  "applianceStats": {
    "FeExTotalEmailsWithRetroDetection": 0,
    "FeExTotalEmails": 8079,
    "FeExTotalEmailsWithRiskwareMatch": 0,
    "FeExTotalEmailsWithBadUrls": 6,
    "FeExTotalEmailsWithRiskwareBlock": 0,
    "FeExTotalEmailsBypassed": 0,
    "FeExTotalEmailsAnalyzed": 3150,
    "FeExTotalBadEmails": 21,
    "FeExTotalEmailBypassAnalysisTimeout": 8,
    "FeExTotalEmailsWithAttachments": 575,
    "FeExTotalEmailsQuarantined": 21,
    "FeExTotalEmailsWithUrls": 2825,
    "FeExTotalEmailsWithBadAttachments": 15
  },
  "adjustedEndTime": "2019-04-25T09:00:00",
  "adjustedStartTime": "2019-04-25T08:00:00",
  "currentTime": "2019-04-13T22:15:45.5564"
}

Email Security — Server response fields:

  • FeExTotalEmails—Number of emails received

  • FeExTotalEmailsAnalyzed—Number of emails analyzed by MVX

  • FeExTotalBadEmails—Total emails received with malicious contents

  • FeExTotalEmailsQuarantined—Number of emails quarantined (emails with riskware-block are included)

  • FeExTotalEmailsBypassed—Number of emails bypassed

  • FeExTotalEmailBypassAnalysisTimeout—The length of time (in minutes) an email is in analysis.

  • FeExTotalEmailsWithAttachments—Number of emails with attachments

  • FeExTotalEmailsWithBadAttachments—Number of emails with malicious attachments

  • FeExTotalEmailsWithUrls—Number of emails with body URLs

  • FeExTotalEmailsWithBadUrls—Number of emails with malicious body URLs

  • FeExfTotalEmailsWithRiskwareMatch—Number of emails with riskware match (emails with riskware-block are not included)

  • FeExfTotalEmailsWithRiskwareBlock—Number of blocked emails due to riskware

  • FeExTotalEmailsWithRetroDetection—Number of emails detected via retroactive detection (this includes all types of retro: FAUDE, remote correlation and object retro detection)

Network Security response fields:

  • FeNxTotalBytes—Total number of bytes (in KBs) for the given time range

  • FeNxMinBytesRate—Minimum rate (kbps) for the given timeframe, measured every 1 minute

  • FeNxMaxBytesRate—Maximum rate (kbps) for the given timeframe, measured every 1 minute

  • FeNxTotalHttpBytes—Total number of HTTP bytes (in KBs) for the given time range

  • FeNxMinHttpRate—Minimum HTTP byte rate (kbps) for the given timeframe, measured every 1 minute

  • FeNxMaxHttpRate—Maximum HTTP byte rate (kbps) for the given timeframe, measured every 1 minute

  • FeNxTotalImapBytes—Total number of IMAP bytes (in KBs) for the given time range

  • FeNxMinImapRate—Minimum IMAP kbps for the given timeframe

  • FeNxMaxImapRate—Maximum IMAP kbps for the given timeframe

  • FeNxTotalDnsBytes—Total number of DNS bytes (in KBs) for the given time range

  • FeNxMinDnsRate—Minimum UDP kbps for the given timeframe

  • FeNxMaxDnsRate—Maximum DNS kbps for the given timeframe

  • FeNxTotalIpBytes—Total number of IP bytes (in KBs) for the given time range

  • FeNxMinIpRate—Minimum IP kbps for the given timeframe

  • FeNxMaxIpRate—Maximum IP kbps for the given timeframe

  • FeNxTotalPopBytes—Total number of POP bytes (in KBs) for the given time range

  • FeNxMinPopRate—Minimum POP kbps for the given timeframe

  • FeNxMaxPopRate—Maximum POP kbps for the given timeframe

  • FeNxTotalRpcBytes—Total number of RPC bytes (in KBs) for the given time range

  • FeNxMinRpcRate—Minimum RPC kbps for the given timeframe

  • FeNxMaxRpcRate—Maximum RPC kbps for the given timeframe

  • FeNxTotalSmbBytes—Total number of SMB bytes (in KBs) for the given time range

  • FeNxMinSmbRate—Minimum SMB kbps for the given timeframe

  • FeNxMaxSmbRate—Maximum SMB kbps for the given timeframe

  • FeNxTotalSmtpBytes—Total number of SMTP bytes (in KBs) for the given time range

  • FeNxMinSmtpRate—Minimum SMTP kbps for the given timeframe

  • FeNxMaxSmtpRate—Maximum SMTP kbps for the given timeframe

  • FeNxTotalSshBytes—Total number of SSH bytes (in KBs) for the given time range

  • FeNxMinSshRate—Minimum SSH kbps for the given timeframe

  • FeNxMaxSshRate—Maximum SSH kbps for the given timeframe

  • FeNxTotalTcpBytes—Total number of TCP bytes (in KBs) for the given time range

  • FeNxMinTcpRate—Minimum TCP kbps for the given timeframe

  • FeNxMaxTcpRate—Maximum TCP kbps for the given timeframe

  • FeNxTotalUdpBytes—Total number of UDP bytes (in KBs) for the given time range

  • FeNxMinUdpRate—Minimum UDP kbps for the given timeframe

  • FeNxMaxUdpRate—Maximum UDP kbps for the given timeframe

  • FeNxTotalVlanBytes—Total number of VLAN bytes (in KBs) for the given time range

  • FeNxMinVlanRate—Minimum VLAN kbps for the given timeframe

  • FeNxMaxVlanRate—Maximum VLAN kbps for the given timeframe

  • FeComTotalMalwareObjectAlerts—Total number of Malware Object alerts

  • FeComTotalRiskwareObjectAlerts—Total number of Riskware Object alerts

  • FeNxTotalMalwareCallbackAlerts—Total number of Malware Callback alerts

  • FeNxTotalWebInfectionAlerts—Total number of Web Infection alerts

  • FeNxTotalDomainMatchAlerts—Total number of Domain Match alerts

  • FeNxTotalInfectionMatchAlerts—Total number of Infection Match alerts

  • FeNxTotalRiskwareCallbackAlerts—Total number of Riskware Callback alerts

  • FeNxTotalRiskwareInfectionAlerts—Total number of Riskware Infection alerts

  • FeNxTotalSmartVisionAlerts—Total number of SmartVision alerts

  • FeNxTotalIpsEvents—Total number of IPS events

Example response body—Email Security — Server:

It is possible that a transaction has not been completely processed at the time the API statistics are collected. Because of this, the numbers that you see for a transaction may not be complete if that transaction is being processed. For example:

FeExTotalEmails = 4238
FeEXTotalEmailsBypassed= 1840
FeEXTotalEmailsAnalyzed =2138

FeEXTotalEmailsBypassed + FeEXTotalEmailsAnalyzed does not equal to 4238 because some emails are still in processed and are not completely analyzed.

{
  "applianceStats": {
    "FeExTotalEmailsWithRetroDetection": 1,
    "FeExTotalEmails": 4238,
    "FeExTotalEmailsWithRiskwareMatch": 0,
    "FeExTotalEmailsWithBadUrls": 18,
    "FeExTotalEmailsWithRiskwareBlock": 4,
    "FeExTotalEmailsBypassed": 1840,
    "FeExTotalEmailsAnalyzed": 2138,
    "FeExTotalBadEmails": 18,
    "FeExTotalEmailBypassAnalysisTimeout": 8,
    "FeExTotalEmailsWithAttachments": 332,
    "FeExTotalEmailsQuarantined": 21,
    "FeExTotalEmailsWithUrls": 1978,
    "FeExTotalEmailsWithBadAttachments": 0
  },
  "adjustedEndTime": "2019-04-09T22:10:00",
  "adjustedStartTime": "2019-04-09T22:04:00",
  "currentTime": "2019-04-09T22:21:30.83766"
}

Example response body using include_submission_stats=true flag—Network Security:

{
  "currentTime": "2019-04-01T02:08:35.089403",
  "adjustedStartTime": "2019-04-01T01:00:00",
  "adjustedEndTime": "2019-04-01T02:08:00",
  "applianceStats": {
    "FeNxMinDnsRate": 0,
    "FeNxTotalPopBytes": 68,
    "FeNxMaxHttpRate": 125.895691,
    "FeNxTotalSmbBytes": 68,
    "FeNxMaxSmbRate": 2.048839,
    "FeNxTotalSshBytes": 68,
    "FeNxMaxVlanRate": 0,
    "FeNxTotalMalwareCallbackAlerts": 106,
    "FeNxMinSshRate": 0,
    "FeNxMaxIpRate": 131.090439,
    "FeNxTotalInfectionMatchAlerts": 11,
    "FeNxMinSmtpRate": 0,
    "FeNxMaxUdpRate": 6.048085,
    "FeNxTotalBytes": 68,
    "FeNxMinVlanRate": 0,
    "FeNxMinUdpRate": 0,
    "FeNxMaxRpcRate": 0.016655,
    "FeNxMinPopRate": 0,
    "FeNxMinTcpRate": 0,
    "FeNxMinRpcRate": 0,
    "FeNxMinBytesRate": 0,
    "FeNxMaxSmtpRate": 1.865765,
    "FeNxMinSmbRate": 0,
    "FeNxTotalSmtpBytes": 68,
    "FeNxTotalRiskwareCallbackAlerts": 2,
    "FeNxMaxBytesRate": 131.118591,
    "FeNxMinImapRate": 0,
    "FeNxTotalVlanBytes": 68,
    "FeNxMinIpRate": 0,
    "FeNxTotalHttpBytes": 68,
    "FeNxTotalRpcBytes": 68,
    "FeNxMaxDnsRate": 1.01648,
    "FeNxTotalDnsBytes": 68,
    "FeNxMaxImapRate": 0,
    "FeNxMaxPopRate": 0,
    "FeNxTotalUdpBytes": 68,
    "FeNxTotalIpBytes": 68,
    "FeNxMaxSshRate": 0,
    "FeNxTotalDomainMatchAlerts": 12,
    "FeComTotalMalwareObjectAlerts": 21,
    "FeNxMinHttpRate": 0,
    "FeNxTotalImapBytes": 68,
    "FeNxMaxTcpRate": 131.080902,
    "FeNxTotalTcpBytes": 68
  }
  "submissionStats": {
  "FeComCompletedSubmissions": {
    "file": 0,
    "url": 0
  },
  "FeComQueuedSubmissions": {
    "file": 232649,
    "url": 918
  },
  "FeComMaliciousSubmissions": {
    "file": 0,
    "url": 0
  }
}

cURL code sample: statistics

The following code sample can be copied and executed from any command-line interface that includes the cURL library. This sample builds on the authentication cURL code sample.

Note

In this sample, line breaks are added for readability. Remove these line breaks before you paste the code sample into your command-line tool.

curl -qgsSkH --no-progress-bar
--header "X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
https://xxx.xxx.xxx.xxx:443/wsapis/v2.0.0/statistics?start_time=2017-06-01T03:02:13.552-00:00&end_time=2017-06-02T03:02:13.552-00:00&include_submission_stats=false

This cURL sample includes the following options:

  • -q—This option specifies that the curlrc config file is not read or used. Although this is an optional setting, Trellix recommends that you include this option.

  • -g—This option turns off the URL globbing parser. Although this is an optional setting, Trellix recommends that you include this option.

  • -s—This option turns off the progress meter and error message. Although this is an optional setting, Trellix recommends that you include this option.

  • -S—When used with the -s option, this option shows error messages if your cURL switch fails. Although this is an optional setting, Trellix recommends that you include this option.

  • -k—This option explicitly allows cURL to perform insecure SSL connections and transfers. This allows you to test your SSL connection without installing a CA certificate.

  • -H—This option allows you to specify a custom header with the --header switch.

  • --no-progress-bar—This option suppresses the cURL download progress bar, which can interfere with the request.

  • --header "X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"—This custom header provides the API-Token that was returned during the authentication request. In the authentication cURL code sample, this token was included in the auth.txt file. Replace the token value in the code sample with the token value received in response to your authentication request.

    Note

    By default, the X-FeApi-Token times out after 15 minutes of inactivity.

  • https://xxx.xxx.xxx.xxx:443/wsapis/v2.0.0/statistics?start_time=2017-06-01T03:02:13.552-00:00&end_time=2017-06-02T03:02:13.552-00:00&include_submission_stats=false—The statistics request URL. Replace the IP address xxx.xxx.xxx.xxx with the IP address of your appliance.

Results

The requested statistics are returned.

:
Related articles
  • System statistics for a host: Request
    Intrusion Prevention System (IPS) > Network Detection and Response (NDR) > NDR 4.x > Network Detection and Response Console API Reference Guide 4.x > NDR RESTful API endpoints > Statistics
  • Health statistics
    Intrusion Prevention System (IPS) > Network Detection and Response (NDR) > NDR 4.x > Network Detection and Response Console API Reference Guide 4.x > NDR RESTful API endpoints > Telemetry data
  • PX host statistics: Request
    Intrusion Prevention System (IPS) > Network Detection and Response (NDR) > NDR 4.x > Network Detection and Response Console API Reference Guide 4.x > NDR RESTful API endpoints > Statistics
  • Submission results request based on format 2.0
    Network Security (NX) > Common Security Platform Product Docs > API Reference Release 2025.1 > Endpoints > IVX API endpoints
Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy.
Products
Company
Top Features
Solutions
Existing Users
Connect With Us
Sales and Support
Copyright © Abc Inc. All Rights Reserved