Get Activity Firewall - Cloud Security API

{"type":"api","title":"Get Activity Firewall","meta":{"id":"/apps/pubhub/media/cloud-security-apis-in-eft/9d37d008417d562ab46d4b67547a68457ce288d2/d1093732-2fd9-3760-ac85-83910c4b7111","info":{"title":"Cisco Secure Access Reporting API","description":"The Reporting API provides the data to generate the Secure Access reports.","version":"2.0.1","contact":{"name":"Cloud Security Developer Community"}},"security":[{"oauthFlow":[]}],"tags":[{"name":"Activity"},{"name":"Top Identities"},{"name":"Identity Distribution"},{"name":"Top Resources"},{"name":"Top Destinations"},{"name":"Top Categories"},{"name":"Top Event Types"},{"name":"Top DNS Query Types"},{"name":"Organization Requests by Hour"},{"name":"Organization Requests by Timerange"},{"name":"Organization Requests by Hour and Category"},{"name":"Organization Requests by Timerange and Category"},{"name":"Deployment Status"},{"name":"Bandwidth by Hour"},{"name":"Bandwidth by Timerange"},{"name":"Top Files"},{"name":"Total Requests"},{"name":"Top Threats"},{"name":"Top Threat Types"},{"name":"Utility"},{"name":"Top IPs"},{"name":"Summary"},{"name":"Summaries by Category"},{"name":"Summaries by Destination"},{"name":"Summaries by Rule"},{"name":"Remote Access"},{"name":"Private Resource"},{"name":"Requests Resource Connector"},{"name":"Requests Summary Resource Connector Groups"},{"name":"Resource Connectors"},{"name":"Rules Activity"},{"name":"Unique Resources"},{"name":"Network Tunnels"},{"name":"Secure Access"}],"x-parser-conf":{"overview":{"markdownPath":"secure-access/reference/reports/reporting-overview.md","uri":"secure-access-api-reference-reporting-overview"}},"openapi":"3.0.1","servers":[{"url":"https://api.sse.cisco.com/{basePath}","variables":{"basePath":{"default":"reports/v2"}}}],"securitySchemes":{"oauthFlow":{"type":"oauth2","description":"client credential flow","flows":{"clientCredentials":{"tokenUrl":"https://api.sse.cisco.com/auth/v2/token","scopes":{"reports.granularEvents:read":"Read reports granular events","reports.utilities:read":"Read reports utilities","reports.aggregations:read":"Read reports aggregations","reports.summariesByRule:read":"Read reports for the summaries of the rule","reports.privateResources:read":"Read reports for the private resources"}}}}}},"spec":{"tags":["Activity","Secure Access"],"summary":"Get Activity Firewall","description":"List all firewall activity within the timeframe.\n\n**Access Scope:** Reports \u003e Granular Events \u003e Read-Only","operationId":"getActivityFirewall","security":[{"oauthFlow":["reports.granularEvents:read"]}],"parameters":[{"name":"from","in":"query","description":"A timestamp or relative time string (for example: '-1days').\nFilter for data that appears after this time.","required":true,"schema":{"type":"string"},"example":"1639146300000","$$ref":"#/components/parameters/fromParam"},{"name":"to","in":"query","description":"A timestamp or relative time string (for example: 'now').\nFilter for data that appears before this time.","required":true,"schema":{"type":"string"},"example":"1640010300000","$$ref":"#/components/parameters/toParam"},{"name":"offset","in":"query","description":"A number that represents an index in the collection.","schema":{"type":"number","default":0},"example":0,"$$ref":"#/components/parameters/offsetParam"},{"name":"limit","in":"query","description":"The maximum number of records to return from the collection.","required":true,"schema":{"type":"number","default":100},"example":100,"$$ref":"#/components/parameters/limitParam"},{"name":"identityids","in":"query","description":"An identity ID or comma-delimited list of identity IDs.","schema":{"type":"string"},"example":"1,2,3","$$ref":"#/components/parameters/identityIdsParam"},{"name":"ruleid","in":"query","description":"The firewall policy rule ID.","schema":{"type":"number"},"example":1,"$$ref":"#/components/parameters/ruleIdParam"},{"name":"verdict","in":"query","description":"A string or comma-delimited string that describes whether the traffic can reach the destination.","schema":{"type":"string"},"example":"allowed,blocked","$$ref":"#/components/parameters/verdictParam"},{"name":"ip","in":"query","description":"An IP address.","schema":{"type":"string"},"example":"10.10.10.10","$$ref":"#/components/parameters/ipParam"},{"name":"ports","in":"query","description":"A port number or comma-delimited list of port numbers.","schema":{"type":"string"},"example":"7351,80","$$ref":"#/components/parameters/portsParam"},{"name":"timezone","in":"query","description":"Display the timestamp of the traffic events in the specified timezone.\nFor the timezone, provide a continent and city separated by an url-encoded forward slash ('/'), for example: timezone='ASIA%2fCALCUTTA'.","schema":{"type":"string"},"example":"ASIA%2fCALCUTTA","$$ref":"#/components/parameters/timezoneParam"},{"name":"categories","in":"query","description":"A category ID or comma-delimited list of category ID.","schema":{"type":"string"},"example":"148,151,66","$$ref":"#/components/parameters/categoriesParam"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"type":"object","description":"The information about the firewall activity.","properties":{"date":{"type":"string","description":"The date from the timestamp based on the timezone parameter.","example":"2020-07-12","$$ref":"#/components/schemas/Date"},"destinationip":{"type":"string","description":"The destination IP for the entry.","example":"12.10.10.10","$$ref":"#/components/schemas/DestinationIp"},"sourceip":{"type":"string","description":"The source IP for the entry.","example":"10.11.10.10","$$ref":"#/components/schemas/SourceIp"},"sourceport":{"type":"number","description":"The source port for the entry.","example":3000,"$$ref":"#/components/schemas/SourcePort"},"destinationport":{"type":"number","description":"The destination port for entry.","example":89,"$$ref":"#/components/schemas/DestinationPort"},"categories":{"type":"array","description":"The list of categories.","items":{"type":"object","description":"The properties of the category.","properties":{"id":{"type":"number","description":"The ID of the category."},"label":{"type":"string","description":"The descriptive label for the category."},"type":{"type":"string","description":"The type of the category."},"integration":{"type":"boolean","description":"Specifies whether the category is an integration.","example":true},"deprecated":{"type":"boolean","description":"Specifies whether the category is a legacy category.","example":true}},"$$ref":"#/components/schemas/Category"},"$$ref":"#/components/schemas/categories"},"verdict":{"type":"string","description":"The verdict for the entry.","enum":["allowed","blocked"],"example":"allowed","$$ref":"#/components/schemas/verdict"},"time":{"type":"string","description":"The time in 24-hour format based on the timezone parameter.","example":"12:34","$$ref":"#/components/schemas/Time"},"timestamp":{"type":"number","description":"The timestamp represented in milliseconds.","example":1594557263000,"$$ref":"#/components/schemas/Timestamp"},"identities":{"type":"array","description":"The list of identities for the entry.","items":{"type":"object","description":"The information about the identity.","properties":{"id":{"type":"number","description":"The ID of the identity."},"label":{"type":"string","description":"The descriptive label for the identity."},"type":{"type":"object","description":"The information about the identity including the type.","properties":{"id":{"type":"number","description":"The ID of the origin type for the identity."},"label":{"type":"string","description":"The label of the origin type for the identity."},"type":{"type":"string","description":"The name of the origin type for the identity."}},"$$ref":"#/components/schemas/IdentityType"},"deleted":{"type":"boolean","description":"Indicates whether the identity was deleted.","example":true}},"required":["id","label","type","deleted"],"example":{"id":1,"label":"Catch Rate Testing System","type":{"id":21,"label":"Sites","type":"site"},"deleted":false},"$$ref":"#/components/schemas/Identity"},"$$ref":"#/components/schemas/identities"},"protocol":{"type":"object","description":"The properties of the protocol.","properties":{"id":{"type":"number","description":"The ID of protocol."},"label":{"type":"string","description":"The name of the protocol."}},"required":["id","label"],"$$ref":"#/components/schemas/Protocol"},"rule":{"type":"object","description":"The properties of the firewall rule.","properties":{"id":{"type":"number","description":"The ID of the rule."},"label":{"type":"string","description":"The name of the rule."},"privateapplicationgroup":{"type":"object","description":"The private application group.","properties":{"id":{"nullable":true,"type":"number","description":"The ID of application group."},"label":{"nullable":true,"type":"string","description":"The name of the application group."}},"$$ref":"#/components/schemas/PrivateApplicationGroup"}},"required":["id","label"],"$$ref":"#/components/schemas/Rule"},"type":{"type":"string","description":"The type of the request. A firewall request always has type firewall.","example":"firewall"},"allapplications":{"type":"array","description":"The list of applications for the entry.","items":{"type":"object","description":"The information about the application.","properties":{"id":{"type":"number","description":"The ID of the application."},"label":{"type":"string","description":"The descriptive label for the application."},"type":{"type":"string","description":"The type of the application: NBAR or AVC.","enum":["NBAR","AVC"],"example":"AVC"},"category":{"type":"object","description":"The category of the application.","properties":{"id":{"type":"number","description":"The ID of the application category."},"label":{"type":"string","description":"The label of the application category."}}}},"example":{"id":1,"label":"malware","type":"AVC","category":{"id":2,"label":"Education"}},"$$ref":"#/components/schemas/Application"},"$$ref":"#/components/schemas/allapplications"},"applicationprotocols":{"type":"array","description":"A list of firewall application protocols.","items":{"type":"object","description":"The information about the applications managed by the firewall.","properties":{"id":{"type":"number","description":"The ID of the application or protocol."},"label":{"type":"string","description":"The descriptive label for the application or protocol."},"app":{"type":"string","description":"The information about the app type.","example":"IT Service Management (string) - application/protocol type"}},"$$ref":"#/components/schemas/FirewallApplication"}},"direction":{"type":"string","description":"The direction of the packet. It is destined either towards the internet or to the customer's network."},"packetsize":{"type":"number","description":"The size of the packet that was received."}},"required":["allapplications","applicationprotocols","date","destinationip","destinationport","direction","identities","packetsize","protocol","rule","sourceip","sourceport","time","timestamp","type","verdict"],"example":{"date":"","destinationip":"52.8.160.247","sourceip":"192.168.0.1","sourceport":0,"destinationport":0,"direction":"toward","categories":[{"id":66,"label":"Malware","type":"security","integration":true}],"verdict":"allowed","time":"12:34","timestamp":1548311506000,"packetsize":32,"identities":[{"id":1,"label":"Catch Rate Testing System","type":{"id":21,"label":"Sites","type":"site"},"deleted":false}],"protocol":{"id":17,"label":"UDP"},"rule":{"id":1,"label":"Default Rule"},"type":"firewall","allapplications":[{"id":72,"label":"dns IT Service Management","app":""}],"applicationprotocols":[{"id":72,"label":"dns IT Service Management","app":""}]},"$$ref":"#/components/schemas/ActivityFirewall"}},"meta":{"type":"object","description":"The properties of the metadata.","example":{},"$$ref":"#/components/schemas/Meta"}},"required":["data","meta"]},"example":{"data":[{"date":"2019","destinationip":"52.8.160.247","sourceip":"192.168.0.1","sourceport":0,"destinationport":0,"categories":[{"id":66,"label":"Malware","type":"security","integration":true}],"verdict":"allowed","time":"12:34","timestamp":1731002169000,"identities":[{"id":1,"label":"Catch Rate Testing System","type":{"id":21,"label":"Sites","type":"site"},"deleted":false}],"protocol":{"id":17,"label":"UDP"},"rule":{"id":1,"label":"Default Rule"},"type":"firewall","allapplications":[{"id":72,"label":"dns IT Service Management","app":""}],"applicationprotocols":[{"id":72,"label":"dns IT Service Management","app":""}],"packetsize":32,"direction":"towards"}],"meta":{}}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"example":{"message":"Bad Request"}}}},"$$ref":"#/components/responses/400Error"},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"example":{"message":"Unauthorized"}}}},"$$ref":"#/components/responses/401Error"},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"example":{"message":"Forbidden"}}}},"$$ref":"#/components/responses/403Error"},"404":{"description":"Not Found","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"example":{"message":"Not Found"}}}},"$$ref":"#/components/responses/404Error"},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"example":{"message":"Internal Server Error"}}}},"$$ref":"#/components/responses/500Error"}},"__originalOperationId":"getActivityFirewall","method":"get","path":"/activity/firewall"}}