Term list by name: Request

To retrieve an already created term list, send the following request:

GET https://<IA_IP_address>:<port_number>/savedquery/v1/termlist/<user_name>/<term_list_name>

Required header:

Cookie: px=<token>

Options

IA_IP_address—The IP address of the NDR appliance running the NDR API.
port_number—The port number of the NDR appliance running the NDR API.
user_name—The name of the user. The user_name must match the name of the logged-in user.
term_list_name—The name of the term list.
token—This token authenticates the session. By default, the session times out after 24 hours.

Example

GET https://xxx.xxx.xxx.xxx:443/savedquery/v1/termlist/npadmin/faas_threat_feed

Required header:

Cookie: px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Term list by name: Response

HTTP/1.1 [Response Code] [Response Message]				
Server: [Server]
Date: [Date]				
Content-Type: [Content Type]
ownerName: [Owner Name]
name: [Term List Name]
values: [List Values]

Response fields

Response code—A standard HTTP response code.
- 200—Request successful; the specified information was deleted.
- 404—Request unsuccessful because the name was not found.
Response message—A standard HTTP response message.
- OK—Request successful; the specified information was deleted.
- Not found—Request unsuccessful because the name was not found.
Server—The server being used.
Date—Standard HTML date format.
Content type—The response format.
Owner name—The name of the user who created this term list.
Term list name—The unique name of this term list.
List values—The list of values for the term list. The maximum number of values is 1000.

Example

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 28 Apr 2016 19:28:21 GMT
Content-Type: application/json; charset=utf-8
{
  "ownerName": "npadmin",
  "name": "faas_threat_feed",
  "values": [
    "8.8.8.8",
    "9.9.9.9"
  ]
}

cURL code sample: Term list by name

curl -k --cookie "px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" 
https://xxx.xxx.xxx.xxx:443/savedquery/v1/termlist/npadmin/faas_threat_feed

This cURL sample includes the following options:

-k—This option explicitly allows cURL to perform insecure SSL connections and transfers, which allows you to test your SSL connection without installing a CA certificate.
--cookie "px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"—This option specifies the authentication token for this session.
https://xxx.xxx.xxx.xxx:443/savedquery/v1/termlist/npadmin/faas_threat_feed—The saved query request URL. Replace xxx.xxx.xxx.xxx with the IP address of your NDR appliance. Replace npadmin with the user name who created the term list. Replace faas_threat_feed with name of the term list to retrieve.

Results

This example returns the specified term list.