Miscellaneous APIs#
Some APIs don’t fit nicely into the main categories. They are listed here.
Connectivity test#
This API is for validating that the backend is responding to HTTP requests. A GET on /api/test
should return a 200 status with no body content. No authentication required.
Version API#
Perform a GET on /api/version
to get version info. No authentication required.
{
"API": {
"Major": 0,
"Minor": 1
},
"Build": {
"BuildDate": "2020-05-04T00:00:00Z",
"BuildID": "6c48dd4c",
"GUIBuildID": "b5c8cd58",
"Major": 4,
"Minor": 0,
"Point": 0
}
}
Tag List#
The webserver maintains a list of all tags known to the indexers. This list can be fetched with a GET request on /api/tags
. This will return a list of tags:
["default", "gravwell", "pcap", "windows"]
Search Module List#
To get a list of all available search modules and some info about each one, do a GET on /api/info/searchmodules
. This will return a list of module info structures:
[
{
"Collapsing": true,
"Examples": [
"min by src",
"min by someKey"
],
"FrontendOnly": false,
"Info": "No information available",
"Name": "min",
"Sorting": true
},
{
"Collapsing": true,
"Examples": [
"unique",
"unique chuck",
"unique chuck,testa"
],
"FrontendOnly": false,
"Info": "No information available",
"Name": "unique",
"Sorting": false
},
[...]
{
"Collapsing": false,
"Examples": [
"alias src dst"
],
"FrontendOnly": false,
"Info": "Alias enumerated values",
"Name": "alias",
"Sorting": false
},
{
"Collapsing": true,
"Examples": [
"count",
"count by chuck",
"count by src",
"count by someKey"
],
"FrontendOnly": false,
"Info": "No information available",
"Name": "count",
"Sorting": true
}
]
Render Module List#
To get a list of all available render modules and some info about each one, do a GET on /api/info/rendermodules
. This will return a list of module info structures:
[
{
"Description": "A raw entry storage system, it can store and handle anything.",
"Examples": [
"raw"
],
"Name": "raw",
"SortRequired": false
},
{
"Description": "A chart storage system system.\n\t Chart looks for numeric types, storing them.\n\t Requested entries will be a set of types with column names.",
"Examples": [
"chart"
],
"Name": "chart",
"SortRequired": false
},
[...]
{
"Description": "A point mapping system that supports condensing and geofencing",
"Examples": [],
"Name": "point2point",
"SortRequired": false
}
]
GUI Settings#
This API provides some basic information for the user interface. A GET on /api/settings
will return a structure similar to the following:
{
"DisableMapTileProxy": false,
"DistributedWebservers": false,
"MapTileUrl": "http://localhost:8080/api/maps",
"MaxFileSize": 8388608,
"MaxResourceSize": 134217728,
"ServerTime": "2020-11-30T11:50:29.478092519-08:00",
"ServerTimezone": "PST",
"ServerTimezoneOffset": -28800
}
DisableMapTileProxy
, if true, tells the UI that it should send map requests directly to OpenStreetMap servers, rather than using the Gravwell proxy.MapTileUrl
is the URL which the UI should use to fetch map tiles.DistributedWebservers
will be set to true if there are multiple webservers coordinating via a datastore.MaxFileSize
is the maximum allowable file size (in bytes) which may be uploaded to the/api/files
APIs.MaxResourceSize
is the maximum allowable resource size, in bytes.ServerTime
is the current time on the webserver.ServerTimezone
is the webserver’s timezone.ServerTimezoneOffset
is the webservers timezone offset, in seconds from UTC.
Scripting Libraries#
This API allows automation scripts to import libraries from GitHub repositories using the require
function. There is also an endpoint which will trigger a git pull on all the user’s repositories.
Fetching a library#
This endpoint is probably only useful for the searchagent to use via library functions but is included for completeness. To fetch a file from a given repository, do a GET with parameters in the URL, e.g.:
/api/libs?repo=github.com/gravwell/libs&commit=40e98d216bb6e69642df392b255e8edc0f57eb06&path=utils/links.ank
The “repo” and “commit” values may be omitted. If “repo” is omitted, it defaults to github.com/gravwell/libs. If “commit” is omitted, it defaults to the tip of the master branch.
Updating libraries#
A set of repositories is maintained for each user. A user may force a git pull
on their own repository set by sending a GET request to /api/libs/pull
. Be aware that this may take some time.