Jobs

Create PCAP Job from Event

Given a TCP or UDP network connection log event, create a PCAP lookup job that would best locate the PCAP from that event.

get/connect/joblookup/

Query parameters

timestring required

Time timestamp of the event

esidstring

The event document ID. If this is not specified then the ncid param is required.

ncidstring

The network.community_id value for the event. Ignored if the esid param is provided.

Changed in 2 of the 23 revisions of this API.11

Jan 26, 202568dd01966c8b1See the full diff
- ○
  endpoint added
  endpoint-added
This revision also has 1 change that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog
Dec 10, 2024ee1120fd1e201See the full diff
- ▲
  api path removed without deprecation
  api-path-removed-without-deprecation
This revision also has 35 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog