Detect And Respond Context Creation Models

List Context Creation Models

get

Returns an array of Context Creation Models.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Responses

200

List of Requested Context Creation Models

application/json

400

Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.

application/json

401

Access token is missing or invalid

application/json

403

Access is forbidden

application/json

default

Unknown Error Occurred

application/json

get/api/v1/rule-engine/ccms

GET /api/v1/rule-engine/ccms HTTP/1.1
Host: api.netography.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "meta": {
    "code": 200,
    "count": 1
  },
  "data": [
    {
      "algo_type": "TDM",
      "beta": false,
      "created": 1640995200,
      "id": "127e5619-5c3c-4314-9d74-c11d07c9361e",
      "recommended": false,
      "subscription": {
        "all": "subscribed"
      },
      "subscriptiontype": "optout",
      "system": false,
      "systemdefault": false,
      "updated": 1641995200,
      "action": [
        {
          "type": "label",
          "field": "dstip",
          "context": "func",
          "labels": [
            "Testing"
          ]
        }
      ],
      "bypassdisplay": false,
      "bypassrule": false,
      "categories": [
        "system"
      ],
      "description": "context model description",
      "discards": [
        "bits > 10000"
      ],
      "enabled": true,
      "expiration": 3600,
      "factors": [
        "srcip"
      ],
      "name": "new_ndm_name",
      "rollupperiod": 300,
      "search_by": [
        {
          "search": [
            "bits > 10000"
          ],
          "type": "all"
        }
      ],
      "thresholds": [
        {
          "severity": "medium",
          "threshold": "average(bits) > 500"
        }
      ],
      "track_by": [
        [
          "srcip"
        ]
      ],
      "updateinterval": 0,
      "algo_record_type": "flow"
    }
  ]
}

Create Context Creation Model

post

Creates a context creation model from the data that's been supplied. Do not provide an id. IDs are auto generated

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Body

Context Creation Model Create or Update Config

bypassdisplaybooleanOptional

If true, portal and API will not display new events

Example: false

bypassrulebooleanOptional

If true, alerts will not be processed by policies and integrations

Example: false

categoriesstring[]Optional

Categories for the context model

Example: ["system"]

descriptionstringRequired

Context model description

Example: context model description

discardsstring[]Optional

Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the context model

Example: ["bits > 10000"]

enabledbooleanOptional

If true, the context model is enabled

Example: true

expirationintegerRequired

Number of seconds the context creation model will remain active

Example: 3600

factorsstring[]Optional

Factors for the context model

Example: ["srcip"]

namestringRequired

Name of the context model

Example: new_ndm_name

rollupperiodintegerRequired

The lookback period for the context model. Min 15 seconds. Max 1 hour (3600)

Example: 300

updateintervalintegerOptional

When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled

Example: 0

algo_record_typestring · enumRequired

The context of record to be used for the context model

Example: flowPossible values:

Responses

201

Requested Context Creation Model

application/json

400

Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.

application/json

401

Access token is missing or invalid

application/json

403

Access is forbidden

application/json

default

Unknown Error Occurred

application/json

post/api/v1/rule-engine/ccm

POST /api/v1/rule-engine/ccm HTTP/1.1
Host: api.netography.com
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 506

{
  "action": [
    {
      "type": "label",
      "field": "dstip",
      "context": "func",
      "labels": [
        "Testing"
      ]
    }
  ],
  "bypassdisplay": false,
  "bypassrule": false,
  "categories": [
    "system"
  ],
  "description": "context model description",
  "discards": [
    "bits > 10000"
  ],
  "enabled": true,
  "expiration": 3600,
  "factors": [
    "srcip"
  ],
  "name": "new_ndm_name",
  "rollupperiod": 300,
  "search_by": [
    {
      "search": [
        "bits > 10000"
      ],
      "type": "all"
    }
  ],
  "thresholds": [
    {
      "severity": "medium",
      "threshold": "average(bits) > 500"
    }
  ],
  "track_by": [
    [
      "srcip"
    ]
  ],
  "updateinterval": 0,
  "algo_record_type": "flow"
}

{
  "meta": {
    "code": 200,
    "count": 1
  },
  "data": [
    {
      "algo_type": "TDM",
      "beta": false,
      "created": 1640995200,
      "id": "127e5619-5c3c-4314-9d74-c11d07c9361e",
      "recommended": false,
      "subscription": {
        "all": "subscribed"
      },
      "subscriptiontype": "optout",
      "system": false,
      "systemdefault": false,
      "updated": 1641995200,
      "action": [
        {
          "type": "label",
          "field": "dstip",
          "context": "func",
          "labels": [
            "Testing"
          ]
        }
      ],
      "bypassdisplay": false,
      "bypassrule": false,
      "categories": [
        "system"
      ],
      "description": "context model description",
      "discards": [
        "bits > 10000"
      ],
      "enabled": true,
      "expiration": 3600,
      "factors": [
        "srcip"
      ],
      "name": "new_ndm_name",
      "rollupperiod": 300,
      "search_by": [
        {
          "search": [
            "bits > 10000"
          ],
          "type": "all"
        }
      ],
      "thresholds": [
        {
          "severity": "medium",
          "threshold": "average(bits) > 500"
        }
      ],
      "track_by": [
        [
          "srcip"
        ]
      ],
      "updateinterval": 0,
      "algo_record_type": "flow"
    }
  ]
}

Fetch Context Creation Model

get

Fetches a specific context creation model from the ID supplied in the path.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

idstringRequired

The ID of the context creation model to be returned.

Responses

200

Requested Context Creation Model

application/json

400

Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.

application/json

401

Access token is missing or invalid

application/json

403

Access is forbidden

application/json

default

Unknown Error Occurred

application/json

get/api/v1/rule-engine/ccm/{id}

GET /api/v1/rule-engine/ccm/{id} HTTP/1.1
Host: api.netography.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "meta": {
    "code": 200,
    "count": 1
  },
  "data": [
    {
      "algo_type": "TDM",
      "beta": false,
      "created": 1640995200,
      "id": "127e5619-5c3c-4314-9d74-c11d07c9361e",
      "recommended": false,
      "subscription": {
        "all": "subscribed"
      },
      "subscriptiontype": "optout",
      "system": false,
      "systemdefault": false,
      "updated": 1641995200,
      "action": [
        {
          "type": "label",
          "field": "dstip",
          "context": "func",
          "labels": [
            "Testing"
          ]
        }
      ],
      "bypassdisplay": false,
      "bypassrule": false,
      "categories": [
        "system"
      ],
      "description": "context model description",
      "discards": [
        "bits > 10000"
      ],
      "enabled": true,
      "expiration": 3600,
      "factors": [
        "srcip"
      ],
      "name": "new_ndm_name",
      "rollupperiod": 300,
      "search_by": [
        {
          "search": [
            "bits > 10000"
          ],
          "type": "all"
        }
      ],
      "thresholds": [
        {
          "severity": "medium",
          "threshold": "average(bits) > 500"
        }
      ],
      "track_by": [
        [
          "srcip"
        ]
      ],
      "updateinterval": 0,
      "algo_record_type": "flow"
    }
  ]
}

Update Context Creation Model

put

Update a context creation model given the provided object. This does not do a diff. You must send the complete object.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

idstringRequired

The ID of the context creation model to be updated

Body

Context Creation Model Create or Update Config

bypassdisplaybooleanOptional

If true, portal and API will not display new events

Example: false

bypassrulebooleanOptional

If true, alerts will not be processed by policies and integrations

Example: false

categoriesstring[]Optional

Categories for the context model

Example: ["system"]

descriptionstringRequired

Context model description

Example: context model description

discardsstring[]Optional

Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the context model

Example: ["bits > 10000"]

enabledbooleanOptional

If true, the context model is enabled

Example: true

expirationintegerRequired

Number of seconds the context creation model will remain active

Example: 3600

factorsstring[]Optional

Factors for the context model

Example: ["srcip"]

namestringRequired

Name of the context model

Example: new_ndm_name

rollupperiodintegerRequired

The lookback period for the context model. Min 15 seconds. Max 1 hour (3600)

Example: 300

updateintervalintegerOptional

When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled

Example: 0

algo_record_typestring · enumRequired

The context of record to be used for the context model

Example: flowPossible values:

Responses

200

Requested Context Creation Model

application/json

400

Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.

application/json

401

Access token is missing or invalid

application/json

403

Access is forbidden

application/json

default

Unknown Error Occurred

application/json

put/api/v1/rule-engine/ccm/{id}

PUT /api/v1/rule-engine/ccm/{id} HTTP/1.1
Host: api.netography.com
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 506

{
  "action": [
    {
      "type": "label",
      "field": "dstip",
      "context": "func",
      "labels": [
        "Testing"
      ]
    }
  ],
  "bypassdisplay": false,
  "bypassrule": false,
  "categories": [
    "system"
  ],
  "description": "context model description",
  "discards": [
    "bits > 10000"
  ],
  "enabled": true,
  "expiration": 3600,
  "factors": [
    "srcip"
  ],
  "name": "new_ndm_name",
  "rollupperiod": 300,
  "search_by": [
    {
      "search": [
        "bits > 10000"
      ],
      "type": "all"
    }
  ],
  "thresholds": [
    {
      "severity": "medium",
      "threshold": "average(bits) > 500"
    }
  ],
  "track_by": [
    [
      "srcip"
    ]
  ],
  "updateinterval": 0,
  "algo_record_type": "flow"
}

{
  "meta": {
    "code": 200,
    "count": 1
  },
  "data": [
    {
      "algo_type": "TDM",
      "beta": false,
      "created": 1640995200,
      "id": "127e5619-5c3c-4314-9d74-c11d07c9361e",
      "recommended": false,
      "subscription": {
        "all": "subscribed"
      },
      "subscriptiontype": "optout",
      "system": false,
      "systemdefault": false,
      "updated": 1641995200,
      "action": [
        {
          "type": "label",
          "field": "dstip",
          "context": "func",
          "labels": [
            "Testing"
          ]
        }
      ],
      "bypassdisplay": false,
      "bypassrule": false,
      "categories": [
        "system"
      ],
      "description": "context model description",
      "discards": [
        "bits > 10000"
      ],
      "enabled": true,
      "expiration": 3600,
      "factors": [
        "srcip"
      ],
      "name": "new_ndm_name",
      "rollupperiod": 300,
      "search_by": [
        {
          "search": [
            "bits > 10000"
          ],
          "type": "all"
        }
      ],
      "thresholds": [
        {
          "severity": "medium",
          "threshold": "average(bits) > 500"
        }
      ],
      "track_by": [
        [
          "srcip"
        ]
      ],
      "updateinterval": 0,
      "algo_record_type": "flow"
    }
  ]
}

Delete Context Creation Model

delete

Deletes a context creation model

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

idstringRequired

The ID of the context creation model to be deleted

Responses

204

An empty array

No content

400

Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.

application/json

401

Access token is missing or invalid

application/json

403

Access is forbidden

application/json

default

Unknown Error Occurred

application/json

delete/api/v1/rule-engine/ccm/{id}

DELETE /api/v1/rule-engine/ccm/{id} HTTP/1.1
Host: api.netography.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

No content

Enable Context Creation Model

put

Enables a context creation model

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

idstringRequired

The ID of the context creation model to be enabled

Responses

200

Requested Context Creation Model

application/json

400

Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.

application/json

401

Access token is missing or invalid

application/json

403

Access is forbidden

application/json

default

Unknown Error Occurred

application/json

put/api/v1/rule-engine/ccm/{id}/enable

PUT /api/v1/rule-engine/ccm/{id}/enable HTTP/1.1
Host: api.netography.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "meta": {
    "code": 200,
    "count": 1
  },
  "data": [
    {
      "algo_type": "TDM",
      "beta": false,
      "created": 1640995200,
      "id": "127e5619-5c3c-4314-9d74-c11d07c9361e",
      "recommended": false,
      "subscription": {
        "all": "subscribed"
      },
      "subscriptiontype": "optout",
      "system": false,
      "systemdefault": false,
      "updated": 1641995200,
      "action": [
        {
          "type": "label",
          "field": "dstip",
          "context": "func",
          "labels": [
            "Testing"
          ]
        }
      ],
      "bypassdisplay": false,
      "bypassrule": false,
      "categories": [
        "system"
      ],
      "description": "context model description",
      "discards": [
        "bits > 10000"
      ],
      "enabled": true,
      "expiration": 3600,
      "factors": [
        "srcip"
      ],
      "name": "new_ndm_name",
      "rollupperiod": 300,
      "search_by": [
        {
          "search": [
            "bits > 10000"
          ],
          "type": "all"
        }
      ],
      "thresholds": [
        {
          "severity": "medium",
          "threshold": "average(bits) > 500"
        }
      ],
      "track_by": [
        [
          "srcip"
        ]
      ],
      "updateinterval": 0,
      "algo_record_type": "flow"
    }
  ]
}

Disable Context Creation Model

put

Disables a context creation model

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

idstringRequired

The ID of the context creation model to be disabled

Responses

200

Requested Context Creation Model

application/json

400

Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.

application/json

401

Access token is missing or invalid

application/json

403

Access is forbidden

application/json

default

Unknown Error Occurred

application/json

put/api/v1/rule-engine/ccm/{id}/disable

PUT /api/v1/rule-engine/ccm/{id}/disable HTTP/1.1
Host: api.netography.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "meta": {
    "code": 200,
    "count": 1
  },
  "data": [
    {
      "algo_type": "TDM",
      "beta": false,
      "created": 1640995200,
      "id": "127e5619-5c3c-4314-9d74-c11d07c9361e",
      "recommended": false,
      "subscription": {
        "all": "subscribed"
      },
      "subscriptiontype": "optout",
      "system": false,
      "systemdefault": false,
      "updated": 1641995200,
      "action": [
        {
          "type": "label",
          "field": "dstip",
          "context": "func",
          "labels": [
            "Testing"
          ]
        }
      ],
      "bypassdisplay": false,
      "bypassrule": false,
      "categories": [
        "system"
      ],
      "description": "context model description",
      "discards": [
        "bits > 10000"
      ],
      "enabled": true,
      "expiration": 3600,
      "factors": [
        "srcip"
      ],
      "name": "new_ndm_name",
      "rollupperiod": 300,
      "search_by": [
        {
          "search": [
            "bits > 10000"
          ],
          "type": "all"
        }
      ],
      "thresholds": [
        {
          "severity": "medium",
          "threshold": "average(bits) > 500"
        }
      ],
      "track_by": [
        [
          "srcip"
        ]
      ],
      "updateinterval": 0,
      "algo_record_type": "flow"
    }
  ]
}

Reset Context Creation Model

put

Resets a customized system context creation model

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

idstringRequired

The ID of the context creation model to be reseted

Responses

200

Requested Context Creation Model

application/json

400

Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.

application/json

401

Access token is missing or invalid

application/json

403

Access is forbidden

application/json

default

Unknown Error Occurred

application/json

put/api/v1/rule-engine/ccm/{id}/reset

PUT /api/v1/rule-engine/ccm/{id}/reset HTTP/1.1
Host: api.netography.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "meta": {
    "code": 200,
    "count": 1
  },
  "data": [
    {
      "algo_type": "TDM",
      "beta": false,
      "created": 1640995200,
      "id": "127e5619-5c3c-4314-9d74-c11d07c9361e",
      "recommended": false,
      "subscription": {
        "all": "subscribed"
      },
      "subscriptiontype": "optout",
      "system": false,
      "systemdefault": false,
      "updated": 1641995200,
      "action": [
        {
          "type": "label",
          "field": "dstip",
          "context": "func",
          "labels": [
            "Testing"
          ]
        }
      ],
      "bypassdisplay": false,
      "bypassrule": false,
      "categories": [
        "system"
      ],
      "description": "context model description",
      "discards": [
        "bits > 10000"
      ],
      "enabled": true,
      "expiration": 3600,
      "factors": [
        "srcip"
      ],
      "name": "new_ndm_name",
      "rollupperiod": 300,
      "search_by": [
        {
          "search": [
            "bits > 10000"
          ],
          "type": "all"
        }
      ],
      "thresholds": [
        {
          "severity": "medium",
          "threshold": "average(bits) > 500"
        }
      ],
      "track_by": [
        [
          "srcip"
        ]
      ],
      "updateinterval": 0,
      "algo_record_type": "flow"
    }
  ]
}