Detect and Respond Context Creation Models

List Context Creation Models

get

Returns an array of Context Creation Models.

Authorizations

BearerAuth

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Responses

200

List of Requested Context Creation Models

application/json

400

Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.

application/json

401

Access token is missing or invalid

application/json

403

Access is forbidden

application/json

default

Unknown Error Occurred

application/json

get

/api/v1/rule-engine/ccms

HTTPcURLJavaScriptPython

GET /api/v1/rule-engine/ccms HTTP/1.1
Host: api.netography.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "meta": {
    "code": 200,
    "count": 1
  },
  "data": [
    {
      "algo_type": "TDM",
      "beta": false,
      "created": 1640995200,
      "id": "127e5619-5c3c-4314-9d74-c11d07c9361e",
      "recommended": false,
      "subscription": {
        "all": "subscribed"
      },
      "subscriptiontype": "optout",
      "system": false,
      "systemdefault": false,
      "updated": 1641995200,
      "action": [
        {
          "type": "label",
          "field": "dstip",
          "context": "func",
          "labels": [
            "Testing"
          ]
        }
      ],
      "bypassdisplay": false,
      "bypassrule": false,
      "categories": [
        "system"
      ],
      "description": "context model description",
      "discards": [
        "bits > 10000"
      ],
      "enabled": true,
      "expiration": 3600,
      "factors": [
        "srcip"
      ],
      "name": "new_ndm_name",
      "rollupperiod": 300,
      "search_by": [
        {
          "search": [
            "bits > 10000"
          ],
          "type": "all"
        }
      ],
      "thresholds": [
        {
          "severity": "medium",
          "threshold": "average(bits) > 500"
        }
      ],
      "track_by": [
        [
          "srcip"
        ]
      ],
      "updateinterval": 0,
      "algo_record_type": "flow"
    }
  ]
}

Create Context Creation Model

post

Creates a context creation model from the data that's been supplied. Do not provide an id. IDs are auto generated

Authorizations

BearerAuth

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Body

application/json

Context Creation Model Create or Update Config

bypassdisplaybooleanOptional

If true, portal and API will not display new events

Example: false

bypassrulebooleanOptional

If true, alerts will not be processed by policies and integrations

Example: false

categoriesstring[]Optional

Categories for the context model

Example: ["system"]

descriptionstringRequired

Context model description

Example: context model description

discardsstring[]Optional

Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the context model

Example: ["bits > 10000"]

enabledbooleanOptional

If true, the context model is enabled

Example: true

expirationintegerRequired

Number of seconds the context creation model will remain active

Example: 3600

factorsstring[]Optional

Factors for the context model

Example: ["srcip"]

namestringRequired

Name of the context model

Example: new_ndm_name

rollupperiodintegerRequired

The lookback period for the context model. Min 15 seconds. Max 1 hour (3600)

Example: 300

updateintervalintegerOptional

When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled

Example: 0

algo_record_typestring · enumRequired

The context of record to be used for the context model

Example: flowPossible values:

Responses

201

Requested Context Creation Model

application/json

400

Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.

application/json

401

Access token is missing or invalid

application/json

403

Access is forbidden

application/json

default

Unknown Error Occurred

application/json

post

/api/v1/rule-engine/ccm

HTTPcURLJavaScriptPython

POST /api/v1/rule-engine/ccm HTTP/1.1
Host: api.netography.com
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 506

{
  "action": [
    {
      "type": "label",
      "field": "dstip",
      "context": "func",
      "labels": [
        "Testing"
      ]
    }
  ],
  "bypassdisplay": false,
  "bypassrule": false,
  "categories": [
    "system"
  ],
  "description": "context model description",
  "discards": [
    "bits > 10000"
  ],
  "enabled": true,
  "expiration": 3600,
  "factors": [
    "srcip"
  ],
  "name": "new_ndm_name",
  "rollupperiod": 300,
  "search_by": [
    {
      "search": [
        "bits > 10000"
      ],
      "type": "all"
    }
  ],
  "thresholds": [
    {
      "severity": "medium",
      "threshold": "average(bits) > 500"
    }
  ],
  "track_by": [
    [
      "srcip"
    ]
  ],
  "updateinterval": 0,
  "algo_record_type": "flow"
}

{
  "meta": {
    "code": 200,
    "count": 1
  },
  "data": [
    {
      "algo_type": "TDM",
      "beta": false,
      "created": 1640995200,
      "id": "127e5619-5c3c-4314-9d74-c11d07c9361e",
      "recommended": false,
      "subscription": {
        "all": "subscribed"
      },
      "subscriptiontype": "optout",
      "system": false,
      "systemdefault": false,
      "updated": 1641995200,
      "action": [
        {
          "type": "label",
          "field": "dstip",
          "context": "func",
          "labels": [
            "Testing"
          ]
        }
      ],
      "bypassdisplay": false,
      "bypassrule": false,
      "categories": [
        "system"
      ],
      "description": "context model description",
      "discards": [
        "bits > 10000"
      ],
      "enabled": true,
      "expiration": 3600,
      "factors": [
        "srcip"
      ],
      "name": "new_ndm_name",
      "rollupperiod": 300,
      "search_by": [
        {
          "search": [
            "bits > 10000"
          ],
          "type": "all"
        }
      ],
      "thresholds": [
        {
          "severity": "medium",
          "threshold": "average(bits) > 500"
        }
      ],
      "track_by": [
        [
          "srcip"
        ]
      ],
      "updateinterval": 0,
      "algo_record_type": "flow"
    }
  ]
}

Fetch Context Creation Model

get

Fetches a specific context creation model from the ID supplied in the path.

Authorizations

BearerAuth

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

idstringRequired

The ID of the context creation model to be returned.

Responses

200

Requested Context Creation Model

application/json

400

Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.

application/json

401

Access token is missing or invalid

application/json

403

Access is forbidden

application/json

default

Unknown Error Occurred

application/json

get

/api/v1/rule-engine/ccm/{id}

HTTPcURLJavaScriptPython

GET /api/v1/rule-engine/ccm/{id} HTTP/1.1
Host: api.netography.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "meta": {
    "code": 200,
    "count": 1
  },
  "data": [
    {
      "algo_type": "TDM",
      "beta": false,
      "created": 1640995200,
      "id": "127e5619-5c3c-4314-9d74-c11d07c9361e",
      "recommended": false,
      "subscription": {
        "all": "subscribed"
      },
      "subscriptiontype": "optout",
      "system": false,
      "systemdefault": false,
      "updated": 1641995200,
      "action": [
        {
          "type": "label",
          "field": "dstip",
          "context": "func",
          "labels": [
            "Testing"
          ]
        }
      ],
      "bypassdisplay": false,
      "bypassrule": false,
      "categories": [
        "system"
      ],
      "description": "context model description",
      "discards": [
        "bits > 10000"
      ],
      "enabled": true,
      "expiration": 3600,
      "factors": [
        "srcip"
      ],
      "name": "new_ndm_name",
      "rollupperiod": 300,
      "search_by": [
        {
          "search": [
            "bits > 10000"
          ],
          "type": "all"
        }
      ],
      "thresholds": [
        {
          "severity": "medium",
          "threshold": "average(bits) > 500"
        }
      ],
      "track_by": [
        [
          "srcip"
        ]
      ],
      "updateinterval": 0,
      "algo_record_type": "flow"
    }
  ]
}

Update Context Creation Model

put

Update a context creation model given the provided object. This does not do a diff. You must send the complete object.

Authorizations

BearerAuth

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

idstringRequired

The ID of the context creation model to be updated

Body

application/json

Context Creation Model Create or Update Config

bypassdisplaybooleanOptional

If true, portal and API will not display new events

Example: false

bypassrulebooleanOptional

If true, alerts will not be processed by policies and integrations

Example: false

categoriesstring[]Optional

Categories for the context model

Example: ["system"]

descriptionstringRequired

Context model description

Example: context model description

discardsstring[]Optional

Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the context model

Example: ["bits > 10000"]

enabledbooleanOptional

If true, the context model is enabled

Example: true

expirationintegerRequired

Number of seconds the context creation model will remain active

Example: 3600

factorsstring[]Optional

Factors for the context model

Example: ["srcip"]

namestringRequired

Name of the context model

Example: new_ndm_name

rollupperiodintegerRequired

The lookback period for the context model. Min 15 seconds. Max 1 hour (3600)

Example: 300

updateintervalintegerOptional

When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled

Example: 0

algo_record_typestring · enumRequired

The context of record to be used for the context model

Example: flowPossible values:

Responses

200

Requested Context Creation Model

application/json

400

Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.

application/json

401

Access token is missing or invalid

application/json

403

Access is forbidden

application/json

default

Unknown Error Occurred

application/json

put

/api/v1/rule-engine/ccm/{id}

HTTPcURLJavaScriptPython

PUT /api/v1/rule-engine/ccm/{id} HTTP/1.1
Host: api.netography.com
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 506

{
  "action": [
    {
      "type": "label",
      "field": "dstip",
      "context": "func",
      "labels": [
        "Testing"
      ]
    }
  ],
  "bypassdisplay": false,
  "bypassrule": false,
  "categories": [
    "system"
  ],
  "description": "context model description",
  "discards": [
    "bits > 10000"
  ],
  "enabled": true,
  "expiration": 3600,
  "factors": [
    "srcip"
  ],
  "name": "new_ndm_name",
  "rollupperiod": 300,
  "search_by": [
    {
      "search": [
        "bits > 10000"
      ],
      "type": "all"
    }
  ],
  "thresholds": [
    {
      "severity": "medium",
      "threshold": "average(bits) > 500"
    }
  ],
  "track_by": [
    [
      "srcip"
    ]
  ],
  "updateinterval": 0,
  "algo_record_type": "flow"
}

{
  "meta": {
    "code": 200,
    "count": 1
  },
  "data": [
    {
      "algo_type": "TDM",
      "beta": false,
      "created": 1640995200,
      "id": "127e5619-5c3c-4314-9d74-c11d07c9361e",
      "recommended": false,
      "subscription": {
        "all": "subscribed"
      },
      "subscriptiontype": "optout",
      "system": false,
      "systemdefault": false,
      "updated": 1641995200,
      "action": [
        {
          "type": "label",
          "field": "dstip",
          "context": "func",
          "labels": [
            "Testing"
          ]
        }
      ],
      "bypassdisplay": false,
      "bypassrule": false,
      "categories": [
        "system"
      ],
      "description": "context model description",
      "discards": [
        "bits > 10000"
      ],
      "enabled": true,
      "expiration": 3600,
      "factors": [
        "srcip"
      ],
      "name": "new_ndm_name",
      "rollupperiod": 300,
      "search_by": [
        {
          "search": [
            "bits > 10000"
          ],
          "type": "all"
        }
      ],
      "thresholds": [
        {
          "severity": "medium",
          "threshold": "average(bits) > 500"
        }
      ],
      "track_by": [
        [
          "srcip"
        ]
      ],
      "updateinterval": 0,
      "algo_record_type": "flow"
    }
  ]
}

Delete Context Creation Model

delete

Deletes a context creation model

Authorizations

BearerAuth

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

idstringRequired

The ID of the context creation model to be deleted

Responses

204

An empty array

400

Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.

application/json

401

Access token is missing or invalid

application/json

403

Access is forbidden

application/json

default

Unknown Error Occurred

application/json

delete

/api/v1/rule-engine/ccm/{id}

HTTPcURLJavaScriptPython

DELETE /api/v1/rule-engine/ccm/{id} HTTP/1.1
Host: api.netography.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

No content

Enable Context Creation Model

put

Enables a context creation model

Authorizations

BearerAuth

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

idstringRequired

The ID of the context creation model to be enabled

Responses

200

Requested Context Creation Model

application/json

400

Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.

application/json

401

Access token is missing or invalid

application/json

403

Access is forbidden

application/json

default

Unknown Error Occurred

application/json

put

/api/v1/rule-engine/ccm/{id}/enable

HTTPcURLJavaScriptPython

PUT /api/v1/rule-engine/ccm/{id}/enable HTTP/1.1
Host: api.netography.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "meta": {
    "code": 200,
    "count": 1
  },
  "data": [
    {
      "algo_type": "TDM",
      "beta": false,
      "created": 1640995200,
      "id": "127e5619-5c3c-4314-9d74-c11d07c9361e",
      "recommended": false,
      "subscription": {
        "all": "subscribed"
      },
      "subscriptiontype": "optout",
      "system": false,
      "systemdefault": false,
      "updated": 1641995200,
      "action": [
        {
          "type": "label",
          "field": "dstip",
          "context": "func",
          "labels": [
            "Testing"
          ]
        }
      ],
      "bypassdisplay": false,
      "bypassrule": false,
      "categories": [
        "system"
      ],
      "description": "context model description",
      "discards": [
        "bits > 10000"
      ],
      "enabled": true,
      "expiration": 3600,
      "factors": [
        "srcip"
      ],
      "name": "new_ndm_name",
      "rollupperiod": 300,
      "search_by": [
        {
          "search": [
            "bits > 10000"
          ],
          "type": "all"
        }
      ],
      "thresholds": [
        {
          "severity": "medium",
          "threshold": "average(bits) > 500"
        }
      ],
      "track_by": [
        [
          "srcip"
        ]
      ],
      "updateinterval": 0,
      "algo_record_type": "flow"
    }
  ]
}

Disable Context Creation Model

put

Disables a context creation model

Authorizations

BearerAuth

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

idstringRequired

The ID of the context creation model to be disabled

Responses

200

Requested Context Creation Model

application/json

400

Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.

application/json

401

Access token is missing or invalid

application/json

403

Access is forbidden

application/json

default

Unknown Error Occurred

application/json

put

/api/v1/rule-engine/ccm/{id}/disable

HTTPcURLJavaScriptPython

PUT /api/v1/rule-engine/ccm/{id}/disable HTTP/1.1
Host: api.netography.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "meta": {
    "code": 200,
    "count": 1
  },
  "data": [
    {
      "algo_type": "TDM",
      "beta": false,
      "created": 1640995200,
      "id": "127e5619-5c3c-4314-9d74-c11d07c9361e",
      "recommended": false,
      "subscription": {
        "all": "subscribed"
      },
      "subscriptiontype": "optout",
      "system": false,
      "systemdefault": false,
      "updated": 1641995200,
      "action": [
        {
          "type": "label",
          "field": "dstip",
          "context": "func",
          "labels": [
            "Testing"
          ]
        }
      ],
      "bypassdisplay": false,
      "bypassrule": false,
      "categories": [
        "system"
      ],
      "description": "context model description",
      "discards": [
        "bits > 10000"
      ],
      "enabled": true,
      "expiration": 3600,
      "factors": [
        "srcip"
      ],
      "name": "new_ndm_name",
      "rollupperiod": 300,
      "search_by": [
        {
          "search": [
            "bits > 10000"
          ],
          "type": "all"
        }
      ],
      "thresholds": [
        {
          "severity": "medium",
          "threshold": "average(bits) > 500"
        }
      ],
      "track_by": [
        [
          "srcip"
        ]
      ],
      "updateinterval": 0,
      "algo_record_type": "flow"
    }
  ]
}

Reset Context Creation Model

put

Resets a customized system context creation model

Authorizations

BearerAuth

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

idstringRequired

The ID of the context creation model to be reseted

Responses

200

Requested Context Creation Model

application/json

400

Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.

application/json

401

Access token is missing or invalid

application/json

403

Access is forbidden

application/json

default

Unknown Error Occurred

application/json

put

/api/v1/rule-engine/ccm/{id}/reset

HTTPcURLJavaScriptPython

PUT /api/v1/rule-engine/ccm/{id}/reset HTTP/1.1
Host: api.netography.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "meta": {
    "code": 200,
    "count": 1
  },
  "data": [
    {
      "algo_type": "TDM",
      "beta": false,
      "created": 1640995200,
      "id": "127e5619-5c3c-4314-9d74-c11d07c9361e",
      "recommended": false,
      "subscription": {
        "all": "subscribed"
      },
      "subscriptiontype": "optout",
      "system": false,
      "systemdefault": false,
      "updated": 1641995200,
      "action": [
        {
          "type": "label",
          "field": "dstip",
          "context": "func",
          "labels": [
            "Testing"
          ]
        }
      ],
      "bypassdisplay": false,
      "bypassrule": false,
      "categories": [
        "system"
      ],
      "description": "context model description",
      "discards": [
        "bits > 10000"
      ],
      "enabled": true,
      "expiration": 3600,
      "factors": [
        "srcip"
      ],
      "name": "new_ndm_name",
      "rollupperiod": 300,
      "search_by": [
        {
          "search": [
            "bits > 10000"
          ],
          "type": "all"
        }
      ],
      "thresholds": [
        {
          "severity": "medium",
          "threshold": "average(bits) > 500"
        }
      ],
      "track_by": [
        [
          "srcip"
        ]
      ],
      "updateinterval": 0,
      "algo_record_type": "flow"
    }
  ]
}