Activity Firewall - Legacy Umbrella API

{"type":"api","title":"Activity Firewall","meta":{"id":"/apps/pubhub/media/legacy-umbrella-api/bf58de618cbb72dda8f39b0414ce94c0a15cd467/ca1cb6ac-c651-3cb6-9746-527b35467f3c","info":{"title":"Reporting API","description":"The Reporting API provides the data to generate the reports as seen on the Umbrella dashboard.","version":"1.0.0","contact":{"name":"Cloud Security Developer Community"}},"security":[{"oauthFlow":[]}],"tags":[{"name":"Activity"},{"name":"Top Identities"},{"name":"Identity Distribution"},{"name":"Top Destinations"},{"name":"Top Categories"},{"name":"Top Event Types"},{"name":"Top DNS query types"},{"name":"Organization Requests by Hour"},{"name":"Organization Requests by Timerange"},{"name":"Organization Requests by Hour and Category"},{"name":"Organization Requests by Timerange and Category"},{"name":"Deployment Status"},{"name":"MSP Deployment Status"},{"name":"MSP Requests by Hour"},{"name":"MSP Requests by Timerange"},{"name":"MSP Requests by Organization"},{"name":"MSP Requests by Category"},{"name":"MSP Requests by Destination"},{"name":"MSP Category Requests by Organization"},{"name":"Bandwidth by Hour"},{"name":"Bandwidth by Timerange"},{"name":"Top Files"},{"name":"Total Requests"},{"name":"Top Threats"},{"name":"Top Threat Types"},{"name":"Utility"},{"name":"Top IPs"},{"name":"Summary"},{"name":"Summaries by Category"},{"name":"Summaries by Destination"},{"name":"Summaries by Rule (Intrusion)"},{"name":"Remote Access"}],"x-parser-conf":{"oAuth2":{"clientId":"","clientSecret":"","proxyEnabled":true},"meta":{"useProxy":true}},"openapi":"3.0.1","servers":[{"url":"https://reports.api.umbrella.com/{basePath}","variables":{"basePath":{"default":"v2"}}}],"securitySchemes":{"oauthFlow":{"type":"oauth2","description":"client credential flow","flows":{"clientCredentials":{"tokenUrl":"https://management.api.umbrella.com/auth/v2/oauth2/token","scopes":{}}}}}},"spec":{"tags":["Activity"],"summary":"Activity Firewall","description":"List all Firewall entries within timeframe.","operationId":"getActivityFirewall","parameters":[{"name":"organizationid","in":"path","description":"The organization ID","required":true,"schema":{"type":"number"},"example":1234567,"$$ref":"#/components/parameters/organizationIdParam"},{"name":"from","in":"query","description":"A timestamp or relative time string (for example: '-1days').\nFilter for data that appears after this time.","required":true,"schema":{"type":"string"},"example":"1639146300000","$$ref":"#/components/parameters/fromParam"},{"name":"to","in":"query","description":"A timestamp or relative time string (for example: 'now').\nFilter for data that appears before this time.","required":true,"schema":{"type":"string"},"example":"1640010300000","$$ref":"#/components/parameters/toParam"},{"name":"offset","in":"query","description":"A number that represents an index into the collection.","schema":{"type":"number"},"example":0,"$$ref":"#/components/parameters/offsetParam"},{"name":"limit","in":"query","description":"The maximum number of records to return from the collection.","required":true,"schema":{"type":"number"},"example":100,"$$ref":"#/components/parameters/limitParam"},{"name":"identityids","in":"query","description":"An identity ID or comma-delimited list of identity ID.","schema":{"type":"string"},"example":"1,2,3","$$ref":"#/components/parameters/identityIdsParam"},{"name":"ruleid","in":"query","description":"A firewall policy rule ID.","schema":{"type":"number"},"example":1,"$$ref":"#/components/parameters/ruleIdParam"},{"name":"verdict","in":"query","description":"A verdict string or comma-delimited list of verdict string.","schema":{"type":"string"},"example":"allowed,blocked,proxied","$$ref":"#/components/parameters/verdictParam"},{"name":"ip","in":"query","description":"An IP address","schema":{"type":"string"},"example":"10.10.10.10","$$ref":"#/components/parameters/ipParam"},{"name":"ports","in":"query","description":"A port number or comma-delimited list of port number.","schema":{"type":"string"},"example":"7351,80","$$ref":"#/components/parameters/portsParam"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"type":"object","properties":{"date":{"type":"string","description":"the date from the timestamp based on the timezone parameter","example":"2020-07-12","$$ref":"#/components/schemas/Date"},"destinationip":{"type":"string","description":"destination IP for entry","example":"12.10.10.10","$$ref":"#/components/schemas/DestinationIp"},"sourceip":{"type":"string","description":"source IP for entry","example":"10.11.10.10","$$ref":"#/components/schemas/SourceIp"},"sourceport":{"type":"number","description":"source port for entry","example":3000,"$$ref":"#/components/schemas/SourcePort"},"destinationport":{"type":"number","description":"destination port for entry","example":89,"$$ref":"#/components/schemas/DestinationPort"},"verdict":{"type":"string","description":"verdict for entry"},"time":{"type":"string","description":"the time in 24 hour format based on the timezone parameter","example":"12:34","$$ref":"#/components/schemas/Time"},"timestamp":{"type":"number","description":"timestamp in ms","example":1594557263000,"$$ref":"#/components/schemas/Timestamp"},"identities":{"type":"array","description":"array of identities for entry","items":{"type":"object","properties":{"id":{"type":"number","description":"id of identity + organizationid: 957974 (number) - organization id for identity"},"label":{"type":"string","description":"label for identity"},"type":{"type":"object","properties":{"id":{"type":"number","description":"origin type for identity"},"label":{"type":"string","description":"origin type label for identity"},"type":{"type":"string","description":"origin type name for identity"}},"$$ref":"#/components/schemas/IdentityType"},"deleted":{"type":"boolean","description":"indicates whether the identity was deleted or not"}},"required":["id","label","type","deleted"],"example":{"id":1,"label":"Catch Rate Testing System","type":{"id":21,"label":"Sites","type":"site"},"deleted":false},"$$ref":"#/components/schemas/Identity"}},"protocol":{"type":"object","description":"ip protocol","properties":{"id":{"type":"number","description":"id of protocol"},"label":{"type":"string","description":"name of the protocol"}},"required":["id","label"],"$$ref":"#/components/schemas/Protocol"},"rule":{"type":"object","description":"firewall rule","properties":{"id":{"type":"number","description":"id of rule"},"label":{"type":"string","description":"name of the rule"},"privateapplicationgroup":{"type":"object","description":"private application group","properties":{"id":{"nullable":true,"type":"number","description":"id of application group"},"label":{"nullable":true,"type":"string","description":"name of application group"}},"$$ref":"#/components/schemas/PrivateApplicationGroup"}},"required":["id","label"],"$$ref":"#/components/schemas/Rule"},"type":{"type":"string","description":"type of the request. a firewall request always has type firewall"},"allapplications":{"type":"array","description":"a list of firewall applications","items":{"type":"object","properties":{"id":{"type":"number","description":"application/protocol id"},"label":{"type":"string","description":"application/protocol label"},"app":{"type":"string","description":"type: \"IT Service Management\" (string) - application/protocol type"}},"$$ref":"#/components/schemas/FirewallApplication"}},"applicationprotocols":{"type":"array","description":"a list of firewall applications","items":{"type":"object","properties":{"id":{"type":"number","description":"application/protocol id"},"label":{"type":"string","description":"application/protocol label"},"app":{"type":"string","description":"type: \"IT Service Management\" (string) - application/protocol type"}},"$$ref":"#/components/schemas/FirewallApplication"}},"direction":{"type":"string","description":"The direction of the packet. It is destined either towards the internet or to the customer's network."},"packetsize":{"type":"number","description":"The size of the packet that Umbrella CDFW received."}},"required":["allapplications","applicationprotocols","date","destinationip","destinationport","direction","identities","packetsize","protocol","rule","sourceip","sourceport","time","timestamp","type","verdict"],"example":{"date":"","destinationip":"52.8.160.247","sourceip":"192.168.0.1","sourceport":0,"destinationport":0,"direction":"toward","verdict":"allowed","time":"12:34","timestamp":1548311506,"packetsize":32,"identities":[{"id":1,"label":"Catch Rate Testing System","type":{"id":21,"label":"Sites","type":"site"},"deleted":false}],"protocol":{"id":17,"label":"UDP"},"rule":{"id":1,"label":"Default Rule"},"type":"firewall","allapplications":[{"id":72,"label":"dns IT Service Management","app":""}],"applicationprotocols":[{"id":72,"label":"dns IT Service Management","app":""}]},"$$ref":"#/components/schemas/ActivityFirewall"}},"meta":{"type":"object","example":{},"$$ref":"#/components/schemas/Meta"}},"required":["data","meta"]},"example":{"data":[{"date":"2019","destinationip":"52.8.160.247","sourceip":"192.168.0.1","sourceport":0,"destinationport":0,"verdict":"allowed","time":"12:34","timestamp":1548311506,"identities":[{"id":1,"label":"Catch Rate Testing System","type":{"id":21,"label":"Sites","type":"site"},"deleted":false}],"protocol":{"id":17,"label":"UDP"},"rule":{"id":1,"label":"Default Rule"},"type":"firewall","allapplications":[{"id":72,"label":"dns IT Service Management","app":""}],"applicationprotocols":[{"id":72,"label":"dns IT Service Management","app":""}],"packetsize":32,"direction":"towards"}],"meta":{}}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"example":{"message":"Invalid request"}}}},"$$ref":"#/components/responses/400Error"},"401":{"description":"Unauthorized request","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"example":{"message":"Unauthorized request"}}}},"$$ref":"#/components/responses/401Error"},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"example":{"message":"Forbidden"}}}},"$$ref":"#/components/responses/403Error"},"404":{"description":"Not Found","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"example":{"message":"Not Found"}}}},"$$ref":"#/components/responses/404Error"},"500":{"description":"Server error","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"example":{"message":"Server error"}}}},"$$ref":"#/components/responses/500Error"}},"__originalOperationId":"getActivityFirewall","security":[{"oauthFlow":[]}],"method":"get","path":"/organizations/{organizationid}/activity/firewall"}}