Get Aegister Threat Blocker traffic logs

Retrieve Aegister Threat Blocker traffic logs from the Web Application.

You can retrieve only Aegister Threat Blocker traffic logs for organizations you can manage.

Authorizations

X-Aegister-Token

string

header

required

Path Parameters

id

integer

required

Query Parameters

actions[]

string[]

Filter results by action value

export

string

Export format for the result

limit

number

default:10

Max number of reponse items.

offset

number

default:0

Offset response items.

order

string

Order results by item field,

search

string

Filter results by search term

Response

200

application/json

error

integer

Any value different from 0 indicates an error.
More details can be found in messages.

Required range: 0 <= x <= 0

Example:

0

messages

any[]

If error is 1, contains zero or more details on the error.

Example:

[]

total

number

Total number of items that meet the list filter.
This doesn't represent the number of items inside the data array.

Required range: x >= 0

Example:

20

data

object[]

Show child attributes

data.id

number

ATB Traffic Log unique identifier.

Required range: x >= 1

data.date_time

string

Timestamp of the created Traffic Log.

data.type

enum<string>

The type of the traffic log parsed.
For now only sophos is supported.

Available options:

sophos

data.src_ip

string

Parsed source IP from the Traffic Log.

Example:

"22.33.44.55"

data.dest_ip

string

Parsed destination IP from the Traffic Log.

Example:

"192.168.1.50"

data.dest_port

string

Parsed destination Port from the Traffic Log.

Example:

"443"

data.log_message

string

Raw message from the Traffic Log.

Example:

"<30>device_name=SFW timestamp=2024-07-10T05:26:30+0200 device_model=XGS100 device_serial_id=X111111111111 log_id=000000001111 log_type=Firewall log_component=Firewall Rule log_subtype=Allowed log_version=1 severity=Information fw_rule_id=27"

data.extra

object

This object contains other parsed elements from the Traffic Log raw message.

Example:

{
  "log_id": "000000001111",
  "log_type": "Firewall",
  "severity": "Information",
  "timestamp": "2024-06-17T05:26:30+0200",
  "fw_rule_id": "27",
  "log_subtype": "Allowed",
  "log_version": "1",
  "device_model": "XGS100",
  "log_component": "Firewall",
  "<30>device_name": "SFW",
  "device_serial_id": "X111111111111"
}