NSX-T Data Center REST API

Get the summary of the intrusions that were detected. (Removed in 4.1)

Get the summary of all the intrusions that are detected grouped by signature
with details including signature name, id, severity, attack type, protocol,
first and recent occurence, and affected users and VMs.
Deprecated:
Use the following Policy API -
POST /policy/api/v1/infra/settings/firewall/security/intrusion-services/ids-summary

Request:

Method:
POST
URI Path(s):
/api/v1/intrusion-services/ids-summary
Request Headers:
n/a
Query Parameters:
ListRequestParameters+
Request Body:
IDSEventDataRequest+

Example Request:

POST https://<nsx-mgr>/api/v1/intrusion-services/ids-summary { "filters": [ { "field_names": "signature_detail.severity", "value": "(HIGH OR LOW)" } ] }

Successful Response:

Response Code:
200 OK
Response Headers:
Content-type: application/json
Response Body:
IDSSummaryListResult+

Example Response:

{ "results": [ { "signature_id": 4010643, "total_count": 87, "affected_vm_count": 1, "user_details": { "count": 0, "user_list": [] }, "rule_id": 1001, "is_rule_valid": true, "idsflow_details": { "source_ip": "192.168.56.150", "source_port": 49170, "destination_ip": "178.33.233.154", "destination_port": 80, "protocol": "TCP", "profile_id": "491B2D21-4CEA-48E4-A7C0-98D5DDFE65E3-05-26T18:19491B2D214CEA48E4A7C098D5DDFE65E3", "rule_id": 1001, "action_type": "ALERT", "local_vm_ip": "192.168.56.150", "client_ip": "192.168.56.150" }, "signature_metadata": { "resource_type": "IDSSignatureDetail", "signature_id": 4010643, "name": "ET TROJAN [eSentire] Win32/GandCrab v4/5 Ransomware CnC Activity", "class_type": "trojan-activity", "signature_revision": 4, "signature_severity": "Major", "cvssv3": "0.0", "cvssv2": "0.0", "tag": [ "Ransomware" ], "action": "alert", "protocol": "http", "direction": "$HOME_NET any -> $EXTERNAL_NET any", "flow": "", "policy": [ "suricata-ids" ], "type": [ "suricata" ], "affected_product": "Windows_XP_Vista_7_8_10_Server_32_64_Bit", "performance_impact": "Low", "enabled": true, "attack_target": "Client_Endpoint", "malware_family": "GandCrab", "severity": "HIGH", "urls": [] }, "first_occurence": 1590516802000, "latest_occurence": 1590517147000, "resource_type": "IDSEvent" } ], "result_count": 1, "sort_by": "displayName", "sort_ascending": false, "cursor": "1" }

Required Permissions:

read

Feature:

intrusion_services

Additional Errors: