{"type":"api","title":"Get Remote Access Events","meta":{"id":"/apps/pubhub/media/legacy-umbrella-api/bf58de618cbb72dda8f39b0414ce94c0a15cd467/ca1cb6ac-c651-3cb6-9746-527b35467f3c","info":{"title":"Reporting API","description":"The Reporting API provides the data to generate the reports as seen on the Umbrella dashboard.","version":"1.0.0","contact":{"name":"Cloud Security Developer Community"}},"security":[{"oauthFlow":[]}],"tags":[{"name":"Activity"},{"name":"Top Identities"},{"name":"Identity Distribution"},{"name":"Top Destinations"},{"name":"Top Categories"},{"name":"Top Event Types"},{"name":"Top DNS query types"},{"name":"Organization Requests by Hour"},{"name":"Organization Requests by Timerange"},{"name":"Organization Requests by Hour and Category"},{"name":"Organization Requests by Timerange and Category"},{"name":"Deployment Status"},{"name":"MSP Deployment Status"},{"name":"MSP Requests by Hour"},{"name":"MSP Requests by Timerange"},{"name":"MSP Requests by Organization"},{"name":"MSP Requests by Category"},{"name":"MSP Requests by Destination"},{"name":"MSP Category Requests by Organization"},{"name":"Bandwidth by Hour"},{"name":"Bandwidth by Timerange"},{"name":"Top Files"},{"name":"Total Requests"},{"name":"Top Threats"},{"name":"Top Threat Types"},{"name":"Utility"},{"name":"Top IPs"},{"name":"Summary"},{"name":"Summaries by Category"},{"name":"Summaries by Destination"},{"name":"Summaries by Rule (Intrusion)"},{"name":"Remote Access"}],"x-parser-conf":{"oAuth2":{"clientId":"","clientSecret":"","proxyEnabled":true},"meta":{"useProxy":true}},"openapi":"3.0.1","servers":[{"url":"https://reports.api.umbrella.com/{basePath}","variables":{"basePath":{"default":"v2"}}}],"securitySchemes":{"oauthFlow":{"type":"oauth2","description":"client credential flow","flows":{"clientCredentials":{"tokenUrl":"https://management.api.umbrella.com/auth/v2/oauth2/token","scopes":{}}}}}},"spec":{"tags":["Remote Access"],"summary":"Get Remote Access Events","description":"List the events logged by remote access.","operationId":"getRemoteAccessEvents","parameters":[{"name":"organizationid","in":"path","description":"The organization ID","required":true,"schema":{"type":"number"},"example":1234567,"$$ref":"#/components/parameters/organizationIdParam"},{"name":"from","in":"query","description":"A timestamp or relative time string (for example: '-1days').\nFilter for data that appears after this time.","required":true,"schema":{"type":"string"},"example":"1639146300000","$$ref":"#/components/parameters/fromParam"},{"name":"to","in":"query","description":"A timestamp or relative time string (for example: 'now').\nFilter for data that appears before this time.","required":true,"schema":{"type":"string"},"example":"1640010300000","$$ref":"#/components/parameters/toParam"},{"name":"limit","in":"query","description":"The maximum number of records to return from the collection.","required":true,"schema":{"type":"number"},"example":100,"$$ref":"#/components/parameters/limitParam"},{"name":"ip","in":"query","description":"An IP address","schema":{"type":"string"},"example":"10.10.10.10","$$ref":"#/components/parameters/ipParam"},{"name":"identityids","in":"query","description":"An identity ID or comma-delimited list of identity ID.","schema":{"type":"string"},"example":"1,2,3","$$ref":"#/components/parameters/identityIdsParam"},{"name":"identitytypes","in":"query","description":"An identity type or comma-delimited list of identity type.","schema":{"type":"string"},"example":"network,roaming","$$ref":"#/components/parameters/identityTypesParam"},{"name":"connectionevent","in":"query","description":"Specify the type of connection event.","schema":{"type":"string","enum":["connected","disconnected","failed"]},"example":"connected","$$ref":"#/components/parameters/connectioneventParam"},{"name":"anyconnectversions","in":"query","description":"Specify a comma-separated list of AnyConnect Roaming Security module\nversions to filter the data.","schema":{"type":"string"},"example":"4.10.05095","$$ref":"#/components/parameters/anyconnectversionsParam"},{"name":"osversions","in":"query","description":"Specify a comma-separated list of OS versions to filter the data.","schema":{"type":"string"},"example":"","$$ref":"#/components/parameters/osversionsParam"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"type":"object","required":["osversion","internalip","connecttimestamp","reason","failedreasons","connectionevent","anyconnectversion","timestamp","identities"],"properties":{"osversion":{"type":"string","description":"The OS version of the host","example":"linux-64-Ubuntu 20.04.5 LTS (Focal Fossa)"},"internalip":{"type":"string","description":"The internal IP address of the host","example":"10.0.1.5"},"connecttimestamp":{"type":"number","description":"The time and date when the host connected, expressed in milliseconds","example":1667252442},"reason":{"type":"string","description":"The reason the event occurred for the remote access endpoint","example":"ACCT_DISC_USER_REQ"},"failedreasons":{"type":"array","items":{"type":"string"},"description":"A list of messages that describe the remote access error","example":[]},"connectionevent":{"type":"string","description":"The type of event associated with the remote connection","example":"disconnected"},"anyconnectversion":{"type":"string","description":"The version of the AnyConnect Roaming Security module","example":"4.10.05095"},"timestamp":{"type":"number","description":"The time and date of the event, expressed in milliseconds","example":1667252458},"identities":{"type":"array","items":{"type":"object","properties":{"id":{"type":"integer","format":"int32","description":"The id of the remote access endpoint","example":1173502975},"type":{"type":"object","properties":{"id":{"type":"integer","description":"The ID of the type","example":7},"type":{"type":"string","description":"The descriptive type","example":"directory_user"},"label":{"type":"string","description":"The label for the type","example":"AD Users"}}},"label":{"type":"string","description":"The label for the remote access identity","example":"sample-endpoint@cisco.com"},"deleted":{"type":"boolean","description":"Specifies whether the identity is available","example":false}}}}},"example":{"osversion":"linux-64-Ubuntu 20.04.5 LTS (Focal Fossa)","internalip":"10.0.1.5","connecttimestamp":1667252442,"reason":"ACCT_DISC_USER_REQ","failedreasons":[],"connectionevent":"disconnected","anyconnectversion":"4.10.05095","timestamp":1667252458,"identities":[{"id":1173502975,"type":{"id":7,"type":"directory_user","label":"AD Users"},"label":"sample-remote-access@cisco.com","deleted":false}]},"$$ref":"#/components/schemas/RemoteAccess"}},"meta":{"type":"object","example":{},"$$ref":"#/components/schemas/Meta"}},"required":["data","meta"]},"example":{"data":[{"osversion":"linux-64-Ubuntu 20.04.5 LTS (Focal Fossa)","internalip":"10.0.1.5","connecttimestamp":1667252442,"reason":"ACCT_DISC_USER_REQ","failedreasons":[],"connectionevent":"disconnected","anyconnectversion":"4.10.05095","timestamp":1667252458,"identities":[{"id":1173502975,"type":{"id":7,"type":"directory_user","label":"AD Users"},"label":"sample-remote-access@cisco.com","deleted":false}]}],"meta":{}}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"example":{"message":"Invalid request"}}}},"$$ref":"#/components/responses/400Error"},"401":{"description":"Unauthorized request","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"example":{"message":"Unauthorized request"}}}},"$$ref":"#/components/responses/401Error"},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"example":{"message":"Forbidden"}}}},"$$ref":"#/components/responses/403Error"},"404":{"description":"Not Found","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"example":{"message":"Not Found"}}}},"$$ref":"#/components/responses/404Error"},"500":{"description":"Server error","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"example":{"message":"Server error"}}}},"$$ref":"#/components/responses/500Error"}},"__originalOperationId":"getRemoteAccessEvents","security":[{"oauthFlow":[]}],"method":"get","path":"/organizations/{organizationid}/remote-access-events"}}