SoftLayer Network TippingPointReporting::drillDownAttack

From SoftLayer Development Network Wiki

Jump to: navigation, search

drillDownAttack is a member of the SoftLayer_Network_TippingPointReporting service.

Contents

Overview

This method, when given an attack signature ID (available in the return values of getReportForIpAddressOrSubnet and getSubnetReportForEntireAccount) and an IP Address and subnet mask, returns all attacks for that subnet in the specified time frame and direction. Once the results have been filtered, additional data is available, including starting and ending times for the attack, originating IP address and port, and destination IP address and port.

CVE and Bugtraq information is not available at this level.

User Access

Users wishing to execute drillDownAttack service must have the Network IDS permission assigned to their account.

Return Type

drillDownAttack returns the SoftLayer_Container_Network_IntrusionProtection_SubnetReport data type.

Headers

Required Headers

drillDownAttack requires the following headers:

Parameters

drillDownAttack takes the following parameters:

signatureId

The unique ID for this attack signature. SignatureId is a part of the data returned by getReportForIpAddressOrSubnet and getSubnetReportForEntireAccount on this service

  • Type: string


IpAddress

in dotted decimal format

  • Type: string


subnetMask

(optional) the number of bits that are set to 1 in the subnet mask. If your subnet is 192.168.1.1/24, enter 24 here. Default: 32

  • Type: integer
  • Default Value:32


timeFrame

(optional) number of minutes back to search from the present (default 60)

  • Type: integer
  • Default Value:60


direction

(optional) Either 'Inbound' or 'Outbound', determines which direction you would like to search. Default: Inbound

  • Type: string
  • Default Value:Inbound

Error Handling

drillDownAttack throws the following exceptions:

  • SoftLayer_Exception_Public
Throw the exception "Parameter 'timeFrame' not valid in SoftLayer_Network_TippingPointReporting getReportForIpAddressOrSubnet. Valid values are positive integers less than or equal to 1440" If an invalid argument was passed for the "timeFrame" value
  • SoftLayer_Exception_Public
Throw the exception "Parameter 'direction' not valid in SoftLayer_Network_TippingPointReporting getReportForIpAddressOrSubnet. Valid values are Inbound, Outbound" If an invalid attack direction has been specified
  • SoftLayer_Exception_Public
Throw the exception "IP address not assigned to this account: {Address}" If the supplied IP or subnet does not belong to this account
  • SoftLayer_Exception_Public
Throw the exception "Invalid IP Address: {Address}" If the supplied IP or subnet was not formatted correctly.
  • SoftLayer_Exception_Public
Throw the exception "There was a problem with the IP address you entered {Address}. Make sure the IP entered belongs to the current account." If there was an unrecoverable error with the passed IP Address
Retrieved from "http://sldn.softlayer.com/wiki/index.php/SoftLayer_Network_TippingPointReporting::drillDownAttack"
Personal tools