1"use strict";(globalThis.webpackChunkwww=globalThis.webpackChunkwww||[]).push([[3503],{7940(e,s,n){n.r(s),n.d(s,{assets:()=>l,contentTitle:()=>c,default:()=>h,frontMatter:()=>i,metadata:()=>r,toc:()=>o});const r=JSON.parse('{"id":"api","title":"API","description":"The EveBox API is currently under active development and may change without notice. Endpoints, request parameters, and response formats are not subject to semantic versioning or backward compatibility guarantees.","source":"@site/docs/api.mdx","sourceDirName":".","slug":"/api","permalink":"/docs/api","draft":false,"unlisted":false,"tags":[],"version":"current","sidebarPosition":10,"frontMatter":{"sidebar_position":10},"sidebar":"docsSidebar","previous":{"title":"Extracted Files","permalink":"/docs/filestore"}}');var t=n(4848),d=n(8453);const i={sidebar_position:10},c="API",l={},o=[{value:"/api/pcap",id:"apipcap",level:2},{value:"/api/filestore",id:"apifilestore",level:2},{value:"/api/filestore/preview",id:"apifilestorepreview",level:3},{value:"/api/agents",id:"apiagents",level:2},{value:"/api/sensors",id:"apisensors",level:2},{value:"/api/alerts",id:"apialerts",level:2},{value:"/api/events",id:"apievents",level:2},{value:"/api/agg",id:"apiagg",level:2}];function a(e){const s={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",header:"header",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,d.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(s.header,{children:(0,t.jsx)(s.h1,{id:"api",children:"API"})}),"\n",(0,t.jsx)(s.admonition,{title:"No Stability Guarantees",type:"warning",children:(0,t.jsx)(s.p,{children:"The EveBox API is currently under active development and may change without notice. Endpoints, request parameters, and response formats are not subject to semantic versioning or backward compatibility guarantees."})}),"\n",(0,t.jsx)(s.h2,{id:"apipcap",children:"/api/pcap"}),"\n",(0,t.jsx)(s.p,{children:"Downloads packets from a configured server-local spool or a connected\nPCAP-capable EveBox Agent."}),"\n",(0,t.jsxs)(s.p,{children:[(0,t.jsx)(s.strong,{children:"Methods:"})," ",(0,t.jsx)(s.code,{children:"GET"}),", ",(0,t.jsx)(s.code,{children:"POST"})]}),"\n",(0,t.jsxs)(s.p,{children:[(0,t.jsx)(s.code,{children:"GET"})," accepts query parameters and streams the capture. ",(0,t.jsx)(s.code,{children:"POST"})," accepts\nthe same fields as JSON, buffers the result, and cannot exceed the fixed\n8,000,000-byte server limit. All request fields are strings."]}),"\n",(0,t.jsxs)(s.table,{children:[(0,t.jsx)(s.thead,{children:(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.th,{children:"Parameter"}),(0,t.jsx)(s.th,{children:"Description"})]})}),(0,t.jsxs)(s.tbody,{children:[(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"event_id"})}),(0,t.jsx)(s.td,{children:"EveBox datastore ID used to derive the event flow and time window."})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"filter"})}),(0,t.jsx)(s.td,{children:"Optional libpcap BPF expression."})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"start"})}),(0,t.jsx)(s.td,{children:"RFC 3339 start time for a free-form request."})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"duration"})}),(0,t.jsxs)(s.td,{children:["Window after ",(0,t.jsx)(s.code,{children:"start"}),"; defaults to ",(0,t.jsx)(s.code,{children:"1m"}),"."]})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"before"})}),(0,t.jsxs)(s.td,{children:["Window before an event timestamp. Requires ",(0,t.jsx)(s.code,{children:"event_id"}),"."]})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"after"})}),(0,t.jsxs)(s.td,{children:["Window after an event timestamp. Requires ",(0,t.jsx)(s.code,{children:"event_id"}),"."]})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"max_size"})}),(0,t.jsxs)(s.td,{children:["Output cap such as ",(0,t.jsx)(s.code,{children:"50mb"}),"; ",(0,t.jsx)(s.code,{children:"0"}),", ",(0,t.jsx)(s.code,{children:"none"}),", or ",(0,t.jsx)(s.code,{children:"unlimited"})," removes the cap for streaming GET requests."]})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"source"})}),(0,t.jsxs)(s.td,{children:["Optional source name: ",(0,t.jsx)(s.code,{children:"(server)"})," or a connected agent. Event requests normally route automatically."]})]})]})]}),"\n",(0,t.jsxs)(s.p,{children:["Use ",(0,t.jsx)(s.code,{children:"event_id"})," by itself for an event capture, ",(0,t.jsx)(s.code,{children:"event_id"})," with ",(0,t.jsx)(s.code,{children:"before"}),"\nor ",(0,t.jsx)(s.code,{children:"after"})," for an event-relative window, or ",(0,t.jsx)(s.code,{children:"start"})," with optional\n",(0,t.jsx)(s.code,{children:"duration"})," and ",(0,t.jsx)(s.code,{children:"filter"}
1)," for a free-form capture."]}),"\n",(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-bash",children:"curl --fail --get 'http://localhost:5636/api/pcap' \\\n --data-urlencode 'start=2026-07-13T12:00:00Z' \\\n --data-urlencode 'duration=5m' \\\n --data-urlencode 'filter=tcp port 443' \\\n --output capture.pcap\n"})}),"\n",(0,t.jsxs)(s.p,{children:[(0,t.jsx)(s.code,{children:"GET /api/pcap/validate"})," accepts the same query parameters and validates\nthe request without reading capture files. It returns ",(0,t.jsx)(s.code,{children:"ok"})," and the\nsuggested download filename, but does not check whether packets match."]}),"\n",(0,t.jsxs)(s.p,{children:[(0,t.jsx)(s.code,{children:"POST"})," returns a structured error when no packets match and sets\n",(0,t.jsx)(s.code,{children:"X-EveBox-PCAP-Truncated: true"})," when its buffered result reaches a size\nor scan limit. A streaming ",(0,t.jsx)(s.code,{children:"GET"})," with no matching or available packets\ninstead returns a valid, header-only capture. If a ",(0,t.jsx)(s.code,{children:"GET"})," reaches a limit\nafter its response headers have been sent, the partial capture cannot be\nmarked with a late truncation header. Successful responses include\n",(0,t.jsx)(s.code,{children:"X-EveBox-PCAP-Source"})," with the source that served the request."]}),"\n",(0,t.jsxs)(s.p,{children:[(0,t.jsx)(s.code,{children:"GET /api/pcap/sources"})," lists the sources currently available to the\n",(0,t.jsx)(s.code,{children:"source"})," parameter:"]}),"\n",(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-json",children:'{\n "sources": [\n {"name": "(server)", "kind": "server"}
1,\n {"name": "firewall-east", "kind": "agent"}\n ]\n}\n'})}),"\n",(0,t.jsx)(s.h2,{id:"apifilestore",children:"/api/filestore"}),"\n",(0,t.jsx)(s.admonition,{title:"New in EveBox 0.30.0",type:"info",children:(0,t.jsx)(s.p,{children:"This endpoint is only available in EveBox 0.30.0 and newer."})}),"\n",(0,t.jsxs)(s.p,{children:["Downloads a file extracted by Suricata's file-store (version 2) output\nfrom a configured server-local file store or a connected\nfilestore-capable EveBox Agent. See ",(0,t.jsx)(s.a,{href:"/docs/filestore",children:"Extracted Files"}),"."]}),"\n",(0,t.jsxs)(s.p,{children:[(0,t.jsx)(s.strong,{children:"Method:"})," ",(0,t.jsx)(s.code,{children:"GET"})]}),"\n",(0,t.jsxs)(s.table,{children:[(0,t.jsx)(s.thead,{children:(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.th,{children:"Parameter"}),(0,t.jsx)(s.th,{children:"Description"})]})}),(0,t.jsxs)(s.tbody,{children:[(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"event_id"})}),(0,t.jsxs)(s.td,{children:["EveBox datastore ID of a ",(0,t.jsx)(s.code,{children:"fileinfo"})," event or an alert with ",(0,t.jsx)(s.code,{children:"files"}),"."]})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"sha256"})}),(0,t.jsxs)(s.td,{children:["SHA-256 of the file. With ",(0,t.jsx)(s.code,{children:"event_id"}),", it must be a file the event references, and may be omitted when the event references only one."]})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"source"})}),(0,t.jsxs)(s.td,{children:["Optional source name: ",(0,t.jsx)(s.code,{children:"(server)"})," or a connected agent. Requests normally route automatically."]})]})]})]}),"\n",(0,t.jsxs)(s.p,{children:["At least one of ",(0,t.jsx)(s.code,{children:"event_id"})," or ",(0,t.jsx)(s.code,{children:"sha256"})," is required. A ",(0,t.jsx)(s.code,{children:"sha256"})," without\nan event downloads the file by digest alone."]}),"\n",(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-bash",children:"curl --fail --get 'http://localhost:5636/api/filestore' \\\n --data-urlencode 'sha256=<sha256>' \\\n --data-urlencode 'source=(server)' \\\n --output extracted.bin\n"})}),"\n",(0,t.jsxs)(s.p,{children:["Files are returned as ",(0,t.jsx)(s.code,{children:"application/octet-stream"})," attachments named by\ntheir SHA-256 digest. Successful responses include\n",(0,t.jsx)(s.code,{children:"X-EveBox-File-Source"})," with the source that served the request."]}),"\n",(0,t.jsxs)(s.p,{children:["Errors are returned as JSON with an error ",(0,t.jsx)(s.code,{children:"code"})," and ",(0,t.jsx)(s.code,{children:"message"}),". When an\nevent references several files and no ",(0,t.jsx)(s.code,{children:"sha256"})," is given, the response\nis ",(0,t.jsx)(s.code,{children:"409 Conflict"})," with code ",(0,t.jsx)(s.code,{children:"ambiguous-file"})," and the digests to choose\nfrom in ",(0,t.jsx)(s.code,{children:"candidates"}),". A file that is not in the file store returns\n",(0,t.jsx)(s.code,{children:"404 Not Found"})," with code ",(0,t.jsx)(s.code,{children:"file-not-found"}),"."]}),"\n",(0,t.jsxs)(s.p,{children:[(0,t.jsx)(s.code,{children:"GET /api/filestore/validate"})," accepts the same parameters and performs\nthe same event lookup, file selection and routing without downloading.\nFor the server-local store it also checks that the file exists and\nreturns its size. For a remote agent, validation does not check whether\nthe file exists; a preview or download can still fail with a missing-file\nerror."]}),"\n",(0,t.jsxs)(s.p,{children:[(0,t.jsx)(s.code,{children:"GET /api/filestore/sources"})," lists the sources currently available to\nthe ",(0,t.jsx)(s.code,{children:"source"})," parameter, in the same format as ",(0,t.jsx)(s.code,{children:"/api/pcap/sources"}),"."]}),"\n",(0,t.jsx)(s.h3,{id:"apifilestorepreview",children:"/api/filestore/preview"}),"\n",(0,t.jsxs)(s.p,{children:[(0,t.jsx)(s.strong,{children:"Method:"})," ",(0,t.jsx)(s.code,{children:"GET"})," (EveBox 0.30.0 and newer)"]}),"\n",(0,t.jsxs)(s.p,{children:["Accepts the same ",(0,t.jsx)(s.code,{children:"event_id"}),", ",(0,t.jsx)(s.code,{children:"sha256"}),", and ",(0,t.jsx)(s.code,{children:"source"})," parameters as the\nfull download endpoint, with the same file selection and routing.\nReturns at most the first ",(0,t.jsx)(s.strong,{children:"65,536 bytes (64 KiB)"})," of the file. The cap\nis fixed; there are no offset, length, or range options."]}),"\n",(0,t.jsx)(s.p,{children:"Successful responses contain raw bytes, not JSON, with these headers:"}),"\n",(0,t.jsxs)(s.table,{children:[(0,t.jsx)(s.thead,{children:(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.th,{children:"Header"}),(0,t.jsx)(s.th,{children:"Description"})]})}),(0,t.jsxs)(s.tbody,{children:[(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"Content-Type"})}),(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"application/octet-stream"})})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"Content-Length"})}),(0,t.jsx)(s.td,{children:"Number of bytes in the returned prefix."})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"X-EveBox-File-Size"})}),(0,t.jsx)(s.td,{children:"Size of the complete file in bytes."})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"X-EveBox-File-Source"})}),(0,t.jsx)(s.td,{children:"Source that served the request."})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"X-Content-Type-Options"})}),(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"nosniff"})})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"Content-Security-Policy"})}),(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"sandbox"})})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"Cache-Control"})}),(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"no-store"})})]})]})]}),"\n",(0,t.jsxs)(s.p,{children:["Unlike a full download, the preview has no ",(0,t.jsx)(s.code,{children:"Content-Disposition"})," header.\nThe web interface fetches these bytes and displays derived information,\nhex, decoded text, and strings rather than rendering the file itself.\nErrors use the same JSON ",(0,t.jsx)(s.code,{children:"error"})," object as the full download endpoint."]}),"\n",(0,t.jsxs)(s.p,{children:["Remote previews and downloads share a limit of 16 concurrent file jobs\nacross all agents. Each agent has separate single-request slots for\npreview and download. A busy source returns ",(0,t.jsx)(s.code,{children:"429 Too Many Requests"}),"\nwith code ",(0,t.jsx)(s.code,{children:"source-busy"}),"; local file requests bypass these limits."]}),"\n",(0,t.jsx)(s.h2,{id:"apiagents",children:"/api/agents"}),"\n",(0,t.jsxs)(s.p,{children:["Returns the currently connected EveBox Agents and their advertised\ncapabilities. The server-local PCAP spool is not an agent and is not\nincluded here; use ",(0,t.jsx)(s.code,{children:"/api/pcap/sources"})," for the complete PCAP source list."]}),"\n",(0,t.jsxs)(s.p,{children:[(0,t.jsx)(s.strong,{children:"Method:"})," ",(0,t.jsx)(s.code,{children:"GET"})]}),"\n",(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-json",children:'[\n {\n "name": "firewall-east",\n "hostname": "sensor01",\n "version": "0.27.0-dev",\n "capabilities": ["pcap"],\n "connected_at": "2026-07-15T18:00:00Z",\n "last_seen": "2026-07-15T18:01:00Z",\n "rtt_ms": 2\n }\n]\n'})}),"\n",(0,t.jsx)(s.h2,{id:"apisensors",children:"/api/sensors"}),"\n",(0,t.jsx)(s.p,{children:"Returns a list of all sensor names in your data."}),"\n",(0,t.jsxs)(s.p,{children:[(0,t.jsx)(s.strong,{children:"Method:"})," ",(0,t.jsx)(s.code,{children:"GET"})]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.strong,{children:"Example:"})}),"\n",(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-bash",children:'curl "http://localhost:5636/api/sensors"\n'})}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.strong,{children:"Response:"})}),"\n",(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-json",children:'{\n "data": ["sensor-1", "sensor-2", "sensor-3"]\n}\n'})}),"\n",(0,t.jsx)(s.h2,{id:"apialerts",children:"/api/alerts"}),"\n",(0,t.jsx)(s.p,{children:"Returns aggregated alerts grouped by signature, source IP, and destination IP."}),"\n",(0,t.jsxs)(s.p,{children:[(0,t.jsx)(s.strong,{children:"Method:"})," ",(0,t.jsx)(s.code,{children:"GET"})]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.strong,{children:"Parameters:"})}),"\n",(0,t.jsxs)(s.table,{children:[(0,t.jsx)(s.thead,{children:(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.th,{children:"Parameter"}),(0,t.jsx)(s.th,{children:"Description"}),(0,t.jsx)(s.th,{children:"Example"})]})}),(0,t.jsxs)(s.tbody,{children:[(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"sensor"})}),(0,t.jsx)(s.td,{children:"Filter by sensor name"}),(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"sensor=my-sensor"})})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"time_range"})}),(0,t.jsx)(s.td,{children:"Time window to query"}),(0,t.jsxs)(s.td,{children:[(0,t.jsx)(s.code,{children:"time_range=24h"}),", ",(0,t.jsx)(s.code,{children:"time_range=7d"})]})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"query_string"})}
1),(0,t.jsx)(s.td,{children:"Additional search filters"}),(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"query_string=src_ip:192.168.1.1"})})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"tags"})}),(0,t.jsx)(s.td,{children:"Filter by tags (comma-separated)"}),(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"tags=evebox.escalated"})})]})]})]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.strong,{children:"Example:"})}),"\n",(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-bash",children:'# Get alerts from the last 24 hours\ncurl "http://localhost:5636/api/alerts?time_range=24h"\n\n# Get alerts from a specific sensor\ncurl "http://localhost:5636/api/alerts?sensor=my-sensor&time_range=24h"\n'})}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.strong,{children:"Response:"})}),"\n",(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-json",children:'{\n "events": [...],\n "took": 42,\n "timed_out": false,\n "min_timestamp": "2025-12-28T00:00:00Z",\n "max_timestamp": "2025-12-29T00:00:00Z"\n}\n'})}),"\n",(0,t.jsx)(s.h2,{id:"apievents",children:"/api/events"}),"\n",(0,t.jsxs)(s.p,{children:["Returns individual events with optional filtering. With no ",(0,t.jsx)(s.code,{children:"size"})," or ",(0,t.jsx)(s.code,{children:"order"}),",\nthe endpoint returns up to 500 events, newest first."]}),"\n",(0,t.jsxs)(s.p,{children:[(0,t.jsx)(s.strong,{children:"Method:"})," ",(0,t.jsx)(s.code,{children:"GET"})]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.strong,{children:"Parameters:"})}),"\n",(0,t.jsxs)(s.table,{children:[(0,t.jsx)(s.thead,{children:(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.th,{children:"Parameter"}),(0,t.jsx)(s.th,{children:"Description"}),(0,t.jsx)(s.th,{children:"Default"}),(0,t.jsx)(s.th,{children:"Example"})]})}),(0,t.jsxs)(s.tbody,{children:[(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"event_type"})}),(0,t.jsx)(s.td,{children:"Exact event type to return."}),(0,t.jsx)(s.td,{children:"all types"}),(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"event_type=alert"})})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"sensor"})}),(0,t.jsx)(s.td,{children:"Exact sensor name to return."}),(0,t.jsx)(s.td,{children:"all sensors"}),(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"sensor=my-sensor"})})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"query_string"})}),(0,t.jsxs)(s.td,{children:["Additional ",(0,t.jsx)(s.code,{children:"field:value"})," filters. The sensor field is ",(0,t.jsx)(s.code,{children:"host"}),"."]}),(0,t.jsx)(s.td,{children:"none"}),(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"query_string=src_ip:192.168.1.1"})})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"from"})}),(0,t.jsx)(s.td,{children:"Inclusive ISO 8601 start timestamp."}),(0,t.jsx)(s.td,{children:"unbounded"}),(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"from=2025-12-28T00:00:00Z"})})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"to"})}),(0,t.jsx)(s.td,{children:"Inclusive ISO 8601 end timestamp."}),(0,t.jsx)(s.td,{children:"unbounded"}),(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"to=2025-12-29T00:00:00Z"})})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"size"})}),(0,t.jsx)(s.td,{children:"Positive number of events to return."}),(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"500"})}),(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"size=100"})})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"order"})}),(0,t.jsxs)(s.td,{children:["Timestamp order: ",(0,t.jsx)(s.code,{children:"asc"})," or ",(0,t.jsx)(s.code,{children:"desc"}),"."]}),(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"desc"})}),(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"order=asc"})})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"sort_by"})}),(0,t.jsx)(s.td,{children:"Elastic/OpenSearch field to sort by; ignored with SQLite."}),(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"@timestamp"})}),(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"sort_by=@timestamp"})})]})]})]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.strong,{children:"Examples:"})}),"\n",(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-bash",children:'# Get up to 500 recent alerts from a specific sensor.\ncurl "http://localhost:5636/api/events?event_type=alert&sensor=my-sensor"\n\n# The equivalent sensor filter using the query string.\ncurl "http://localhost:5636/api/events?event_type=alert&query_string=host:my-sensor"\n\n# Get the last 50 alerts.\ncurl "http://localhost:5636/api/events?event_type=alert&size=50&order=desc"\n'})}),"\n",(0,t.jsxs)(s.p,{children:["If authentication is required, add ",(0,t.jsx)(s.code,{children:"-u username:password"})," to the ",(0,t.jsx)(s.code,{children:"curl"}),"\ncommand or use an authenticated EveBox session."]}),"\n",(0,t.jsx)(s.h2,{id:"apiagg",children:"/api/agg"}),"\n",(0,t.jsx)(s.p,{children:"Groups events over a field and returns the counts for each value. Similar to\nan SQL query like:"}),"\n",(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-sql",children:"SELECT COUNT(event_type), event_type FROM events GROUP BY event_type ORDER BY count DESC;\n"})}),"\n",(0,t.jsxs)(s.p,{children:[(0,t.jsx)(s.strong,{children:"Method:"})," ",(0,t.jsx)(s.code,{children:"GET"})]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.strong,{children:"Parameters:"})}),"\n",(0,t.jsxs)(s.table,{children:[(0,t.jsx)(s.thead,{children:(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.th,{children:"Parameter"}),(0,t.jsx)(s.th,{children:"Description"}),(0,t.jsx)(s.th,{children:"Default"}),(0,t.jsx)(s.th,{children:"Example"})]})}),(0,t.jsxs)(s.tbody,{children:[(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"field"})}),(0,t.jsx)(s.td,{children:"Field name to group over"}),(0,t.jsx)(s.td,{children:"(required)"}),(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"field=event_type"})})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"time_range"})}),(0,t.jsx)(s.td,{children:"Time range to search over"}),(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"24h"})}),(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"time_range=7d"})})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"size"})}),(0,t.jsx)(s.td,{children:"Number of results to return"}),(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"10"})}),(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"size=20"})})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"order"})}),(0,t.jsxs)(s.td,{children:["Sort order (",(0,t.jsx)(s.code,{children:"desc"})," or ",(0,t.jsx)(s.code,{children:"asc"}),")"]}),(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"desc"})}),(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"order=asc"})})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"q"})}),(0,t.jsx)(s.td,{children:"Optional query string filter"}),(0,t.jsx)(s.td,{}),(0,t.jsx)(s.td,{children:(0,t.jsx)(s.code,{children:"q=src_ip:192.168.1.1"})})]})]})]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.strong,{children:"Example:"})}),"\n",(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-bash",children:'# Get top 10 event types in the last 24 hours\ncurl "http://localhost:5636/api/agg?field=event_type"\n\n# Get top 20 source IPs in the last 7 days\ncurl "http://localhost:5636/api/agg?field=src_ip&time_range=7d&size=20"\n'})}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.strong,{children:"Response:"})}),"\n",(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-json",children:'{\n "rows": [\n {"key": "alert", "count": 1234},\n {"key": "dns", "count": 567},\n {"key": "http", "count": 89}\n ]\n}\n'})})]})}function h(e={}){const{wrapper:s}={...(0,d.R)(),...e.components};return s?(0,t.jsx)(s,{...e,children:(0,t.jsx)(a,{...e})}):a(e)}},8453(e,s,n){n.d(s,{R:()=>i,x:()=>c});var r=n(6540);const t={},d=r.createContext(t);function i(e){const s=r.useContext(d);return r.useMemo(function(){return"function"==typeof e?e(s):{...s,...e}},[s,e])}function c(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:i(e.components),r.createElement(d.Provider,{value:s},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.