Log

Get security event list

get/log/security

Request

Headers

X-Auth-Tokenstring required

Response

Success

Example response

{
  "threats": [
    {
      "name": "HTTP.Request.Slowloris",
      "level": "CRIT",
      "reported_timestamp": 1505755712,
      "reported_at": "2017-09-18T17:28:32Z",
      "cluster_name": "cluster1",
      "response_rule_id": 10005,
      "host_id": "ubuntu64:ZYA3:NPGZ:IU64:XJ3P:SUU3:QYEF:SLVT",
      "host_name": "ubuntu64",
      "enforcer_id": "2fdc03e027d6483633376609",
      "enforcer_name": "allinone",
      "id": "999-9c96-11e7-83c1-17580b",
      "threat_id": 2017,
      "client_workload_id": "7e31a2a4d4074ba459f8c22ee90",
      "client_workload_name": "iperfclient",
      "server_workload_id": "2cbab37b43efe049e583924a73a764b096ce8f15ea",
      "server_workload_name": "iperfserver",
      "severity": "critical",
      "action": "monitor",
      "count": 1,
      "ether_type": 2048,
      "client_port": 53825,
      "server_port": 5000,
      "server_conn_port": 5000,
      "ip_proto": 6,
      "client_ip": "172.17.0.4",
      "server_ip": "172.17.0.3",
      "application": "HTTP",
      "target": "true",
      "monitor": true,
      "cap_len": 32043,
      "packet": "base64string",
      "message": "Header duration=3s, threshold=3s"
    }
  ],
  "incidents": [
    {
      "name": "Host.Suspicious.Process",
      "level": "WARNING",
      "reported_timestamp": 1515020888,
      "reported_at": "2018-01-03T23:08:08Z",
      "cluster_name": "cluster1",
      "response_rule_id": 10006,
      "host_id": "ubuntu64:ZYA3:UZL5:2WOT:QYEF:SLVT:LIBD",
      "host_name": "ubuntu64",
      "enforcer_id": "a928be54f34fbb696426890a7249c067",
      "enforcer_name": "allinone",
      "id": "e6e19591-75a0-43e9-bebb-145d588e6718",
      "workload_id": "83e76eabd68494649440fa0a35451315289c70eb3094454e419952dffaa7715a",
      "workload_name": "iperfserver",
      "workload_image": "iperfserver",
      "workload_service": "iperfserver",
      "remote_workload_id": "external",
      "remote_workload_name": "iperfclient",
      "remote_workload_image": "iperfclient",
      "remote_workload_service": "iperfclient",
      "proc_name": "nc",
      "proc_path": "/bin/nc.traditional",
      "proc_cmd": "./dns_tunneling/iodine/bin/iodine -f -r 172.17.0.3 -P",
      "proc_real_uid": 1000,
      "proc_effective_uid": 1000,
      "proc_real_user": "test",
      "proc_effective_user": "root",
      "client_ip": "192.168.1.62",
      "server_ip": "10.1.4.3",
      "client_port": 56564,
      "server_port": 80,
      "server_conn_port": 80,
      "ether_type": 2048,
      "ip_proto": 6,
      "proc_parent_name": "sh",
      "proc_parent_path": "/bin/dash",
      "action": "violate",
      "group": "nv.iperfserver",
      "rule_id": "00000000-0000-0000-0000-000000000001",
      "aggregation_from": 1515020888,
      "count": 1,
      "message": "dns tunneling"
    }
  ],
  "violations": [
    {
      "level": "WARNING",
      "reported_timestamp": 1516160219,
      "reported_at": "2018-01-17T03:36:59Z",
      "cluster_name": "cluster1",
      "response_rule_id": 10008,
      "host_id": "2AU7:TIEN:O5KX:QK56:LFQP:IJSV:FXBN:QJV7",
      "host_name": "ubuntu64",
      "enforcer_id": "bced57295eefbd3f3bd0cf798b6184fa789",
      "enforcer_name": "allinone",
      "id": "e6e19591-75a0-43e9-bebb-145d588e6718",
      "client_id": "25f773945fff1d8880b9eb67d26be22f5321d",
      "client_name": "iperfclient",
      "server_id": "0350077d87164505597268494acbc8a25109e3",
      "server_name": "iperfserver",
      "server_port": 5000,
      "ip_proto": 6,
      "applications": [
        "HTTP"
      ],
      "policy_action": "violate",
      "policy_id": 9999,
      "client_ip": "172.17.0.4",
      "server_ip": "172.17.0.3"
    }
  ]
}

Changes

No recorded changes to this operation across all 1 revision of this API.