Edge Firewall Log Search

Edge Firewall Log Search

API to perform search on Edge Firewall logs

Request
URI
GET
https://{api_host}/api/search/v1/enterprises/{enterpriseLogicalId}/edgeFirewall
COPY
Path Parameters
string
enterpriseLogicalId
Required

Unique identifier of the customer for which logs are being requested

Query Parameters
number
from
Optional

Number of logs to skip in paginated results, defaults to 0

number
size
Optional

Maximum number of logs to return

string
startTime
Required

Start time of logs to search on

string
endTime
Required

End time of logs to search on

string
ACTION_TAKEN
Optional

Action that was performed on the packets when the condition of the rule met (applies to the flow the packet is part of)

string
RULE_ID
Optional

Unique identifier that identifies a firewall rule

string
SESSION_ID
Optional

Unique session or flow ID

string
SEGMENT_LOGICAL_ID
Optional

Unique identifier of the segment which the flow is part of

string
INPUT_INTERFACE
Optional

Interface name through which the packets of the flow entered the edge (applies only to the flows which was initiated from the LAN side. Empty string in case of overlay inbound flows)

string
PROTOCOL
Optional

L4 protocol of the flow

string
SOURCE_IP
Optional

Source IP of the packets

string
DESTINATION_IP
Optional

Destination IP for the packets

string
SOURCE_PORT
Optional

Source port number of the session

string
DESTINATION_PORT
Optional

Destination port number of the session

string
DESTINATION
Optional

Name of the remote-end device of the session

string
DOMAIN
Optional

Domain name of the destination IP address

string
FIREWALL_POLICY_NAME
Optional

Name of the firewall policy applied to the session

string
SEGMENT_NAME
Optional

Name of the segment to which the session belongs to

string
EXTENSION_HEADER
Optional

Includes the extension header details in case of IPv6 session

string
APPLICATION
Optional

Application the firewall rule was applied. It could be of "Any" or an application that was selected with Differentiated Services Code Point (DSCP) flag to apply a specific firewall rule

string
SESSION_DURATION_SECS
Optional

Duration for which the session has been active

string
BYTES_SENT
Optional

Amount of data sent in bytes in the session

string
BYTES_RECEIVED
Optional

Amount of data received in bytes in the session

string
CLOSE_REASON
Optional

Reason for the session closureseReason

string
SIGNATURE_ID
Optional

Suricata signature ID

string
VERDICT
Optional

Tells allowed or blocked in case of IDPS rules

string
SIGNATURE
Optional

Signature name/title

string
CATEGORY
Optional

Classification description for the rule

string
RULE_VERSION
Optional

ruleVersion

string
ATTACK_SOURCE
Optional

Source IP of the attack

string
ATTACK_TARGET
Optional

Target IP for the attack

string
SEVERITY
Optional

One of the severity levels (Critical/High/Medium/Low/Suspicious) identified for the traffic after subjecting the traffic through IDPS engine

string
EDGE_LOGICAL_ID
Optional

Unique identifier for the edge

string
ENTERPRISE_LOGICAL_ID
Optional

Unique identifier for the enterprise

string
EDGE_NAME
Optional

Name of the edge that generated the log

string
IDS_ALERT
Optional

Indicates whether or not Intrusion Detection System alert was generated

string
IPS_ALERT
Optional

Indicates whether or not Intrusion Prevention System alert was generated

Responses
200

Successfully retrieved Edge Firewall logs

Returns firewallFieldResponseSchema of type(s) application/json 
{
    "metaData": {
        "limit": "number",
        "more": false,
        "nextPageLink": "string",
        "prevPageLink": "string"
    },
    "data": [
        {
            "_source": {
                "@timestamp": "string",
                "logType": "string",
                "enterpriseLogicalId": "string",
                "edgeName": "string",
                "ruleId": "string",
                "edgeLogicalId": "string",
                "actionTaken": "string",
                "sessionId": "number",
                "segmentLogicalId": "string",
                "inputInterface": "string",
                "protocol": "number",
                "sourceIp": "string",
                "destinationIp": "string",
                "sourcePort": "number",
                "destinationPort": "number",
                "destination": "string",
                "domainName": "string",
                "firewallPolicyName": "string",
                "segmentName": "string",
                "extensionHeader": "string",
                "application": "string",
                "sessionDurationSecs": "number",
                "bytesSent": "number",
                "bytesReceived": "number",
                "closeReason": "string",
                "signatureId": "number",
                "verdict": "string",
                "signature": "string",
                "category": "string",
                "ruleVersion": "number",
                "attackSource": "string",
                "attackTarget": "string",
                "severity": "number",
                "idsAlert": "number",
                "ipsAlert": "number"
            }
        }
    ],
    "count": "number"
}
fieldSearchMetaDataResponseSchema
metaData
Optional

metaData

array of firewallSearchDocumentSchema
data
Required

Data which contains logs for the log search response

number As float As float
count
Optional

Total log count for the log search query


400

Invalid Input

Returns httpResponseError of type(s) application/json 
{
    "errors": [
        {
            "message": "pop(s) for vni: 1 do not exist",
            "path": "object.path",
            "key": "INVALID_PARAMS"
        }
    ],
    "code": "INVALID_PARAMS"
}
array of httpResponseErrorObject
errors
Required

Array for different types of error objects

string
code
Optional

Error code for the message

Possible values are : INTERNAL_ERROR, INVALID_PARAMS, INVALID_QUERY_PARAMS, ALREADY_EXISTS, INVALID_SEARCH_ENDPOINT, INVALID_SEARCH_INPUTS,

401

Unauthorized Access

Returns httpResponseError of type(s) application/json 
{
    "errors": [
        {
            "message": "pop(s) for vni: 1 do not exist",
            "path": "object.path",
            "key": "INVALID_PARAMS"
        }
    ],
    "code": "INVALID_PARAMS"
}
array of httpResponseErrorObject
errors
Required

Array for different types of error objects

string
code
Optional

Error code for the message

Possible values are : INTERNAL_ERROR, INVALID_PARAMS, INVALID_QUERY_PARAMS, ALREADY_EXISTS, INVALID_SEARCH_ENDPOINT, INVALID_SEARCH_INPUTS,

500

Internal Server Error

Returns httpResponseError of type(s) application/json 
{
    "errors": [
        {
            "message": "pop(s) for vni: 1 do not exist",
            "path": "object.path",
            "key": "INVALID_PARAMS"
        }
    ],
    "code": "INVALID_PARAMS"
}
array of httpResponseErrorObject
errors
Required

Array for different types of error objects

string
code
Optional

Error code for the message

Possible values are : INTERNAL_ERROR, INVALID_PARAMS, INVALID_QUERY_PARAMS, ALREADY_EXISTS, INVALID_SEARCH_ENDPOINT, INVALID_SEARCH_INPUTS,

On This Page
Search Operations
GET
Edge Firewall Log Search
GET
Healthcheck
GET
Secure Access Log Search