Policy > Security > East West Security > Distributed IDS

Associated URIs:

API Description API Path

List IDS security policies


List intrusion detection system security policies.
GET /policy/api/v1/infra/domains/<domain-id>/intrusion-service-policies

Get IDS/IPS rule statistics


Get statistics of a IDS/IPS rule.
- no enforcement point path specified: Stats will be evaluated on each enforcement
point.
- {enforcement_point_path}: Stats are evaluated only on the given enforcement point.
GET /policy/api/v1/infra/domains/<domain-id>/intrusion-service-policies/<ids-policy-id>/rules/<rule-id>/statistics

Get IDS security policy statistics


Get statistics of a IDS security policy.
- no enforcement point path specified: Stats will be evaluated on each enforcement
point.
- {enforcement_point_path}: Stats are evaluated only on the given enforcement point.
GET /policy/api/v1/infra/domains/<domain-id>/intrusion-service-policies/<ids-policy-id>/statistics

Delete IDS security policy


Delete intrusion detection system security policy.
DELETE /policy/api/v1/infra/domains/<domain-id>/intrusion-service-policies/<policy-id>

Get IDS security policy.


Read intrusion detection system security policy.
GET /policy/api/v1/infra/domains/<domain-id>/intrusion-service-policies/<policy-id>

Patch IDS security policy


Patch intrusion detection system security policy for a domain.
PATCH /policy/api/v1/infra/domains/<domain-id>/intrusion-service-policies/<policy-id>

Revise the positioning of IDS security policies


This is used to set a precedence of a security policy w.r.t others.
POST /policy/api/v1/infra/domains/<domain-id>/intrusion-service-policies/<policy-id>?action=revise

create or update IDS security policy


Update intrusion detection system security policy for a domain.
PUT /policy/api/v1/infra/domains/<domain-id>/intrusion-service-policies/<policy-id>

List IDS rules


List intrusion detection rules.
GET /policy/api/v1/infra/domains/<domain-id>/intrusion-service-policies/<policy-id>/rules

Delete IDS rule


Delete intrusion detection rule.
DELETE /policy/api/v1/infra/domains/<domain-id>/intrusion-service-policies/<policy-id>/rules/<rule-id>

Get IDS rule.


Read intrusion detection rule
GET /policy/api/v1/infra/domains/<domain-id>/intrusion-service-policies/<policy-id>/rules/<rule-id>

Patch IDS rule


Patch intrusion detection system rule.
PATCH /policy/api/v1/infra/domains/<domain-id>/intrusion-service-policies/<policy-id>/rules/<rule-id>

Revise the positioning of IDS rule


This is used to re-order a rule within a security policy.
POST /policy/api/v1/infra/domains/<domain-id>/intrusion-service-policies/<policy-id>/rules/<rule-id>?action=revise

create or update IDS rule


Update intrusion detection system rule.
PUT /policy/api/v1/infra/domains/<domain-id>/intrusion-service-policies/<policy-id>/rules/<rule-id>

Get IDS system settings


Intrusion detection system settings.
GET /policy/api/v1/infra/settings/firewall/security/intrusion-services

Patch Intrusion detection system settings


Intrusion detection system settings.
PATCH /policy/api/v1/infra/settings/firewall/security/intrusion-services

Update Intrusion detection system settings


Intrusion detection system settings.
PUT /policy/api/v1/infra/settings/firewall/security/intrusion-services

Get the list of the IPs affected for that signature for intrusion events detected on gateway


Get the list of IP addresses affected pertaining to a specific
signature for intrusion events detected on gateway.
POST /policy/api/v1/infra/settings/firewall/security/intrusion-services/affected-ips

Get the list of the users affected for that signature


Get the list of the users affected pertaining to a specific
signature.
POST /policy/api/v1/infra/settings/firewall/security/intrusion-services/affected-users

Get the list of the VMs affected for that signature


Get the list of the VMs affected pertaining to a specific
signature.
POST /policy/api/v1/infra/settings/firewall/security/intrusion-services/affected-vms

List IDS cluster configs


List intrusion detection system cluster configs.
GET /policy/api/v1/infra/settings/firewall/security/intrusion-services/cluster-configs

Read IDS cluster config.


Read intrusion detection system cluster config
GET /policy/api/v1/infra/settings/firewall/security/intrusion-services/cluster-configs/<cluster-config-id>

Patch IDS config on cluster level


Patch intrusion detection system on cluster level.
PATCH /policy/api/v1/infra/settings/firewall/security/intrusion-services/cluster-configs/<cluster-config-id>

create or update IDS config on cluster level


Update intrusion detection system on cluster level.
PUT /policy/api/v1/infra/settings/firewall/security/intrusion-services/cluster-configs/<cluster-config-id>

List Global IDS signatures


List global intrusion detection signatures.
GET /policy/api/v1/infra/settings/firewall/security/intrusion-services/global-signatures

Delete Global IDS signature


Delete global intrusion detection signature.
DELETE /policy/api/v1/infra/settings/firewall/security/intrusion-services/global-signatures/<signature-id>

Get Global IDS signature.


Read global intrusion detection signature
GET /policy/api/v1/infra/settings/firewall/security/intrusion-services/global-signatures/<signature-id>

Patch Global IDS Signature


Patch global intrusion detection system signature.
PATCH /policy/api/v1/infra/settings/firewall/security/intrusion-services/global-signatures/<signature-id>

create or update Global IDS Signature


Update global intrusion detection signature.
PUT /policy/api/v1/infra/settings/firewall/security/intrusion-services/global-signatures/<signature-id>

Get the list of the IDS events that are detected, grouped by signature id.


Get the list of the IDS events that are detected with the total number of
intrusions detected, their severity and the time they occurred,
grouped by signature id.
POST /policy/api/v1/infra/settings/firewall/security/intrusion-services/ids-events

Read IDS config


Read intrusion detection system config of standalone hosts.
GET /policy/api/v1/infra/settings/firewall/security/intrusion-services/ids-standalone-host-config

Patch IDS configuration


Patch intrusion detection system configuration on standalone hosts.
PATCH /policy/api/v1/infra/settings/firewall/security/intrusion-services/ids-standalone-host-config

Create or update IDS configuration


Update intrusion detection system configuration on standalone hosts.
PUT /policy/api/v1/infra/settings/firewall/security/intrusion-services/ids-standalone-host-config

Get the summary of the intrusions that were detected.


Get the summary of all the intrusions that are detected grouped by signature
with details including signature name, id, severity, attack type, protocol,
first and recent occurence, and affected users and VMs.
The following filter criteria are supported: attack target, attack type,
gateway name, IP address, product affected, signature ID and VM name.
POST /policy/api/v1/infra/settings/firewall/security/intrusion-services/ids-summary

List IDS profiles


List intrusion detection profiles.
GET /policy/api/v1/infra/settings/firewall/security/intrusion-services/profiles

Delete IDS profile


Delete intrusion detection profile.
DELETE /policy/api/v1/infra/settings/firewall/security/intrusion-services/profiles/<profile-id>

Get IDS profile.


Read intrusion detection profile
GET /policy/api/v1/infra/settings/firewall/security/intrusion-services/profiles/<profile-id>

Patch IDS profile


Patch intrusion detection system profile.
PATCH /policy/api/v1/infra/settings/firewall/security/intrusion-services/profiles/<profile-id>

create or update IDS profile


Update intrusion detection profile.
PUT /policy/api/v1/infra/settings/firewall/security/intrusion-services/profiles/<profile-id>

Get IDS profile signatures.


Get all the IDS signatures attached to the Profile.
GET /policy/api/v1/infra/settings/firewall/security/intrusion-services/profiles/<profile-id>/effective-signatures (Experimental)

Get IDS signature versions


Intrusion detection system signature versions.
GET /policy/api/v1/infra/settings/firewall/security/intrusion-services/signature-versions

Change the state of IDS Signature Version


Make this IDS Signature version as ACTIVE version and other versions as NOTACTIVE.
POST /policy/api/v1/infra/settings/firewall/security/intrusion-services/signature-versions?action=make_active_version

List IDS signatures


List intrusion detection system signatures.
GET /policy/api/v1/infra/settings/firewall/security/intrusion-services/signature-versions/<version-id>/signatures

Download and update IDS signatures


Trigger the process to Download and update the IDS signatures manually.
POST /policy/api/v1/infra/settings/firewall/security/intrusion-services/signatures?action=update_signatures

Upload IDS signatures bundle


Upload IDS signatures bundle
POST /policy/api/v1/infra/settings/firewall/security/intrusion-services/signatures?action=upload_signatures

Get IDS signature status


Intrusion detection system signatures status.
GET /policy/api/v1/infra/settings/firewall/security/intrusion-services/signatures/status

Reset IDS/IPS rule statistics


Sets IDS/IPS rule statistics counter to zero.
- no enforcement point path specified: Reset of stats will be executed for
each enforcement point.
- {enforcement_point_path}: Reset of stats will be executed only for the given
enforcement point.
POST /policy/api/v1/infra/settings/firewall/security/intrusion-services/stats?action=reset

List Malware Prevention profiles


List Malware Prevention profiles.
GET /policy/api/v1/infra/settings/firewall/security/malware-prevention-service/profiles

Delete Malware Prevention profile


Delete Malware Prevention profile.
DELETE /policy/api/v1/infra/settings/firewall/security/malware-prevention-service/profiles/<profile-id>

Get Malware Prevention profile.


Read Malware Prevention profile
GET /policy/api/v1/infra/settings/firewall/security/malware-prevention-service/profiles/<profile-id>

Patch Malware Prevention profile


Patch Malware Prevention profile.
PATCH /policy/api/v1/infra/settings/firewall/security/malware-prevention-service/profiles/<profile-id>

Patch Malware Prevention profile


Patch Malware Prevention profile.
PUT /policy/api/v1/infra/settings/firewall/security/malware-prevention-service/profiles/<profile-id>

List Malware Prevention signatures


List Malware Prevention signatures.
GET /policy/api/v1/infra/settings/firewall/security/malware-prevention-service/signatures