{"type":"api","title":"Get Remote Access Events","meta":{"id":"/apps/pubhub/media/cloud-security-apis-in-eft/d2a1854d5c0ed9069a7f0bc54a9b813f3075ddc9/d1093732-2fd9-3760-ac85-83910c4b7111","info":{"title":"Cisco Secure Access Reporting API","description":"The Reporting API provides the data to generate the Secure Access reports.","version":"2.0.1","contact":{"name":"Cloud Security Developer Community"}},"security":[{"oauthFlow":[]}],"tags":[{"name":"Activity"},{"name":"Top Identities"},{"name":"Identity Distribution"},{"name":"Top Resources"},{"name":"Top Destinations"},{"name":"Top Categories"},{"name":"Top Event Types"},{"name":"Top DNS Query Types"},{"name":"Organization Requests by Hour"},{"name":"Organization Requests by Timerange"},{"name":"Organization Requests by Hour and Category"},{"name":"Organization Requests by Timerange and Category"},{"name":"Deployment Status"},{"name":"Bandwidth by Hour"},{"name":"Bandwidth by Timerange"},{"name":"Top Files"},{"name":"Total Requests"},{"name":"Top Threats"},{"name":"Top Threat Types"},{"name":"Utility"},{"name":"Top IPs"},{"name":"Summary"},{"name":"Summaries by Category"},{"name":"Summaries by Destination"},{"name":"Summaries by Rule"},{"name":"Remote Access"},{"name":"Private Resource"},{"name":"Requests Resource Connector"},{"name":"Requests Summary Resource Connector Groups"},{"name":"Resource Connectors"},{"name":"Rules Activity"},{"name":"Unique Resources"},{"name":"Secure Access"}],"x-parser-conf":{"overview":{"markdownPath":"secure-access/reference/reports/reporting-overview.md","uri":"secure-access-api-reference-reporting-overview"}},"openapi":"3.0.1","servers":[{"url":"https://api.sse.cisco.com/{basePath}","variables":{"basePath":{"default":"reports/v2"}}}],"securitySchemes":{"oauthFlow":{"type":"oauth2","description":"client credential flow","flows":{"clientCredentials":{"tokenUrl":"https://api.sse.cisco.com/auth/v2/token","scopes":{"reports.granularEvents:read":"Read reports granular events","reports.utilities:read":"Read reports utilities","reports.aggregations:read":"Read reports aggregations","reports.summariesByRule:read":"Read reports for the summaries of the rule","reports.privateResources:read":"Read reports for the private resources"}}}}}},"spec":{"tags":["Remote Access","Secure Access"],"summary":"Get Remote Access Events","description":"List the events logged by remote access VPN.\n\n**Access Scope:** Reports \u003e Granular Events \u003e Read-Only","operationId":"getRemoteAccessEvents","security":[{"oauthFlow":["reports.granularEvents:read"]}],"parameters":[{"name":"from","in":"query","description":"A timestamp or relative time string (for example: '-1days').\nFilter for data that appears after this time.","required":true,"schema":{"type":"string"},"example":"1639146300000","$$ref":"#/components/parameters/fromParam"},{"name":"to","in":"query","description":"A timestamp or relative time string (for example: 'now').\nFilter for data that appears before this time.","required":true,"schema":{"type":"string"},"example":"1640010300000","$$ref":"#/components/parameters/toParam"},{"name":"limit","in":"query","description":"The maximum number of records to return from the collection.","required":true,"schema":{"type":"number","default":100},"example":100,"$$ref":"#/components/parameters/limitParam"},{"name":"ip","in":"query","description":"An IP address.","schema":{"type":"string"},"example":"10.10.10.10","$$ref":"#/components/parameters/ipParam"},{"name":"identityids","in":"query","description":"An identity ID or comma-delimited list of identity IDs.","schema":{"type":"string"},"example":"1,2,3","$$ref":"#/components/parameters/identityIdsParam"},{"name":"identitytypes","in":"query","description":"An identity type or comma-delimited list of identity types.","schema":{"type":"string"},"example":"network,roaming","$$ref":"#/components/parameters/identityTypesParam"},{"name":"connectionevent","in":"query","description":"Specify the type of connection event.","schema":{"type":"string","enum":["connected","disconnected","failed"]},"example":"connected","$$ref":"#/components/parameters/connectioneventParam"},{"name":"anyconnectversions","in":"query","description":"Specify a comma-separated list of AnyConnect Roaming Security module versions.","schema":{"type":"string"},"example":"4.10.05095,5.10","$$ref":"#/components/parameters/anyconnectversionsParam"},{"name":"osversions","in":"query","description":"Specify a comma-separated list of OS versions.","schema":{"type":"string"},"example":"linux-64-Ubuntu 20.04.5 LTS (Focal Fossa)","$$ref":"#/components/parameters/osversionsParam"},{"name":"timezone","in":"query","description":"Display the timestamp of the traffic events in the specified timezone.\nFor the timezone, provide a continent and city separated by an url-encoded forward slash ('/'), for example: timezone='ASIA%2fCALCUTTA'.","schema":{"type":"string"},"example":"ASIA%2fCALCUTTA","$$ref":"#/components/parameters/timezoneParam"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","description":"The properties of the remote access events.","properties":{"data":{"type":"array","description":"The list of remote access events.","items":{"type":"object","description":"The properties of the remote access event.","required":["osversion","internalip","connecttimestamp","reason","failedreasons","connectionevent","anyconnectversion","publicip","vpnprofile","sessiontype","timestamp","identities"],"properties":{"osversion":{"type":"string","description":"The OS version of the host.","example":"linux-64-Ubuntu 20.04.5 LTS (Focal Fossa)"},"internalip":{"type":"string","description":"The internal IP address of the host.","example":"10.0.1.5"},"connecttimestamp":{"type":"number","description":"The time and date when the host connected, expressed in seconds.","example":1667252442},"reason":{"type":"string","description":"The reason the event occurred for the remote access endpoint.","example":"ACCT_DISC_USER_REQ"},"failedreasons":{"type":"array","items":{"type":"string"},"description":"A list of messages that describe the remote access error.","example":[]},"connectionevent":{"type":"string","description":"The type of event associated with the remote connection.","example":"disconnected"},"anyconnectversion":{"type":"string","description":"The version of the AnyConnect Roaming Security module.","example":"4.10.05095"},"publicip":{"type":"string","description":"The public IP address of the host","example":"10.10.10.11"},"vpnprofile":{"type":"string","description":"The VPN profile","example":"fa67a326-123a-456b-cd78-g5ae1192ad00"},"sessiontype":{"type":"string","description":"The session type of the remote connection.","example":"TLS"},"timestamp":{"type":"number","description":"The timestamp represented in seconds.","example":1594557263,"$$ref":"#/components/schemas/TimestampInSeconds"},"identities":{"type":"array","items":{"type":"object","description":"The list of properties of the identities.","properties":{"id":{"type":"integer","format":"int32","description":"The ID of the remote access endpoint.","example":1173502975},"type":{"type":"object","description":"The properties of the identity type.","properties":{"id":{"type":"integer","description":"The ID of the type.","example":7},"type":{"type":"string","description":"The descriptive type.","example":"directory_user"},"label":{"type":"string","description":"The label for the type.","example":"AD Users"}}},"label":{"type":"string","description":"The label for the remote access identity.","example":"sample-endpoint@cisco.com"},"deleted":{"type":"boolean","description":"Specifies whether the identity is available.","example":false}}}}},"example":{"osversion":"linux-64-Ubuntu 20.04.5 LTS (Focal Fossa)","internalip":"10.0.1.5","connecttimestamp":1667252442,"reason":"ACCT_DISC_USER_REQ","failedreasons":[],"connectionevent":"disconnected","anyconnectversion":"4.10.05095","publicip":"10.10.10.11","vpnprofile":"fa67a326-123a-456b-cd78-g5ae1192ad00","sessiontype":"TLS","timestamp":1667252458,"identities":[{"id":1173502975,"type":{"id":7,"type":"directory_user","label":"AD Users"},"label":"sample-remote-access@cisco.com","deleted":false}]},"$$ref":"#/components/schemas/RemoteAccess"}},"meta":{"type":"object","description":"The properties of the metadata.","example":{},"$$ref":"#/components/schemas/Meta"}},"required":["data","meta"]},"example":{"data":[{"osversion":"linux-64-Ubuntu 20.04.5 LTS (Focal Fossa)","internalip":"10.0.1.5","connecttimestamp":1667252442,"reason":"ACCT_DISC_USER_REQ","failedreasons":[],"connectionevent":"disconnected","anyconnectversion":"4.10.05095","publicip":"10.10.10.11","vpnprofile":"fa67a326-123a-456b-cd78-g5ae1192ad00","sessiontype":"TLS","timestamp":1667252458,"identities":[{"id":1173502975,"type":{"id":7,"type":"directory_user","label":"AD Users"},"label":"sample-remote-access@cisco.com","deleted":false}]}],"meta":{}}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"example":{"message":"Bad Request"}}}},"$$ref":"#/components/responses/400Error"},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"example":{"message":"Unauthorized"}}}},"$$ref":"#/components/responses/401Error"},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"example":{"message":"Forbidden"}}}},"$$ref":"#/components/responses/403Error"},"404":{"description":"Not Found","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"example":{"message":"Not Found"}}}},"$$ref":"#/components/responses/404Error"},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"example":{"message":"Internal Server Error"}}}},"$$ref":"#/components/responses/500Error"}},"__originalOperationId":"getRemoteAccessEvents","method":"get","path":"/remote-access-events"}}