The NDR Console appliance has powerful search capabilities using the Web interface. Use the query syntax to construct search queries for specific values of metadata fields from the following protocols:
HTTP
DNS
TLS
FTP
FTP-data
SSH
SMTP
IMAP
POP3
MSN
MODBUS
You can also create term lists and use them in a query. This eliminates the task of entering individual IP addresses and domains in a query.
For more information about setting up queries, refer to the Network Detection and Response User Guide.
After you create and save a query, you can set up a scheduled search. For more information about scheduled search endpoints, see Scheduled search.
The following saved query endpoints are available:
Term lists for a user: Request
GET https://<IA_IP_address>:<port_number>/savedquery/v1/termlist/<user_name>Delete term lists for a user: Request
DELETE https://<IA_IP_address>:<port_number>/savedquery/v1/termlist/<user_name>GET https://<IA_IP_address>:<port_number>/savedquery/v1/termlist/<user_name>/<term_list_name>PUT https://<IA_IP_address>:<port_number>/savedquery/v1/termlist/<user_name>/<term_list_name>Delete a term list by name: Request
DELETE https://<IA_IP_address>:<port_number>/savedquery/v1/termlist/<user_name>/<term_list_name>GET https://<IA_IP_address>:<port_number>/savedquery/v1/querybody/<user_name>Delete queries for a user: Request
DELETE https://<IA_IP_address>:<port_number>/savedquery/v1/querybody/<user_name>GET https://<IA_IP_address>:<port_number>/savedquery/v1/querybody/<user_name>/<query_name>Create a query by name: Request
PUT https://<IA_IP_address>:<port_number>/savedquery/v1/querybody/<user_name>/<query_name>Delete a query by name: Request
DELETE https://<IA_IP_address>:<port_number>/savedquery/v1/querybody/<user_name>/<query_name>Query results using GET: Request
GET https://<IA_IP_address>:<port_number>/savedquery/v1/resolutionQuery results using POST: Request
POST https://<IA_IP_address>:<port_number>/savedquery/v1/resolution