NDR RESTful API endpoints

Authentication

POST https://<IA_IP_address>:<port_number>/login

Session: Request

POST https://<IA_IP_address>:<port_number>/session

Log Out: Request

POST https://<IA_IP_address>:<port_number>/logout

Layer-7 metadata using GET: Request

GET https://<IA_IP_address>/config/v1/l7metadata

Elasticsearch information: Request

GET https://<IA_IP_address>:<port_number>/elasticsearch

Elasticsearch query: Request

GET https://<IA_IP_address>:<port_number>/elasticsearch/<Elasticsearch_query>

Flow summary using GET: Request

GET https://<IA_IP_address>:<port_number>/flowsummary/v2

Flow summary using POST: Request

POST https://<IA_IP_address>:<port_number>/flowsummary/v2

Flow summary for a cluster using GET: Request

GET https://<IA_IP_address>:<port_number>/flowsummary/v2/<cluster_name>

Flow summary for a cluster using POST: Request

POST https://<IA_IP_address>:<port_number>/flowsummary/v2/<cluster_name>

Term lists for a user: Request

GET https://<IA_IP_address>:<port_number>/savedquery/v1/termlist/<user_name>

Delete term lists for a user: Request

DELETE https://<IA_IP_address>:<port_number>/savedquery/v1/termlist/<user_name>

Term list by name: Request

GET https://<IA_IP_address>:<port_number>/savedquery/v1/termlist/<user_name>/<term_list_name>

Create a term list: Request

PUT https://<IA_IP_address>:<port_number>/savedquery/v1/termlist/<user_name>/<term_list_name>

Delete a term list by name: Request

DELETE https://<IA_IP_address>:<port_number>/savedquery/v1/termlist/<user_name>/<term_list_name>

Queries for a user: Request

GET https://<IA_IP_address>:<port_number>/savedquery/v1/querybody/<user_name>

Delete queries for a user: Request

DELETE https://<IA_IP_address>:<port_number>/savedquery/v1/querybody/<user_name>

Query by name: Request

GET https://<IA_IP_address>:<port_number>/savedquery/v1/querybody/<user_name>/<query_body_name>

Create a query by name: Request

PUT https://<IA_IP_address>:<port_number>/savedquery/v1/querybody/<user_name>/<query_body_name>

Delete a query by name: Request

DELETE https://<IA_IP_address>:<port_number>/savedquery/v1/querybody/<user_name>/<query_body_name>

Query results using GET: Request

GET https://<IA_IP_address>:<port_number>/savedquery/v1/resolution

Query results using POST: Request

POST https://<IA_IP_address>:<port_number>/savedquery/v1/resolution

Create a scheduled search: Request

POST https://<IA_IP_address>:<port_number>/scheduledsearch/v1/watch/<user_name>

Scheduled search by name: Request

GET https://<IA_IP_address>:<port_number>/scheduledsearch/v1/watch/<user_name>/<scheduled_search_name>

Update a scheduled search by name: Request

PUT https://<IA_IP_address>:<port_number>/scheduledsearch/v1/watch/<user_name>/<scheduled_search_name>

Delete a scheduled search by name: Request

DELETE https://<IA_IP_address>:<port_number>/scheduledsearch/v1/watch/<user_name>/<scheduled_search_name>

Scheduled searches by user: Request

GET https://<IA_IP_address>:<port_number>/scheduledsearch/v1/watch/<user_name>

Delete scheduled searches by user: Request

DELETE https://<IA_IP_address>:<port_number>/scheduledsearch/v1/watch/<user_name>

All scheduled searches: Request

DELETE https://<IA_IP_address>:<port_number>/scheduledsearch/v1/watch

Delete all scheduled searches: Request

DELETE https://<IA_IP_address>:<port_number>/scheduledsearch/v1/watch

Search result reports by user: Request

GET https://<IA_IP_address>:<port_number>/scheduledsearch/v1/watchreport/<user_name>

Delete scheduled searches by user: Request

DELETE https://<IA_IP_address>:<port_number>/scheduledsearch/v1/watchreport/<user_name>

Search result report by scheduled search: Request

GET https://<IA_IP_address>:<port_number>/scheduledsearch/v1/watchreport/<user_name>/<scheduled_search_name>

Delete search result reports by scheduled search: Request

DELETE https://<IA_IP_address>:<port_number>/scheduledsearch/v1/watchreport/<user_name>/<scheduled_search_name>

Search result report by ID: Request

GET https://<IA_IP_address>:<port_number>/scheduledsearch/v1/watchreport/<user_name>/<scheduled_search_name>/<report_ID>

Delete a search result report by ID: Request

DELETE https://<IA_IP_address>:<port_number>/scheduledsearch/v1/watchreport/<user_name>/<scheduled_search_name>/<report_ID>

Cluster names: Request

GET https://<IA_IP_address>:<port_number>/stats/v1/elastic/clusters

Elasticsearch nodes for a cluster: Request

GET https://<IA_IP_address>:<port_number>/stats/v1/elastic/<cluster_name>/nodes

IA hosts for a cluster: Request

GET https://<IA_IP_address>:<port_number>/stats/v1/elastic/<cluster_name>/hosts

Status for a cluster: Request

GET https://<IA_IP_address>:<port_number>/stats/v1/elastic/<cluster_name>/clusterstatus

Open indices for a cluster: Request

GET https://<IA_IP_address>:<port_number>/stats/v1/elastic/<cluster_name>/openindices

System statistics for a host: Request

POST https://<IA_IP_address>:<port_number>/stats/v1/systemstats/<cluster_name>/<host_name>

Pipeline statistics for a cluster: Request

POST https://<IA_IP_address>:<port_number>/stats/v1/pipelinestats/<cluster_name>

PX hosts for a cluster: Request

GET https://<IA_IP_address>:<port_number>/stats/v1/pxstats/<cluster_name>/hosts

PX host statistics: Request

POST https://<IA_IP_address>:<port_number>/stats/v1/pxstats/<cluster_name>/host/<PX_node>/<measurement>

List users: Request

GET https://<Network Detection and Response_IP_address>/config/v1/users

New user: Request

POST https://<Network Detection and Response_IP_address>/config/v1/users

User details: Request

GET https://<Network Detection and Response_IP_address>/config/v1/users/<user>

Update a user: Request

PUT https://<Network Detection and Response_IP_address>/config/v1/users/<user>

Remove a user: Request

DELETE https://<Network Detection and Response_IP_address>/config/v1/users/<user>

List users: Request

GET https://<Network Detection and Response_director_node_IP_address>/config/v1/users/forward/<data_node_IP_address>

New user: Request

POST https://<Network Detection and Response_director_node_IP_address>/config/v1/users

User details: Request

GET https://<Network Detection and Response_director_node_IP_address>/config/v1/users/<data_node_IP_address>/<user>

Update a user: Request

PUT https://<Network Detection and Response_director_node_IP_address>/config/v1/users/<user>

Remove a user: Request

DELETE https://<Network Detection and Response_director_node_IP_address>/config/v1/users/<data_node_IP_address>/<user>

Upload update file: Request

POST https://<IA_IP_address>/updates/v1

Apply update: Request

POST https://<IA_IP_address>/updates/v1/IA-1.3.2.xxxxx/apply

Enable VBAC: Request

PUT https://<IA_IP_address>:<port_number>/config/v1/rbac/activation?status=<status>

VBAC state: Request

GET https://<IA_IP_address>:<port_number>/config/v1/rbac/activation

VLAN/Q-in-Q mappings: Request

GET https://<IA_IP_address>:<port_number>/config/v1/rbac/vlan/mappings

Delete VLAN mappings: Request

DELETE https://<IA_IP_address>:<port_number>/config/v1/rbac/vlan/mappings

Bulk upsert VLAN/Q-in-Q mappings: Request

PUT https://<IA_IP_address>:<port_number>/config/v1/rbac/vlan/mappings/_bulk

VLAN/Q-in-Q mapping for a group: Request

GET https://<IA_IP_address>:<port_number>/config/v1/rbac/vlan/mappings/<groupAlias>

Delete VLAN/Q-in-Q mapping for a group: Request

DELETE https://<IA_IP_address>:<port_number>/config/v1/rbac/vlan/mappings/<groupAlias>

Create VLAN/Q-in-Q mapping for a group: Request

POST https://<IA_IP_address>:<port_number>/config/v1/rbac/vlan/mappings

Update VLAN/Q-in-Q mapping for a group: Request

PUT https://<IA_IP_address>:<port_number>/config/v1/rbac/vlan/mappings/<group_alias>

Configure activation code: Request

PUT https://<IA_IP_address>:<port_number>/config/v1/dtigw/activation

License details: Request

GET https://<IA_IP_address>:<port_number>/config/v1/licenses

Add or update licenses: Request

POST https://<IA_IP_address>:<port_number>/config/v1/licenses

Delete license: Request

DELETE https://<IA_IP_address>:<port_number>/config/v1/licenses/<key>

License status: Request

GET https://<IA_IP_address>:<port_number>/config/v1/licenses/_status/<feature>

License summary details: Request

GET https://<IA_IP_address>:<port_number>/config/v1/licenses/_summary

License summary details for a feature: Request

GET https://<IA_IP_address>:<port_number>/config/v1/licenses/_summary/<feature>

Configure Endpoint Security integration: Request

POST https://<IA_IP_address>:<port_number>/config/v1/device

Endpoint Security integration configuration: Request

GET https://<IA_IP_address>:<port_number>/config/v1/device

Endpoint Security integration configuration for a device: Request

GET https://<IA_IP_address>:<port_number>/config/v1/device/<device_IP>

Update Endpoint Security configuration: Request

PUT https://<IA_IP_address>:<port_number>/config/v1/device

Delete Endpoint Security configuration: Request

DELETE https://<IA_IP_address>:<port_number>/config/v1/device/<device_IP>

Set poll interval: Request

PUT https://<IA_IP_address>:<port_number>/config/v1/device/<device_IP>/hostpoll/interval/<poll_interval>

Set alert poll interval: Request

PUT https://<IA_IP_address>:<port_number>/config/v1/device/<device_IP>/alertpoll/interval/<poll_interval>

Enable SSL verification: Request

PUT https://<IA_IP_address>:<port_number>/config/v1/device/<device_IP>/sslverify/enabled/{true|false}

Enable host polling: Request

PUT https://<IA_IP_address>:<port_number>/config/v1/device/<device_IP>/hostpoll/enabled/{true|false}

Enable alert polling: Request

PUT https://<IA_IP_address>:<port_number>/config/v1/device/<device_IP>/alertpoll/enabled/{true|false}

External feed names: Request

GET https://<IA_IP_address>:<port_number>/threatintelservice/v1/feedname

Create a feed name: Request

POST https://<IA_IP_address>:<port_number>/threatintelservice/v1/feedname/<feed_name>

Enable a feed: Request

POST https://<IA_IP_address>:<port_number>/threatintelservice/v1/feedname/<feed_name>/<active>

Delete a feed name: Request

DELETE https://<IA_IP_address>:<port_number>/threatintelservice/v1/feedname/<feed_name>

Upload file: Request

POST https://<IA_IP_address>:<port_number>/threatintelservice/v1/uploadfile