NSX-T Data Center REST API

Get the list of the IDS events that are detected, grouped by signature id. (Deprecated)

Get the list of the IDS events that are detected with the total number of
intrusions detected, their severity and the time they occurred,
grouped by signature id.
Deprecated:
Use the following Policy API -
POST /policy/api/v1/infra/settings/firewall/security/intrusion-services/ids-events

Request:

Method:
POST
URI Path(s):
/api/v1/intrusion-services/ids-events
Request Headers:
n/a
Query Parameters:
n/a
Request Body:
IDSEventDataRequest+

Example Request:

POST https://<nsx-mgr>/api/v1/intrusion-services/ids-events { "filters": [ { "field_names": "signature_detail.severity", "value": "HIGH OR CRITICAL" } ] }

Successful Response:

Response Code:
200 OK
Response Headers:
Content-type: application/json
Response Body:
IDSEventsBySignatureResult+

Example Response:

{ "results": [ { "signature_id": 4010643, "signature_name": "ET TROJAN [eSentire] Win32/GandCrab v4/5 Ransomware CnC Activity", "severity": "HIGH", "count": 87, "first_occurence": 1590516802000, "resource_type": "IDSEvent" }, { "signature_id": 4101968, "signature_name": "SLR Alert - GrandCrabv5 Ransomware Infection - POST to CnC", "severity": "CRITICAL", "count": 1002, "first_occurence": 1590516798000, "resource_type": "IDSEvent" } ] }

Required Permissions:

read

Feature:

intrusion_services

Additional Errors: