FFFF API · newdominic/moloch Wiki · GitHub
[go: up one dir, main page]
Skip to content

API

Jump to bottom Edit New page
amaddalena edited this page Sep 26, 2016 · 5 revisions

Viewer API

This API is not final and is subject to change. Many of the parameters are poorly named because of DataTables requirements, however, a newer version of DataTables allows better names so they will be updated.

  • TOC {:toc}

/connections.json

Retrieve the connections data in json format:

Parameters

Name Type Description
date integer The number of hours of data to return, -1 means all data
dstField string The source database field name (Default: a2)
expression string The expression string
iDisplayLength integer < 0.12 - The number of items to return (Default: 5000, Max: 2000000)
iDisplayStart integer < 0.12 - The entry to start at (Default: 0)
length integer >= 0.12 - The number of items to return (Default: 5000, Max: 2000000)
srcField string The source database field name (Default: a1)
start integer >= 0.12 - The entry to start at (Default: 0)
startTime string If the date parameter is not set, this is the start time of data to return. If an integer the number of seconds since Unix EPOC is used, otherwise parsed with javascript Date parser.
stopTime string If the date parameter not set, this is the stop time of data to return. If and integer the number of seconds since Unix EPOC is used, otherwise parsed with javascript Date parser.
strictly boolean When set the entire session must be inside the date range to be observed, otherwise if it overlaps it is displayed.
view string The view name to apply before the expression

/connections.csv

Retrieve the connections data in csv format

Parameters

Same as /connections.json

/files.json

Return a list of files that moloch knows about.

    GET /files.json

Parameters

Name Type Description
iDisplayLength integer < 0.12 - The number of items to return (Default: 500, Max: 10000)
iDisplayStart integer < 0.12 - The entry to start at (Default: 0)
length integer >= 0.12 - The number of items to return (Default: 500, Max: 10000)
start integer >= 0.12 - The entry to start at (Default: 0)

/sessions.json

Retrieve the session data in json format

Parameters

Name Type Description
date integer The number of hours of data to return, -1 means all data
expression string The expression string
facets boolean Also include the aggregation information for maps and time graphs
iDisplayLength integer < 0.11 - The number of items to return (Default: 100, Max: 2000000)
iDisplayStart integer < 0.11 - The entry to start at (Default: 0)
length integer >= 0.12 - the number of items to return (Default: 100, Max: 2000000)
start integer >= 0.12 - The entry to start at (Default: 0)
startTime string If the date parameter is not set, this is the start time of data to return. If an integer the number of seconds since Unix EPOC is used, otherwise parsed with javascript Date parser.
stopTime string If the date parameter not set, this is the stop time of data to return. If an integer the number of seconds since Unix EPOC is used, otherwise parsed 10000 with javascript Date parser.
strictly boolean When set the entire session must be inside the date range to be observed, otherwise if it overlaps it is displayed.
view string The view name to apply before the expression

/sessions.csv

Retrieve the session data in csv format

Parameters

Same as /sessions.json

/sessions.pcap

Retrieve the raw session data in pcap format

Parameters

Name Type Description
date integer The number of hours of data to return, -1 means all data
expression string The expression string, used if ids not set
ids string The list of ids to return
iDisplayLength integer < 0.12 - The number of items to return (Default: 100, Max: 2000000)
iDisplayStart integer < 0.12 - The entry to start at (Default: 0)
length integer >= 0.12 - The number of items to return (Default: 100, Max: 2000000)
segments boolean When set return linked segments
start integer >= 0.12 - The entry to start at (Default: 0)
startTime string If the date parameter not set, this is the start time of data to return. If an integer the number of seconds since Unix EPOC is used, otherwise parsed with javascript Date parser.
stopTime string If the date parameter not set, this is the start time of data to return. If an integer the number of seconds since Unix EPOC is used, otherwise parsed with javascript Date parser.
strictly boolean When set the entire session must be inside the date range to be observed, otherwise if it overlaps it is displayed.
view string The view name to apply before the expression

Parameters

Same as /sessions.json

/spigraph.json

Retrieve the spigraph data in json format

Parameters

Name Type Description
date integer The number of hours of data to return, -1 means all data
expression string The expression string
field string The database field name to spigraph on
size integer The number of unique values to return
startTime string If the date parameter not set, this is the start time of data to return. If an integer the number of seconds since Unix EPOC is used, otherwise parsed with javascript Date parser.
stopTime string If the date parameter not set, this is the start time of data to return. If an integer the number of seconds since Unix EPOC is used, otherwise parsed with javascript Date parser.
strictly boolean When set the entire session must be inside the date range to be observed, otherwise if it overlaps it is displayed.
view string The view name to apply before the expression

/spiview.json

Retrieve the spiview data in json format

Parameters

Name Type Description
date integer The number of hours of data to return, -1 means all data
expression string The expression string
spi boolean A comma separated list of fields to return data for
startTime string If the date parameter not set, this is the start time of data to return. If an integer the number of seconds since Unix EPOC is used, otherwise parsed with javascript Date parser.
stopTime string If the date parameter not set, this is the start time of data to return. If an integer the number of seconds since Unix EPOC is used, otherwise parsed with javascript Date parser.
strictly boolean When set the entire session must be inside the date range to be observed, otherwise if it overlaps it is displayed.
view string The view name to apply before the expression

/unique.txt

Retrieve the unique data for a field in json format

Parameters

Name Type Description
date integer The number of hours of data to return, -1 means all data
expression string The expression string
field string RequiredThe database field name to unique on
startTime string If the date parameter not set, this is the start time of data to return. If an integer the number of seconds since Unix EPOC is used, otherwise parsed with javascript Date parser.
stopTime string If the date parameter not set, this is the start time of data to return. If an integer the number of seconds since Unix EPOC is used, otherwise parsed with javascript Date parser.
strictly boolean When set the entire session must be inside the date range to be observed, otherwise if it overlaps it is displayed.
view string The view name to apply before the expression

Moloch Wiki

Add a custom sidebar

Clone this wiki locally
0