The Artica PCAP REST API service

• Return back to Artica PCAP filter main section

The Web service lets you control the Artica PCAP daemon via json.

Enable/Disable the Web API service

Tokens -http-on -http-off enable or disable the HTTP service. 
When the HTTP service is enabled, Artica uses a random port, binds to the loopback interface and creates a random API key for authentication.

Set the listening port

Use the token -http-port [port number] to define the listening port of the HTTP service.

Set the listening interface

By default, the HTTP service binds to the loopback interface; use the token -http-interface [interface name] to change the listening interface.

Set the API Key

The API Key allows you to query the HTTP service by adding X-Auth-Token: API Key in the request header except if you query the engine from the 127.0.0.1 address.
Use the token -http-key to define the key. 

API key exception

Some HTTP client engines may not allow you to add the X-Auth-Token HTTP header. 
You can specify which source IP addresses will be exempt from API key verification.
Provide a comma-separated list of source IP addresses exempt from API key verification with the token -http-nokey

-http-nokey 192.168.1.1,10.1.2.3,172.16.23.2

Get the status of the service

http://[ip]:[port]/

This will output JSON like this:

{  "content": {
      "Status": true,
      "Error": "",        
"Version": "1.0.34",        
"MemoryRecord": {},        
"MemoryCacheRecords": 3310,        
"MemorCacheSize": 26480,        
"DatabaseSize": 306970624,        
"DatabaseRecords": 3728241,        
"DNSRequests": 56593,        
"ScannedIPs": 238650,    
"MemoryUsage: 2309988944,    
"Result": ""  }  
}

The most important fields are: 

• MemoryCacheRecords: The number of records saved in temporary buffer.
• MemorCacheSize: Temporary buffer size in bytes.
• DatabaseSize: Size in bytes of the defined sources memory database.
• DatabaseRecords : Number of records from defined sources stored in the memory database
• DNSRequests: Number of DNS requests (including host resolutions and RBL queries)
• ScannedIPs: Number of queries to the memory databases
• MemoryUsage: Memory of the Artica PCAP process in bytes

Query the reputation of an IP address

http://[ip]:[port]/scan/1.2.3.4 or http://[ip]:[port]/scan/1.2.3.4:80

This will output JSON like this:

{  "content": {        
"Status": true,        
"Error": "",        
"Version": "1.0.34",        
"MemoryRecord": {            
                "ipStr": "192.231.100.1",            
                "dnsResults": "",            
                "rblServer": "",            
                "rblResults": "",            
              "cachesResult": "BAD",            
              "geoIPCode": "",            
              "geoIPRule": "",            
              "geoIPLog": "",            
              "geoIPCountry": "",            
              "hostname": "Unknown",            
              "memoryCache": {                
                  "fileid": 2,                
                "cacheType": "Sourcefirehol_level1",                
                "category": ""            
},            
      "dstPort": 22,            
      "savedTime": 1691518570,            
        "tempTime": 1691518570,            
        "remediationTime": 1691518570,            
        "remediationTimeout": false    },        
"MemoryCacheRecords": 376,        
"MemorCacheSize": 3008,        
"DatabaseSize": 306970624,        
"DatabaseRecords": 3728241,        
"DNSRequests": 1129,        
"ScannedIPs": 1797,      
"Result": "BAD"  }  
}

• Result: "BAD OR GOOD"
• cachesResult: "BAD OR GOOD"
• dnsResults: Set if an RBL check was performed
• rblServer: which RBL server answered that the IP is bad
• geoIPCode: Country Code from geo**-**localization
• geoIPRule: GeoIP rule that set the IP as BAD
• hostname: Resolved Hostname
• memoryCache/FileID: The ID of the source file that matched the IP address as BAD
• memoryCache/cacheType: The category of the source file.
• memoryCache/category: Used only by the CyberCrime IP Feeds feature ( Artica appliance )

Reload the service

Reload parameters and reload databases in memory:

http://[ip]:[port]/service/reload