Trellix Web Gateway Traffic Logs API

openapi: 3.1.0
info:
  title: Trellix Web Gateway Policy Anti-Malware Traffic Logs API
  description: API for creating, updating, and managing security policies, rule sets, and configurations for web filtering and threat prevention on Trellix Web Gateway (formerly McAfee Web Gateway). Provides programmatic access to policy rules, URL filter settings, anti-malware settings, and SSL scanning configurations.
  version: '1.0'
  contact:
    name: Trellix Support
    url: https://www.trellix.com/support/
    email: support@trellix.com
  termsOfService: https://www.trellix.com/legal/terms-of-use/
servers:
- url: https://{mwg-server}:{port}/Konfigurator/REST/policy
  description: Trellix Web Gateway Policy Endpoint
  variables:
    mwg-server:
      default: mwg.example.com
      description: Hostname or IP address of the Web Gateway appliance
    port:
      default: '4712'
      description: Management port for the REST API
security:
- cookieAuth: []
tags:
- name: Traffic Logs
  description: Web traffic log access and search
paths:
  /logs/traffic:
    get:
      operationId: getTrafficLogs
      summary: Retrieve web traffic logs
      description: Query web traffic access logs with optional filtering by time range, source IP, destination URL, action, and other criteria.
      tags:
      - Traffic Logs
      parameters:
      - $ref: '#/components/parameters/startTime'
      - $ref: '#/components/parameters/endTime'
      - name: sourceIp
        in: query
        description: Filter by source IP address
        schema:
          type: string
      - name: destinationUrl
        in: query
        description: Filter by destination URL pattern
        schema:
          type: string
      - name: action
        in: query
        description: Filter by action taken
        schema:
          type: string
          enum:
          - allowed
          - blocked
          - redirected
      - name: user
        in: query
        description: Filter by authenticated user name
        schema:
          type: string
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/offset'
      responses:
        '200':
          description: Traffic log entries returned
          content:
            application/json:
              schema:
                type: object
                properties:
                  totalCount:
                    type: integer
                    description: Total number of matching entries
                  entries:
                    type: array
                    items:
                      $ref: '#/components/schemas/TrafficLogEntry'
        '401':
          description: Unauthorized
  /logs/traffic/{logId}:
    get:
      operationId: getTrafficLogEntry
      summary: Get a specific traffic log entry
      description: Retrieve detailed information about a specific traffic log entry.
      tags:
      - Traffic Logs
      parameters:
      - $ref: '#/components/parameters/logId'
      responses:
        '200':
          description: Traffic log entry details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TrafficLogEntry'
        '401':
          description: Unauthorized
        '404':
          description: Log entry not found
components:
  parameters:
    endTime:
      name: endTime
      in: query
      description: End time for the query range (ISO 8601)
      schema:
        type: string
        format: date-time
    logId:
      name: logId
      in: path
      required: true
      description: Unique identifier of the log entry
      schema:
        type: string
    startTime:
      name: startTime
      in: query
      description: Start time for the query range (ISO 8601)
      schema:
        type: string
        format: date-time
    offset:
      name: offset
      in: query
      description: Number of results to skip for pagination
      schema:
        type: integer
        default: 0
    limit:
      name: limit
      in: query
      description: Maximum number of results to return
      schema:
        type: integer
        default: 100
        maximum: 1000
  schemas:
    TrafficLogEntry:
      type: object
      properties:
        id:
          type: string
          description: Unique log entry identifier
        timestamp:
          type: string
          format: date-time
          description: Time the request was processed
        sourceIp:
          type: string
          description: Client source IP address
        user:
          type: string
          description: Authenticated user name
        method:
          type: string
          description: HTTP method
        url:
          type: string
          description: Requested URL
        statusCode:
          type: integer
          description: HTTP response status code
        action:
          type: string
          enum:
          - allowed
          - blocked
          - redirected
          description: Action taken by the gateway
        category:
          type: string
          description: URL category classification
        bytesIn:
          type: integer
          description: Bytes received from the client
        bytesOut:
          type: integer
          description: Bytes sent to the client
        duration:
          type: integer
          description: Request processing duration in milliseconds
        ruleName:
          type: string
          description: Name of the policy rule that matched
        mediaType:
          type: string
          description: Content media type
        userAgent:
          type: string
          description: Client user agent string
  securitySchemes:
    cookieAuth:
      type: apiKey
      in: cookie
      name: JSESSIONID
      description: Session cookie obtained via the Konfigurator REST /login endpoint.
externalDocs:
  description: Trellix Web Gateway Policy API Documentation
  url: https://docs.trellix.com/bundle/web-gateway-policy-api