The NDR Console appliance can pull packets for any recorded flow on any connected Packet Capture appliance and return the packets in industry-standard PCAP format. In addition, the NDR Console appliance allows for PCAP retrieval from selected flows that were recorded on any connected Packet Capture appliance.
The following flow summary endpoints are available:
Flow summary using GET: Request
GET https://<IA_IP_address>:<port_number>/flowsummary/v2Flow summary using POST: Request
POST https://<IA_IP_address>:<port_number>/flowsummary/v2Flow summary for a cluster using GET: Request
GET https://<IA_IP_address>:<port_number>/flowsummary/v2/<cluster_name>Flow summary for a cluster using POST: Request
POST https://<IA_IP_address>:<port_number>/flowsummary/v2/<cluster_name>