Management Plane API > Security > Intrusion Services > Dashboard

Get the summary of the intrusions that were detected.

Get the summary of all the intrusions that are detected grouped by signature
with details including signature name, id, severity, attack type, protocol,
first and recent occurence, and affected users and VMs.

Request:

Method:
POST
URI Path(s):
/api/v1/intrusion-services/ids-summary
Request Headers:
n/a
Query Parameters:
ListRequestParameters+
Request Body:
IDSEventDataRequest+

Example Request:

POST https://<nsx-mgr>/api/v1/intrusion-services/ids-summary { "filters": [ { "field_names": "severity", "value": "Major" } ] }

Successful Response:

Response Code:
200 OK
Response Headers:
Content-type: application/json
Response Body:
IDSSummaryListResult+

Example Response:

{ { "resource_type" : "IDSEvent", "signature_id" : 4102226, "total_count" : 3, "vm_details" : { "count" : 3, "vm_list" : [ "1-vm_VM-WIN8-x86-Latest-local-1820", "2-vm_VM-WIN8-x86-Latest-local-1820", "3-vm_VM-WIN8-x86-Latest-local-1820" ] }, "user_details": { "count" : 2, "user_list" : [ "S-1-5-21-992878714-4041223874-2616370337-1001", "S-1-5-21-7375663-6890924511-1272660413-2944159" ] }, "rule_id" : 1004, "source" : "2.2.2.2, "first_occurence" : "15592396731123", "latest_occurence" : "155923967455400", "signature_metadata": { "signature_name" : "SLR Alert - Netwire RAT Heartbeat", "severity" : "Major", "product_affected" : "None, "protocol" : "HTTP", "port" : 80, "attack_type" : "trojan-activity", "attack_target" : "None, "direction" : "Client to Server", "revision" : 1, "cvssv2": "0.0", "cvssv3" : "0.0", "cve" : [] } }, { "resource_type" : "IDSEvent", "signature_id" : 4102488, "total_count" : 3, "vm_details" : { "count" : 3, "vm_list" : [ "1-vm_VM-WIN8-x86-Latest-local-1820", "2-vm_VM-WIN8-x86-Latest-local-1820", "3-vm_VM-WIN8-x86-Latest-local-1820" ] }, "user_details": { "count" : 2, "user_list" : [ "S-1-5-21-992878714-4041223874-2616370337-1001", "S-1-5-21-7375663-6890924511-1272660413-2944159" ] }, "rule_id" : 1000, "source" : "1.1.1.1", "first_occurence" : "15592396731123", "latest_occurence" : "155923967455400", "signature_metadata": { "signature_name" : "SLR Alert - Oracle Weblogic Server 'AsyncResponseService' Deserialization Remote Code Execution", "severity" : "Major", "revision" : 1, "product_affected" : "Oracle_Weblogic, "protocol" : "HTTP", "port" : 80, "attack_type" : "web-application-attack", "attack_target" : "Web_Server", "direction" : "Client to Server", "cvssv2": "7.5", "cvssv3" : "9.8", "cve" : [ "2019-2725" ] } } }

Required Permissions:

read

Feature:

intrusion_services

Additional Errors: