{% extends "base.html" %} {% block content %}
The websnort API is currently implemented as a blocking synchronous HTTP POST. If you have a large ruleset defined for your instance or many concurrent requests, timeout issues could be a problem. An asynchronous job submission API is possible if there is enough interest.
URL | Method | Description | Successful Response | Unsuccessful Response |
---|---|---|---|---|
/api/submit | POST | Accepts a multipart/form-data submission containing the pcap file to scan and returns a results json dictionary. |
{"apiversion": "version", "status": "Success", "filename": "filename" "filesize": bytes, "md5": "hexstring", "start": "YYYY-MM-DDTHH:mm:SS.sssssss", "duration": seconds, "analyses": [ {"status": "Success", "name": "configname", "module": "idsname", "version": "idsversion", "ruleset": "label", "duration": seconds, "alerts":[ {"source": "ipaddress", "destination": "ipaddress", "protocol": "protocol name", "classtype": "alert classification (optional)", "sid": signature_id, "timestamp": "YYYY-MM-DDTHH:mm:SS.sssssss", "message": "alert description", "revision": signature_revision}]}, ]} |
{"apiversion": "version", "status": "Failed", "filename": "filename" "filesize": bytes, "md5": "hexstring", "start": "YYYY-MM-DDTHH:mm:SS.sssssss", "duration": seconds, "errors": ["Error description / details"] "analyses": []} |
$ curl -i --form file=@test.pcap http://localhost:8080/api/submit HTTP/1.0 200 OK Date: Sun, 31 Aug 2014 02:52:50 GMT Server: WSGIServer/0.1 Python/2.7.6 Content-Length: 1001 Content-Type: application/json { "status": "Success", "errors": [], "apiversion": "0.4", "filename": "test.pcap", "start": "2014-08-31T12:52:48.828358", "filesize": 12373, "duration": 2.134792, "analyses": [ { "status": "Success", "name": "snort", "alerts": [ { "source": "10.1.1.132:58650", "classtype": "Detection of a Network Scan", "protocol": "UDP", "sid": 1917, "timestamp": "2014-01-28T21:26:04.885446", "message": "SCAN UPnP service discover attempt", "destination": "239.255.255.250:1900", "revision": 6 } ], "module": "snort", "version": "2.9.6.0 GRE (Build 47)", "ruleset": "community", "duration": 2.131043 } ], "md5": "22bd2cfbdea14676ef4211e539cbb535" }