Security Events Aggregation Query.
const url = 'https://example-corp.console.ves.volterra.io/api/v1/api/production/us-east-1/namespaces/default/api/data/namespaces/example/app_security/events/aggregation';const options = { method: 'POST', headers: {Authorization: '<Authorization>', 'Content-Type': 'application/json'}, body: '{"aggs":{},"end_time":"example","namespace":"example","query":"example","start_time":"example"}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://example-corp.console.ves.volterra.io/api/v1/api/production/us-east-1/namespaces/default/api/data/namespaces/example/app_security/events/aggregation \ --header 'Authorization: <Authorization>' \ --header 'Content-Type: application/json' \ --data '{ "aggs": {}, "end_time": "example", "namespace": "example", "query": "example", "start_time": "example" }'GET summary/aggregation data for security events in the given namespace.
For system namespace, all security events for the tenant matching the query specified
in the request will be considered for aggregation. User may query security events that matches various
fields such as vh_name, sec_event_type, src_site, city, country.
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Namespace
fetch security events for a given namespace.
Request Bodyrequired
Section titled “Request Bodyrequired”Request to GET only aggregation data for security events.
object
Aggregations provide summary/analytics data over the security events response. If the number of security events that matched the query is large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations. The aggregations are key’ed by user-defined aggregation name. The response will be key’ed with the same name. Optional.
object
Fetch security events whose timestamp <= end_time format: unix_timestamp|RFC 3339
Optional: If not specified, then the end_time will be evaluated to start_time+10m
If start_time is not specified, then the end_time will be evaluated to
Fetch security events for a given namespace.
Query is used to specify the list of matchers
syntax for query := {[”|”!”]
= : equal to
!= : not equal to
=~ : regex match
!~ : not regex match
When more than one matcher is specified in the query, then security events matching ALL the matchers will be returned in the response.
Example: query={country=“United States”, city=“California”} will return all security events originating from California, United States.
Optional: If not specified, all the security events matching the given tenant and namespace will be returned in the response.
Fetch security events whose timestamp >= start_time format: unix_timestamp|RFC 3339
Optional: If not specified, then the start_time will be evaluated to end_time-10m
If end_time is not specified, then the start_time will be evaluated to
Examplegenerated
{ "aggs": {}, "end_time": "example", "namespace": "example", "query": "example", "start_time": "example"}Responses
Section titled “Responses”A successful response.
Response message for SecurityEventsAggregationRequest.
object
Aggregations provide summary/analytics data over the security events response. If the number of security events that matched the query is large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations. The aggregation data is key’ed with the aggregation name specified in the request.
object
Total number of security events that matched the query.
Examplegenerated
{ "aggs": {}, "total_hits": "example"}Returned when operation is not authorized.
Examplegenerated
exampleReturned when there is no permission to access resource.
Examplegenerated
exampleReturned when resource is not found.
Examplegenerated
exampleReturned when operation on resource is conflicting with current value.
Examplegenerated
exampleReturned when operation has been rejected as it is happening too frequently.
Examplegenerated
exampleReturned when server encountered an error in processing API.
Examplegenerated
exampleReturned when service is unavailable temporarily.
Examplegenerated
exampleReturned when server timed out processing request.
Examplegenerated
example