Using the REST API on the XGS. Fadly Yahaya SWAT

Transcription

1 Using the REST API on the XGS By Fadly Yahaya SWAT

2 Copyright International Business Machines Corporation Note to U.S. Government Users Restricted Rights -- Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

3 Contents Introduction... 4 Getting started with REST... 5 XGS REST API Token Authentication... 5 Using curl to Interact with XGS REST API... 6 Get Firmware information... 6 Get System time... 7 Get CPU utilization... 7 Get OpenSignatures... 8 Conclusion... 8 Resources... 8 About the author... 8

4 Introduction IBM Security Network Protection (XGS) is designed to protect your business-critical network infrastructure through a unique combination of threat protection, visibility and control. IBM extends the abilities of traditional intrusion prevention systems by offering a next-generation solution that provides network security professionals with tools to help protect their network, and provide visibility and control over it. IBM Security Network Protection helps reduce cost and complexity by consolidating point solutions into a single, extensible network security platform. And by controlling and eliminating non- critical, high-bandwidth activity, organizations may achieve additional cost savings within the infrastructure. Representational State Transfer (REST) defines a set of architectural principles by which you can design Web services that focus on a system's resources, including how resource states are addressed and transferred over HTTP. The REST Web service on the XGS: - Uses HTTP methods - Have Directory structure - URIs - Supports JavaScript Object Notation (JSON) The REST API supports security intelligence sharing and collaboration. Using the REST API, IBM and industry partners can share actionable threat indicators, have seamless integration and automated blocking of attacks.

5 Getting started with REST The following setup can be considered to showcase the REST API on the XGS In this document, we shall use a tool called curl to simulate GET, POST, PUT and DELETE request calls to the REST API on the XGS. GET - Retrieve all records, POST - Create a new record, PUT - Update a single record and DELETE - Remove a single record. First and foremost, you need to authenticate to the XGS. XGS REST API Token Authentication Using curl, you can issue the following command to authenticate to the XGS. curl -v -k -c cookies.txt -d '{username:admin; password:admin}' -H Content-type:application/json -H Accept:application/json -X POST Since we are interested in the request and response details, we pass the v command line argument to curl for a verbose output of the actual HTTP request and response. There are interesting details in the request and the response.

6 The k command line argument prevents certificate validation. The c command line argument causes curl to write the cookie to a file. The cookie is sent by the XGS. The d command line argument defines the data that we are posting to the XGS. In this case, it is the credentials for authenticating to the XGS. The credentials are the same ones used for accessing the local management interface (LMI) of the XGS. The H command line argument allows you to add custom HTTP headers to the request. The X command line argument defines the HTTP method used. And the remaining parameters specifies the IP address of the management port on the XGS and the REST command to login. After successful authentication, the XGS will respond with a cookie and csrftoken. These will be used with subsequent GET, POST, PUT and DELETE request calls to the REST API on the XGS Using curl to Interact with XGS REST API Get Firmware information You can issue the following command to get the firmware information on the XGS. curl s -k --cookie cookies.txt -H X-CSRF- TOKEN:MqyZsnHGhiPXtouiFPAwppmnHgK4cJyQgUGWuiVVu1Q= -H Contenttype:application/json -H Accept:application/json -X GET sed 's/,/,\n/g' The s command line argument is used to initiate silent (less verbose) mode. The -cookie command line argument defines the file that contains the cookie from the XGS. The H

7 command line argument allows you to add custom HTTP headers to the request and csrftoken information. sed is a stream editor to manipulate the text output. Here, we use sed 's/,/,\n/g' to replace the comma(s) with comma(s) and a new line. Get System time You can issue the following command to get the system time setting on the XGS. curl -s -k --cookie cookies.txt -H X-CSRF- TOKEN:MqyZsnHGhiPXtouiFPAwppmnHgK4cJyQgUGWuiVVu1Q= -H Contenttype:application/json -H Accept:application/json -X GET sed 's/,/,\n/g' Get CPU utilization You can issue the following command to get the CPU utilization on the XGS. curl -s -k --cookie cookies.txt -H X-CSRF- TOKEN:MqyZsnHGhiPXtouiFPAwppmnHgK4cJyQgUGWuiVVu1Q= -H Contenttype:application/json -H Accept:application/json -X GET sed 's/,/,\n/g'

8 Get OpenSignatures You can issue the following command to get the OpenSignatures deployed on the XGS. curl -s -k --cookie cookies.txt -H X-CSRF- TOKEN:MqyZsnHGhiPXtouiFPAwppmnHgK4cJyQgUGWuiVVu1Q= -H Contenttype:application/json -H Accept:application/json -X GET sed 's/,/,\n/g' Conclusion The purpose of this document is to provide an overview of the procedures and codes that can be used to show case the REST API on the XGS, to provide seamless integration, increase Intelligence sharing and collaboration. Resources The following IBM technote documents the REST commands supported by the XGS. About the author Fadly is a member of SWAT. He started his career in 2003 with Internet Security Systems, which was acquired by IBM in He currently serves as the subject matter expert for Infrastructure Security, utilizing the vast technical knowledge he gained in presales and post-sales for the past 12 years. Fadly is a rare technical talent that not only possesses the skills for designing solutions, but also performs implementation.

9 For more information To learn more about IBM Security Network Protection, visit: ibm.com/security International Business Machines Corporation 2016 International Business Machines Corporation New Orchard Road Armonk, NY All Rights Reserved References in this publication to IBM products and services do not imply that IBM intends to make them available in all countries in which IBM operates.