swagger: '2.0'
info:
description: Secure Docker and Kubernetes based container deployments with the NeuVector run-time security solution.
version: 5.6.0
license:
name: Apache 2.0
url: https://www.apache.org/licenses/LICENSE-2.0.html
title: NeuVector Log API
contact:
email: support@neuvector.com
schemes:
- https
tags:
- name: Log
description: Operations about Log
paths:
/v1/log/activity:
get:
tags:
- Log
summary: Get activity list
security:
- ApiKeyAuth: []
- TokenAuth: []
produces:
- application/json
responses:
'200':
description: Success
schema:
$ref: '#/definitions/RESTEventsData'
/v1/log/audit:
get:
tags:
- Log
summary: Get a list of audits
security:
- ApiKeyAuth: []
- TokenAuth: []
produces:
- application/json
responses:
'200':
description: Success
schema:
$ref: '#/definitions/RESTAuditsData'
/v1/log/event:
get:
tags:
- Log
summary: Get a list of events
security:
- ApiKeyAuth: []
- TokenAuth: []
produces:
- application/json
responses:
'200':
description: Success
schema:
$ref: '#/definitions/RESTEventsData'
/v1/log/incident:
get:
tags:
- Log
summary: Get a list of incidents
security:
- ApiKeyAuth: []
- TokenAuth: []
produces:
- application/json
responses:
'200':
description: Success
schema:
$ref: '#/definitions/RESTIncidentsData'
/v1/log/threat:
get:
tags:
- Log
summary: Get a list of threats
security:
- ApiKeyAuth: []
- TokenAuth: []
produces:
- application/json
responses:
'200':
description: Success
schema:
$ref: '#/definitions/RESTThreatsData'
/v1/log/threat/{id}:
get:
tags:
- Log
summary: Show threat
security:
- ApiKeyAuth: []
- TokenAuth: []
produces:
- application/json
parameters:
- in: path
name: id
description: Threat ID
required: true
type: string
responses:
'200':
description: Success
schema:
$ref: '#/definitions/RESTThreatData'
/v1/log/violation:
get:
tags:
- Log
summary: Get a list of violations
security:
- ApiKeyAuth: []
- TokenAuth: []
produces:
- application/json
responses:
'200':
description: Success
schema:
$ref: '#/definitions/RESTPolicyViolationsData'
/v1/log/violation/workload:
get:
tags:
- Log
summary: Get violation workloads
security:
- ApiKeyAuth: []
- TokenAuth: []
produces:
- application/json
responses:
'200':
description: Success
schema:
$ref: '#/definitions/RESTPolicyViolationsWLData'
/v1/log/security:
get:
tags:
- Log
summary: Get security event list
security:
- ApiKeyAuth: []
- TokenAuth: []
produces:
- application/json
responses:
'200':
description: Success
schema:
$ref: '#/definitions/RESTSecurityData'
definitions:
Audit:
type: object
required:
- level
- reported_timestamp
- reported_at
- cluster_name
- host_id
- host_name
- enforcer_id
- enforcer_name
- base_os
- high_vul_cnt
- medium_vul_cnt
- cvedb_version
- message
- user
- error
- aggregation_from
- count
- platform
- platform_version
properties:
name:
type: string
example: Container.Managed
level:
type: string
example: INFO
reported_timestamp:
type: integer
format: int64
example: 1516832670
reported_at:
type: string
format: date-time
example: 2018-01-24 22:24:30+00:00
cluster_name:
type: string
example: cluster1
response_rule_id:
type: integer
example: 10007
host_id:
type: string
example: 2AU7:TIEN:O5KX:QK56:LFQP:IJSV:FXBN:QJV7
host_name:
type: string
example: ubuntu64
enforcer_id:
type: string
example: bced57295eefbd3f3bd0cf798b6184fa789
enforcer_name:
type: string
example: allinone
workload_id:
type: string
example: 7df6a19648e2860c89fe12c8d5b1c52079a
workload_name:
type: string
example: ''
workload_domain:
type: string
example: ''
workload_image:
type: string
example: ''
workload_service:
type: string
example: ''
image:
type: string
example: alpine:3.16.1
image_id:
type: string
example: d572b7ee3511b21a2b78b8915bc03c5786ad01949704c1418624224c4cae2c5f
registry:
type: string
example: https://registry.hub.docker.com/
registry_name:
type: string
example: ''
repository:
type: string
example: alpine
tag:
type: string
example: latest
base_os:
type: string
example: ubuntu:16.04
high_vul_cnt:
type: integer
example: 1
medium_vul_cnt:
type: integer
example: 1
high_vuls:
type: array
items:
type: string
example: ''
medium_vuls:
type: array
items:
type: string
example: ''
cvedb_version:
type: string
example: '1.011'
message:
type: string
example: ''
user:
type: string
example: root
error:
type: string
example: Request failed
aggregation_from:
type: integer
format: int64
example: 1516832670
count:
type: integer
example: 10
items:
type: array
items:
type: string
example: ''
platform:
type: string
example: ''
platform_version:
type: string
example: ''
packages:
type: array
items:
type: string
example: ''
package_ver:
type: string
fixed_ver:
type: string
score:
type: number
format: float32
example: 7.3
score_v3:
type: number
format: float32
example: 7.3
vectors:
type: string
vectors_v3:
type: string
link:
type: string
description:
type: string
pub_date:
type: string
last_mod_date:
type: string
image_layer_digest:
type: string
example: sha256:08614570918e6832c44397cc7bce8037f07a8e2b87aec19d57a3da5eff274c7b
cmds:
type: string
Incident:
type: object
required:
- name
- level
- reported_timestamp
- reported_at
- cluster_name
- response_rule_id
- host_id
- host_name
- enforcer_id
- enforcer_name
- id
- workload_id
- workload_name
- workload_domain
- workload_image
- workload_service
- remote_workload_id
- remote_workload_name
- remote_workload_domain
- remote_workload_image
- remote_workload_service
- proc_name
- proc_path
- proc_cmd
- proc_real_uid
- proc_effective_uid
- proc_real_user
- proc_effective_user
- file_path
- file_name
- client_ip
- server_ip
- client_port
- server_port
- server_conn_port
- ether_type
- ip_proto
- conn_ingress
- proc_parent_name
- proc_parent_path
- action
- group
- rule_id
- aggregation_from
- count
- message
properties:
name:
type: string
example: Host.Suspicious.Process
level:
type: string
example: WARNING
reported_timestamp:
type: integer
format: int64
example: 1515020888
reported_at:
type: string
format: date-time
example: 2018-01-03 23:08:08+00:00
cluster_name:
type: string
example: cluster1
response_rule_id:
type: integer
example: 10006
host_id:
type: string
example: ubuntu64:ZYA3:UZL5:2WOT:QYEF:SLVT:LIBD
host_name:
type: string
example: ubuntu64
enforcer_id:
type: string
example: a928be54f34fbb696426890a7249c067
enforcer_name:
type: string
example: allinone
id:
type: string
example: e6e19591-75a0-43e9-bebb-145d588e6718
workload_id:
type: string
example: 83e76eabd68494649440fa0a35451315289c70eb3094454e419952dffaa7715a
workload_name:
type: string
example: iperfserver
workload_domain:
type: string
example: ''
workload_image:
type: string
example: iperfserver
workload_service:
type: string
example: iperfserver
remote_workload_id:
type: string
example: external
remote_workload_name:
type: string
example: iperfclient
remote_workload_domain:
type: string
example: ''
remote_workload_image:
type: string
example: iperfclient
remote_workload_service:
type: string
example: iperfclient
proc_name:
type: string
example: nc
proc_path:
type: string
example: /bin/nc.traditional
proc_cmd:
type: string
example: ./dns_tunneling/iodine/bin/iodine -f -r 172.17.0.3 -P
proc_real_uid:
type: integer
example: 1000
proc_effective_uid:
type: integer
example: 1000
proc_real_user:
type: string
example: test
proc_effective_user:
type: string
example: root
file_path:
type: string
example: ''
file_name:
type: array
items:
type: string
example: ''
client_ip:
type: string
example: 192.168.1.62
server_ip:
type: string
example: 10.1.4.3
client_port:
type: integer
format: uint16
example: 56564
server_port:
type: integer
format: uint16
example: 80
server_conn_port:
type: integer
format: uint16
example: 80
ether_type:
type: integer
format: uint16
example: 2048
ip_proto:
type: integer
format: uint8
example: 6
conn_ingress:
type: boolean
example: false
proc_parent_name:
type: string
example: sh
proc_parent_path:
type: string
example: /bin/dash
action:
type: string
example: violate
group:
type: string
example: nv.iperfserver
rule_id:
type: string
example: 00000000-0000-0000-0000-000000000001
aggregation_from:
type: integer
format: int64
example: 1515020888
count:
type: integer
example: 1
message:
type: string
example: dns tunneling
RESTAuditsData:
type: object
required:
- audits
properties:
audits:
type: array
items:
$ref: '#/definitions/Audit'
RESTPolicyViolationsData:
type: object
required:
- violations
properties:
violations:
type: array
items:
$ref: '#/definitions/Violation'
Event:
type: object
required:
- level
- reported_timestamp
- reported_at
- cluster_name
- host_id
- host_name
- enforcer_id
- enforcer_name
- controller_id
- controller_name
- workload_id
- workload_name
- workload_domain
- workload_image
- workload_service
- category
- user
- user_roles
- user_addr
- user_session
- message
properties:
name:
type: string
example: Container.Managed
level:
type: string
example: INFO
reported_timestamp:
type: integer
format: int64
example: 1516832670
reported_at:
type: string
format: date-time
example: 2018-01-24 22:24:30+00:00
cluster_name:
type: string
example: cluster1
response_rule_id:
type: integer
example: 10009
host_id:
type: string
example: QK56:LFQP:IJSV:FXBN:QJV7:5MBB:6PL5
host_name:
type: string
example: ubuntu64
enforcer_id:
type: string
example: bced57295eefbd3f3bd0cf798b6184fa789
enforcer_name:
type: string
example: allinone
controller_id:
type: string
example: ''
controller_name:
type: string
example: ''
workload_id:
type: string
example: 7df6a19648e2860c89fe12c8d5b1c52079a
workload_name:
type: string
example: kafkadocker_zookeeper_1
workload_domain:
type: string
example: ''
workload_image:
type: string
example: zookeeper
workload_service:
type: string
example: ''
category:
type: string
example: WORKLOAD
user:
type: string
example: user
user_roles:
type: object
description: map key is domain(string type)
additionalProperties:
type: string
example:
domain1: admin
domain2: reader
user_addr:
type: string
example: ''
user_session:
type: string
example: ''
rest_method:
type: string
example: ''
rest_request:
type: string
example: ''
rest_body:
type: string
example: ''
enforcer_limit:
type: integer
example: 0
license_expire:
type: string
example: ''
message:
type: string
example: Start managing container kafkadocker_zookeeper_1
Violation:
type: object
required:
- level
- reported_timestamp
- reported_at
- cluster_name
- host_id
- host_name
- enforcer_id
- enforcer_name
- id
- client_id
- client_name
- server_id
- server_name
- server_port
- ip_proto
- applications
- servers
- sessions
- policy_action
- policy_id
- client_ip
- server_ip
- fqdn
properties:
name:
type: string
example: ''
level:
type: string
example: WARNING
reported_timestamp:
type: integer
format: int64
example: 1516160219
reported_at:
type: string
format: date-time
example: 2018-01-17 03:36:59+00:00
cluster_name:
type: string
example: cluster1
response_rule_id:
type: integer
example: 10008
host_id:
type: string
example: 2AU7:TIEN:O5KX:QK56:LFQP:IJSV:FXBN:QJV7
host_name:
type: string
example: ubuntu64
enforcer_id:
type: string
example: bced57295eefbd3f3bd0cf798b6184fa789
enforcer_name:
type: string
example: allinone
id:
type: string
example: e6e19591-75a0-43e9-bebb-145d588e6718
client_id:
type: string
example: 25f773945fff1d8880b9eb67d26be22f5321d
client_name:
type: string
example: iperfclient
client_domain:
type: string
example: ''
client_image:
type: string
example: ''
client_service:
type: string
example: ''
server_id:
type: string
example: 0350077d87164505597268494acbc8a25109e3
server_name:
type: string
example: iperfserver
server_domain:
type: string
example: ''
server_image:
type: string
example: ''
server_service:
type: string
example: ''
server_port:
type: integer
format: uint16
example: 5000
ip_proto:
type: integer
format: uint8
example: 6
applications:
type: array
items:
type: string
example: HTTP
servers:
type: array
items:
type: string
example:
- server1
- server2
sessions:
type: integer
format: uint32
example: 0
policy_action:
type: string
example: violate
policy_id:
type: integer
format: uint32
example: 9999
client_ip:
type: string
example: 172.17.0.4
server_ip:
type: string
example: 172.17.0.3
fqdn:
type: string
example: www.suse.com
RESTEventsData:
type: object
required:
- events
properties:
events:
type: array
items:
$ref: '#/definitions/Event'
RESTThreatData:
type: object
required:
- threat
properties:
threat:
$ref: '#/definitions/Threat'
RESTScanBrief:
type: object
required:
- status
- high
- medium
- result
- scanned_timestamp
- scanned_at
- base_os
- scanner_version
- cvedb_create_time
properties:
status:
type: string
example: scheduled
high:
type: integer
example: 0
medium:
type: integer
example: 0
result:
type: string
example: success
scanned_timestamp:
type: integer
format: int64
example: 1516561253
scanned_at:
type: string
format: date-time
example: 2018-01-21 19:00:53+00:00
base_os:
type: string
example: ubuntu:16.04
scanner_version:
type: string
example: '1.011'
cvedb_create_time:
type: string
format: date-time
example: 2018-06-20 19:00:53+00:00
RESTWorkloadBrief:
type: object
required:
- id
- name
- display_name
- pod_name
- image
- image_id
- image_created_at
- platform_role
- domain
- state
- service
- author
- service_group
- cap_sniff
- cap_quarantine
- cap_change_mode
- policy_mode
- profile_mode
- scan_summary
- children
- service_mesh
- service_mesh_sidecar
- privileged
- run_as_root
- baseline_profile
properties:
id:
type: string
example: 7304e72fd093155c4cbcd65d07375329b2db82cc679
name:
type: string
example: k8s_POD.d86c_calico-node-mzhtk_kube-system_0050565a_365c13d
display_name:
type: string
example: calico-node-mzhtk
pod_name:
type: string
example: istio-policy-5cdbc47674-t67p4
image:
type: string
example: calico
image_id:
type: string
example: d572b7ee3511b21a2b78b8915bc03c5786ad01949704c1418624224c4cae2c5f
image_digest:
type: array
items:
type: string
example: c2ced31c5dda37cb805f481e3fa34b742cc8980f439b20af3111b08e66cff8e1
image_created_at:
type: string
format: date-time
example: 2018-01-18 00:44:02+00:00
image_reg_scanned:
type: boolean
example: false
platform_role:
type: string
example: core
domain:
type: string
example: ''
state:
type: string
example: exit
service:
type: string
example: kafkazookeeper
author:
type: string
example: ''
service_group:
type: string
example: nv.calico
share_ns_with:
type: string
example: cc0709d522749203042e89dba28bf6924a4b0d360648
cap_sniff:
type: boolean
example: true
cap_quarantine:
type: boolean
example: true
cap_change_mode:
type: boolean
example: true
policy_mode:
type: string
example: Discover
profile_mode:
type: string
example: Discover
scan_summary:
$ref: '#/definitions/RESTScanBrief'
children:
type: array
items:
$ref: '#/definitions/RESTWorkloadBrief'
quarantine_reason:
type: string
example: violation
service_mesh:
type: boolean
example: true
service_mesh_sidecar:
type: boolean
example: true
privileged:
type: boolean
example: true
run_as_root:
type: boolean
example: true
baseline_profile:
type: string
example: ''
RESTPolicyViolationsWLData:
type: object
required:
- violation_workloads
properties:
violation_workloads:
type: array
items:
$ref: '#/definitions/RESTViolationWorkload'
RESTThreatsData:
type: object
required:
- threats
properties:
threats:
type: array
items:
$ref: '#/definitions/Threat'
RESTIncidentsData:
type: object
required:
- incidents
properties:
incidents:
type: array
items:
$ref: '#/definitions/Incident'
Threat:
type: object
required:
- level
- reported_timestamp
- reported_at
- cluster_name
- host_id
- host_name
- enforcer_id
- enforcer_name
- id
- threat_id
- client_workload_id
- client_workload_name
- server_workload_id
- server_workload_name
- severity
- action
- count
- ether_type
- client_port
- server_port
- server_conn_port
- icmp_code
- icmp_type
- ip_proto
- client_ip
- server_ip
- application
- sensor
- group
- target
- monitor
- message
properties:
name:
type: string
example: HTTP.Request.Slowloris
level:
type: string
example: CRIT
reported_timestamp:
type: integer
format: int64
example: 1505755712
reported_at:
type: string
example: '2017-09-18T17:28:32Z'
cluster_name:
type: string
example: cluster1
response_rule_id:
type: integer
example: 10005
host_id:
type: string
example: ubuntu64:ZYA3:NPGZ:IU64:XJ3P:SUU3:QYEF:SLVT
host_name:
type: string
example: ubuntu64
enforcer_id:
type: string
example: 2fdc03e027d6483633376609
enforcer_name:
type: string
example: allinone
id:
type: string
example: 999-9c96-11e7-83c1-17580b
threat_id:
type: integer
format: uint32
example: 2017
client_workload_id:
type: string
example: 7e31a2a4d4074ba459f8c22ee90
client_workload_name:
type: string
example: iperfclient
client_workload_domain:
type: string
example: ''
client_workload_image:
type: string
example: ''
client_workload_service:
type: string
example: ''
server_workload_id:
type: string
example: 2cbab37b43efe049e583924a73a764b096ce8f15ea
server_workload_name:
type: string
example: iperfserver
server_workload_domain:
type: string
example: ''
server_workload_image:
type: string
example: ''
server_workload_service:
type: string
example: ''
severity:
type: string
example: critical
action:
type: string
example: monitor
count:
type: integer
format: uint32
example: 1
ether_type:
type: integer
format: uint16
example: 2048
client_port:
type: integer
format: uint16
example: 53825
server_port:
type: integer
format: uint16
example: 5000
server_conn_port:
type: integer
format: uint16
example: 5000
icmp_code:
type: integer
format: uint8
example: 0
icmp_type:
type: integer
format: uint8
example: 0
ip_proto:
type: integer
format: uint8
example: 6
client_ip:
type: string
example: 172.17.0.4
server_ip:
type: string
example: 172.17.0.3
application:
type: string
example: HTTP
sensor:
type: string
example: ''
group:
type: string
example: ''
target:
type: string
example: 'true'
monitor:
type: boolean
example: true
cap_len:
type: integer
format: uint16
example: 32043
packet:
type: string
example: base64string
message:
type: string
example: Header duration=3s, threshold=3s
RESTViolationWorkload:
type: object
required:
- workload
- count
properties:
workload:
$ref: '#/definitions/RESTWorkloadBrief'
count:
type: integer
example: 2
RESTSecurityData:
type: object
required:
- threats
- incidents
- violations
properties:
threats:
type: array
items:
$ref: '#/definitions/Threat'
incidents:
type: array
items:
$ref: '#/definitions/Incident'
violations:
type: array
items:
$ref: '#/definitions/Violation'
securityDefinitions:
ApiKeyAuth:
type: apiKey
in: header
name: X-Auth-Apikey
TokenAuth:
type: apiKey
in: header
name: X-Auth-Token
externalDocs:
description: Find out more about NeuVector
url: https://www.suse.com/products/neuvector/