Syslog Servers
APIs for managing syslog servers
Create a new syslog integration.
You must have View/Edit Alert Notification permissions to run this endpoint.
Required license: Cortex AgentiX Enterprise or Cortex AgentiX Base
{api_key}
{api_key_id}
OK
Bad Request
Unauthorized
Payment Required
Forbidden
Internal Server Error
POST /public_api/v1/integrations/syslog/create HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 171
{
"request_data": {
"address": "xdr-splunk-qa.traps.company.com",
"facility": "FAC_USER",
"name": "Syslog_PAPI_Test_7H55R76T",
"port": 5006,
"protocol": "TCP",
"security_info": "None"
}
}{
"syslog_integration_id": 630,
"name": "Test PAPI"
}Get a complete or filtered list of syslog servers.
You must have View Alert Notification permissions to run this endpoint.
Required license: Cortex AgentiX Enterprise or Cortex AgentiX Base
{api_key}
{api_key_id}
OK
The number of syslog servers that are returned.
Bad Request
Unauthorized
Payment Required
Forbidden
Internal Server Error
POST /public_api/v1/integrations/syslog/get HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 73
{
"request_data": {
"filters": [
{
"field": "id",
"operator": "eq",
"value": 632
}
]
}
}{
"objects_count": 1,
"objects": [
{
"SYSLOG_INTEGRATION_ID": 1,
"SYSLOG_INTEGRATION_NAME": "text",
"SYSLOG_INTEGRATION_ADDRESS": "text",
"SYSLOG_INTEGRATION_PORT": 1,
"SYSLOG_INTEGRATION_PROTOCOL": "text",
"FACILITY": "text",
"SYSLOG_INTEGRATION_STATUS": "text",
"SYSLOG_INTEGRATION_ERROR": null,
"SYSLOG_INTEGRATION_CERTIFICATE_NAME": null,
"SYSLOG_INTEGRATION_IGNORE_CERTIFICATE_ERROR": "text"
}
]
}Update the details of the specified syslog integration.
You must have View/Edit Alert Notification permissions to run this endpoint.
Required license: Cortex AgentiX Enterprise or Cortex AgentiX Base
{api_key}
{api_key_id}
OK
Whether the update was successful.
trueBad Request
Unauthorized
Payment Required
Forbidden
Internal Server Error
POST /public_api/v1/integrations/syslog/update HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 283
{
"request_data": {
"syslog_id": "123456789",
"name": "Test PAPI",
"address": "34.24.11.16",
"port": "1234",
"protocol": "TLS",
"facility": "FAC_USER",
"security_info": {
"certificate_name": "wf-verdict-service.key.pem",
"ignore_cert_errors": false,
"certificate_content": "<binary string of the cert>"
}
}
}{
"reply": true
}Delete all the syslog integrations or the ones who match the filter criteria.
You must have View/Edit Alert Notification permissions to run this endpoint.
Required license: Cortex AgentiX Enterprise or Cortex AgentiX Base
{api_key}
{api_key_id}
OK
No content
Bad Request
Unauthorized
Payment Required
Forbidden
Internal Server Error
POST /public_api/v1/integrations/syslog/delete HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 95
{
"request_data": {
"filters": [
{
"field": "name",
"operator": "EQ",
"value": "Default syslog server"
}
]
}
}No content
Tests a syslog integration's validity.
You must have View Alert Notification permissions to run this endpoint.
Required license: Cortex AgentiX Enterprise or Cortex AgentiX Base
{api_key}
{api_key_id}
OK
No content
Bad Request
Unauthorized
Payment Required
Forbidden
Internal Server Error
POST /public_api/v1/integrations/syslog/test HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 114
{
"request_data": {
"name": "Test PAPI",
"address": "34.24.11.16",
"port": "1234",
"protocol": "TLS",
"facility": "FAC_USER"
}
}No content
Last updated
Was this helpful?