Get Attack Details

This URL gets details for a particular attack.

Resource URL

GET /attack/<attack_id>

Request Parameters

URL Parameters:

Field Name	Description	Data Type	Mandatory
`attack_id`	Unique attack id	String	Yes

Response Parameters

Following fields are returned if the request parameters are correct, otherwise error details are returned.

Field Name	Description	Data Type
`AttackDescriptor`	Basic attack information	Object

Details of AttackDescriptor:

Field Name	Description	Data Type
`attackId`	Attack id	String
`name`	Attack name	String
`DosDirection`	Attack direction, can be "INBOUND" / "OUTBOUND" / "BOTH"	String
`Severity`	Attack severity, number between 0 and 9	Number
`description`	Attack details	Object

Details of description:

Field Name	Description	Data Type
`definition`	Attack definition	String
`btp`	BTP	String
`rfSB`	RFSB	String
`protectionCategory`	Protection category	String
`target`	Attack target	String
`httpResponseAttack`	HTTP response attack	String
`priority`	Priority	String
`protocols`	Protocols	String
`attackCategory`	Attack category	String
`attackSubCategory`	Attack sub category	String
`snortEngine`	Snort engine	String
`versionAdded`	Signature set version in which the attack was added	String
`versionUpdated`	Recent signature set version in which the attack was updated	String
`reference`	References	Object
`signatures`	Signatures	Array
`componentAttacks`	Component attacks	Array
`comments`	Comments	Object

Details of reference:

Field Name	Description	Data Type
`nspId`	NSP id	String
`cveId`	CVE did list	String
`microsoftId`	Microsoft id list	String
`bugtraqId`	Bug traq id list	String
`certId`	Cert id list	String
`arachNidsId`	ArchNid id list	String
`additionInfo`	Any additional info	String

Details of object under signatures:

Field Name	Description	Data Type
`name`	Signature name	String
`conditions`	List of conditions	List of string

Details of object under componentAttacks:

Field Name	Description	Data Type
`nspId`	NSP id	String
`attackName`	Attack name	String

Details of comments:

Field Name	Description	Data Type
`comments`	Comments	String
`availabeToChildDomains`	Available to child domains or not	Boolean
`parentDomainComments`	Parent domain comments	String

Example

Request

GET https://<NSM_IP>/attack/0x00000100

Response

{
"AttackDescriptor": 
{
                "DosDirection": null,
                "Severity": 5,
                "attackId": "0x00000100",
                "name": "IP: IP Fragment too Large",
                "description": {
                    "definition": "The Fragment offset plus the length exceeds 65,535. This generic condition indicates either errors in some network hardware/software, or maliciously constructed fragmented packets.\n\nnull\n\nnull\n\nnull\n\nSoftware Packages <br>any Internet connected machine<ul></ul>",
                    "btp": "Low",
                    "rfSB": "No",
                    "protectionCategory": "[Network Protection/IP]",
                    "target": "Server",
                    "httpResponseAttack": "No",
                    "priority": "High",
                    "protocols": "ipv4",
                    "attackCategory": "Exploit",
                    "attackSubCategory": "Protocol Violation",
                    "snortEngine": "---",
                    "versionAdded": "10.8.10.6",
                    "versionUpdated": "10.8.10.6",
                    "reference": {
                        "nspId": "0x00000100",
                        "cveId": "",
                        "microsoftId": "",
                        "bugtraqId": "",
                        "certId": "",
                        "arachNidsId": "",
                        "additionInfo": null
                    },
                    "signatures": [
                        {
                            "name": "Signature#1",
                            "conditions": [
                                "condition 1",
                                " System Event Name=\"ip-fragment-too-large\" "
                            ]
                        }
                    ],
                    "componentAttacks": [],
                    "comments": {
                        "comments": "",
                        "availabeToChildDomains": true,
                        "parentDomainComments": null
                    }
                }
            }
}

Error Information

Following error codes are returned by this URL:

S.No	HTTP Error Code	SDK API errorId	SDK API errorMessage
1	500	1001	Internal error
2	404	1402	Invalid attack id