openapi: 3.2.0 info: title: Monitoring and Troubleshooting Monitoring - Security Unified Logging Connection Events API description: "Includes API operations for the following:\n Real-time monitoring\n Accessing statistics APIs and statistics bulk APIs\n Retrieving device state\n Managing alarms and events" contact: email: vmanage@cisco.com license: name: Commercial License url: https://www.cisco.com/c/en/us/solutions/enterprise-networks/sd-wan/index.html version: 26.1.0+2026-01-06 x-provenance: method: harvested authored_by: Cisco Catalyst SD-WAN harvested_by: API Evangelist harvested_on: '2026-08-19' first_party: true provider_published: true source_host: pubhub.devnetcloud.com note: 4,138 operations across 2,841 paths, published by Cisco as self-contained per-operation OpenAPI 3.1.0 fragments on the DevNet CDN and consolidated here into 13 documents. Ownership verified from info.contact vmanage@cisco.com and the Cisco license URL rather than from the fetch host. x-evidence: - type: source url: https://pubhub.devnetcloud.com/media/cisco-catalyst-sd-wan-26-1-api-guide/docs/ - type: source url: https://developer.cisco.com/docs/sdwan/ servers: - url: /dataservice tags: - name: Monitoring - Security Unified Logging Connection Events paths: /statistics/sul/connections: get: tags: - Monitoring - Security Unified Logging Connection Events description: Get security connection events stats raw data operationId: getSulStatDataRawData parameters: - name: query in: query description: Query string schema: type: string example: query: condition: AND rules: - value: - '24' field: entry_time type: date operator: last_n_hours - value: - 172.16.255.15 field: vdevice_name type: string operator: in - name: page in: query description: page number schema: minimum: 1 type: integer format: int64 - name: pageSize in: query description: page size schema: minimum: 1 type: integer format: int64 - name: sortBy in: query description: sort by schema: pattern: ^[a-zA-Z-_]+$ type: string - name: sortOrder in: query description: sort order schema: type: string responses: '200': description: Success content: application/json: schema: type: object examples: Search result: description: Search result value: data: - ip_proto: 6 device_model: vedge-CSR-1000v egress_intf: cpu packets: 5 src_ip: 10.20.24.1 fw_zone_pair: ulogging_in2out statcycletime: 1616121001459 octets: 300 sdvt_drop_reason_name: Service Node not healthy tenant: default dest_port: 80 entry_time: 1616120034778 create_time: 1616120009235 fw_dst_zone: ulogging_z_out end_time: 1616120024267 fw_action: Pass vmanage_system_ip: 172.16.255.15 fw_src_zone: ulogging_z_in fw_policy: p1 src_port: 34128 start_time: 1616120009235 application: unknown fw_protocol: http ingress_intf: GigabitEthernet5 fw_class: '1' vdevice_name: 172.16.255.15 dest_ip: 103.235.46.39 vip_idx: 1 family: network-service host_name: vm5 vpn_id: 1 id: _dlRSHgBQcANHsKKdbP0 '400': description: Bad Request '403': description: Forbidden '500': description: Internal Server Error x-roles-required: Device Monitoring-read post: tags: - Monitoring - Security Unified Logging Connection Events description: Get stats raw data operationId: getStatsRawData_MonitoringSecurityUnifiedLoggingConnectionEvents_2704 parameters: - name: page in: query description: page number schema: minimum: 1 type: integer format: int64 - name: pageSize in: query description: page size schema: minimum: 1 type: integer format: int64 - name: sortBy in: query description: sort by schema: pattern: ^[a-zA-Z-_]+$ type: string - name: sortOrder in: query description: sort order schema: type: string requestBody: description: Stats query string content: application/json: schema: type: object examples: Stats query string: description: Stats query string value: query: condition: AND rules: - value: - '24' field: entry_time type: date operator: last_n_hours - value: - 172.16.255.15 field: vdevice_name type: string operator: in required: true responses: '200': description: Success content: application/json: schema: type: object examples: Search result: description: Search result value: data: - ip_proto: 6 device_model: vedge-CSR-1000v egress_intf: cpu packets: 5 src_ip: 10.20.24.1 fw_zone_pair: ulogging_in2out statcycletime: 1616121001459 octets: 300 sdvt_drop_reason_name: Service Node not healthy tenant: default dest_port: 80 entry_time: 1616120034778 create_time: 1616120009235 fw_dst_zone: ulogging_z_out end_time: 1616120024267 fw_action: Pass vmanage_system_ip: 172.16.255.15 fw_src_zone: ulogging_z_in fw_policy: p1 src_port: 34128 start_time: 1616120009235 application: unknown fw_protocol: http ingress_intf: GigabitEthernet5 fw_class: '1' vdevice_name: 172.16.255.15 dest_ip: 103.235.46.39 vip_idx: 1 family: network-service host_name: vm5 vpn_id: 1 id: _dlRSHgBQcANHsKKdbP0 '400': description: Bad Request '403': description: Forbidden '500': description: Internal Server Error x-roles-required: Device Monitoring-read /statistics/sul/connections/aggregation: get: tags: - Monitoring - Security Unified Logging Connection Events description: Get aggregated data based on input query and filters. The data can be filtered on time and other unique parameters based upon necessity and intended usage operationId: getAggregationDataByQuery_MonitoringSecurityUnifiedLoggingConnectionEvents_3903 parameters: - name: query in: query description: Query filter schema: type: string example: query: condition: AND rules: - value: - '24' field: entry_time type: date operator: last_n_hours - value: - 172.16.255.15 field: vdevice_name type: string operator: in responses: '200': description: Success content: application/json: schema: type: object examples: Aggregated each result: description: Aggregated each result value: data: - latency: 0.6404125644631974 '400': description: Bad Request '403': description: Forbidden '500': description: Internal Server Error x-roles-required: Device Monitoring-read post: tags: - Monitoring - Security Unified Logging Connection Events description: Get aggregated data based on input query and filters. The data can be filtered on time and other unique parameters based upon necessity and intended usage operationId: getPostAggregationDataByQuery_MonitoringSecurityUnifiedLoggingConnectionEvents_3904 requestBody: description: Stats query string content: application/json: schema: type: object examples: Stats query string: description: Stats query string value: query: condition: AND rules: - value: - '24' field: entry_time type: date operator: last_n_hours - value: - 172.16.255.15 field: vdevice_name type: string operator: in required: true responses: '200': description: Success content: application/json: schema: type: object examples: Aggregated search result: description: Aggregated search result value: data: - ip_proto: 6 device_model: vedge-CSR-1000v egress_intf: cpu packets: 5 src_ip: 10.20.24.1 statcycletime: 1616170802027 octets: 300 sdvt_drop_reason_name: Service Node not healthy tenant: default dest_port: 80 entry_time: 1616170026992 create_time: 1616170001492 end_time: 1616170016505 fw_action: Pass vmanage_system_ip: 172.16.255.15 fw_policy: p1 src_port: 53105 start_time: 1616170001492 application: unknown fw_protocol: http ingress_intf: GigabitEthernet5 fw_class: '1' vdevice_name: 172.16.255.15 dest_ip: 90.130.70.73 vip_idx: 1 family: network-service host_name: vm5 vpn_id: 1 id: uNlJS3gBQcANHsKKW_5s pageInfo: startTime: '1615956601540' endTime: '1616170802027' scrollId: DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAQXMWSm81WWtQX1NUeXU4UnpKYm9VV2Nudw==_500 hasMoreData: false count: 14 totalCount: 14 '400': description: Bad Request '403': description: Forbidden '500': description: Internal Server Error x-roles-required: Device Monitoring-read,dca /statistics/sul/connections/app-agg/aggregation: post: tags: - Monitoring - Security Unified Logging Connection Events description: Get aggregated data based on input query and filters. The data can be filtered on time and other unique parameters based upon necessity and intended usage operationId: getPostAggregationAppDataByQuery_MonitoringSecurityUnifiedLoggingConnectionEvents_4704 requestBody: description: Stats query string content: application/json: schema: type: object examples: Stats query string: description: Stats query string value: query: field: latency type: long value: - '1' operator: greater fields: - latency aggregation: metrics: - property: latency type: avg required: true responses: '200': description: Success content: application/json: schema: type: object examples: Aggregated search result: description: Aggregated search result value: data: - latency: 0.6404125644631974 '400': description: Bad Request '403': description: Forbidden '500': description: Internal Server Error x-roles-required: Device Monitoring-read,dca /statistics/sul/connections/csv: get: tags: - Monitoring - Security Unified Logging Connection Events description: Get raw data with optional query as CSV operationId: getStatDataRawDataAsCSV_MonitoringSecurityUnifiedLoggingConnectionEvents_3103 parameters: - name: query in: query description: Query string schema: type: string example: query: condition: AND rules: - value: - '168' field: entry_time type: date operator: last_n_hours - value: - '1' field: vpn_id type: int operator: in - value: - p1 field: fw_policy type: string operator: in - value: - 172.16.255.15 field: vdevice_name type: string operator: in responses: '200': description: Success content: text/csv: schema: type: string examples: Search result in csv format: description: Search result in csv format value: blob:https:///82c972bc-f9b3-4cce-bb70-1e1b033ef1cd '400': description: Bad Request '403': description: Forbidden '500': description: Internal Server Error x-roles-required: Device Monitoring-read /statistics/sul/connections/doccount: get: tags: - Monitoring - Security Unified Logging Connection Events description: Get response count of a query operationId: getCount_MonitoringSecurityUnifiedLoggingConnectionEvents_3603 parameters: - name: query in: query description: Query required: true schema: type: string example: query: condition: AND rules: - value: - '24' field: entry_time type: date operator: last_n_hours - value: - 172.16.255.15 field: vdevice_name type: string operator: in responses: '200': description: Success content: application/json: schema: type: object examples: Query result count: description: Query result count value: count: 9642 '400': description: Bad Request '403': description: Forbidden '500': description: Internal Server Error post: tags: - Monitoring - Security Unified Logging Connection Events description: Get response count of a query operationId: getCountPost_MonitoringSecurityUnifiedLoggingConnectionEvents_3604 requestBody: description: Query content: application/json: schema: type: object examples: Query: description: Query value: query: condition: AND rules: - value: - '24' field: entry_time type: date operator: last_n_hours - value: - 172.16.255.15 field: vdevice_name type: string operator: in required: true responses: '200': description: Success content: application/json: schema: type: object examples: Query result count: description: Query result count value: count: 9642 '400': description: Bad Request '403': description: Forbidden '500': description: Internal Server Error /statistics/sul/connections/fields: get: tags: - Monitoring - Security Unified Logging Connection Events description: Get fields and type operationId: getStatDataFields_MonitoringSecurityUnifiedLoggingConnectionEvents_3403 responses: '200': description: Success content: application/json: schema: type: object example: - dataType: string property: mac - dataType: string property: vap - dataType: number property: rssi - dataType: string property: mode - dataType: number property: bandwidth - dataType: string property: data_security - dataType: number property: rx_rate - dataType: string property: assoc_time - dataType: date property: entry_time - dataType: date property: statcycletime - dataType: string property: ssid - dataType: number property: vip_idx - dataType: date property: vip_time - dataType: string property: vdevice_name - dataType: string property: host_name - dataType: string property: device_model '400': description: Bad Request '403': description: Forbidden '500': description: Internal Server Error /statistics/sul/connections/filter/policy_name/{policyType}: get: tags: - Monitoring - Security Unified Logging Connection Events description: Get filter Policy Name list operationId: getFilterPolicyNameList parameters: - name: policyType in: path description: Policy type required: true schema: type: string enum: - zoneBasedFW - intrusionPrevention - urlFiltering - advancedMalwareProtection - name: query in: query description: query string required: true schema: type: string example: query: condition: AND rules: - field: vdevice_name type: string operator: in value: - 172.16.255.15 responses: '200': description: Success content: application/json: schema: type: array items: type: object examples: Filter Policy Name list: description: Filter Policy Name list value: - fw_policy: FW-Block-AV - fw_policy: FW-Block-p2p - fw_policy: FW_policy1 '400': description: Bad Request '403': description: Forbidden '500': description: Internal Server Error /statistics/sul/connections/page: get: tags: - Monitoring - Security Unified Logging Connection Events description: Get stats raw data operationId: getStatsPaginationRawData_MonitoringSecurityUnifiedLoggingConnectionEvents_3203 parameters: - name: query in: query description: Query string schema: type: string example: query: condition: AND rules: - value: - '24' field: entry_time type: date operator: last_n_hours - name: scrollId in: query description: ES scroll Id schema: type: string example: DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAOIWZ1NQbXpvQ29Uc0stNzZ2UzlwTEREUQ== - name: count in: query description: Result size schema: type: integer format: int64 example: 10 responses: '200': description: Success content: application/json: schema: type: object examples: Search result: description: Search result value: data: - mem_used: 19407626240 disk_avail: 9305948160 device_model: vmanage mem_cached: 6740430848 mem_util: 0.59 min1_avg: 0.92 disk_used: 5789007872 statcycletime: 1647394800045 tenant: 57501bad-32a7-4f52-8f54-8547dcd7403e entry_time: 1647393870251 runningp: 0 cpu_user: 8.63 cpu_idle_new: 88.14 vip_time: 1647393870252 min15_avg: 1.08 totalp: 2427 cpu_idle: 88.14 mem_buffers: 892911616 cpu_system: 3.23 vmanage_system_ip: 169.254.10.2 min5_avg: 1.07 cpu_min1_avg: 0.115 mem_free: 5716930560 vdevice_name: 172.16.255.201 vip_idx: 82 cpu_min15_avg: 0.135 system_ip: 172.16.255.201 cpu_user_new: 8.63 cpu_system_new: 3.23 host_name: vm201 cpu_min5_avg: 0.13375 id: 4YphkH8BPIGvVbrdtzXi - mem_used: 19534016512 disk_avail: 9304268800 device_model: vmanage mem_cached: 6747897856 mem_util: 0.6 min1_avg: 1.14 disk_used: 5790687232 statcycletime: 1647394800046 tenant: 57501bad-32a7-4f52-8f54-8547dcd7403e entry_time: 1647394110479 runningp: 0 cpu_user: 5.53 cpu_idle_new: 91.49 vip_time: 1647394110479 min15_avg: 1.1 totalp: 2323 cpu_idle: 91.49 mem_buffers: 902213632 cpu_system: 2.97 vmanage_system_ip: 169.254.10.2 min5_avg: 1.14 cpu_min1_avg: 0.1425 mem_free: 5573771264 vdevice_name: 172.16.255.201 vip_idx: 86 cpu_min15_avg: 0.1375 system_ip: 172.16.255.201 cpu_user_new: 5.53 cpu_system_new: 2.97 host_name: vm201 cpu_min5_avg: 0.1425 id: 5YphkH8BPIGvVbrdtzXi pageInfo: startTime: '1647394800045' endTime: '1647394800047' scrollId: DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAf4WcUlydS1uYzlTdXFhR05GTlBpTFJ4QQ== hasMoreData: true count: 2 totalCount: 11140 '400': description: Bad Request '403': description: Forbidden '500': description: Internal Server Error x-roles-required: Device Monitoring-read post: tags: - Monitoring - Security Unified Logging Connection Events description: Get stats raw data operationId: getPostStatsPaginationRawData_MonitoringSecurityUnifiedLoggingConnectionEvents_3204 parameters: - name: scrollId in: query description: ES scroll Id schema: type: string example: DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAOIWZ1NQbXpvQ29Uc0stNzZ2UzlwTEREUQ== - name: count in: query description: Result size schema: type: integer format: int64 example: 10 requestBody: description: Stats query string content: application/json: schema: type: object examples: Stats query string: description: Stats query string value: query: condition: AND rules: - value: - '24' field: entry_time type: date operator: last_n_hours required: true responses: '200': description: Success content: application/json: schema: type: object examples: Search result: description: Search result value: data: - mem_used: 19407626240 disk_avail: 9305948160 device_model: vmanage mem_cached: 6740430848 mem_util: 0.59 min1_avg: 0.92 disk_used: 5789007872 statcycletime: 1647394800045 tenant: 57501bad-32a7-4f52-8f54-8547dcd7403e entry_time: 1647393870251 runningp: 0 cpu_user: 8.63 cpu_idle_new: 88.14 vip_time: 1647393870252 min15_avg: 1.08 totalp: 2427 cpu_idle: 88.14 mem_buffers: 892911616 cpu_system: 3.23 vmanage_system_ip: 169.254.10.2 min5_avg: 1.07 cpu_min1_avg: 0.115 mem_free: 5716930560 vdevice_name: 172.16.255.201 vip_idx: 82 cpu_min15_avg: 0.135 system_ip: 172.16.255.201 cpu_user_new: 8.63 cpu_system_new: 3.23 host_name: vm201 cpu_min5_avg: 0.13375 id: 4YphkH8BPIGvVbrdtzXi - mem_used: 19534016512 disk_avail: 9304268800 device_model: vmanage mem_cached: 6747897856 mem_util: 0.6 min1_avg: 1.14 disk_used: 5790687232 statcycletime: 1647394800046 tenant: 57501bad-32a7-4f52-8f54-8547dcd7403e entry_time: 1647394110479 runningp: 0 cpu_user: 5.53 cpu_idle_new: 91.49 vip_time: 1647394110479 min15_avg: 1.1 totalp: 2323 cpu_idle: 91.49 mem_buffers: 902213632 cpu_system: 2.97 vmanage_system_ip: 169.254.10.2 min5_avg: 1.14 cpu_min1_avg: 0.1425 mem_free: 5573771264 vdevice_name: 172.16.255.201 vip_idx: 86 cpu_min15_avg: 0.1375 system_ip: 172.16.255.201 cpu_user_new: 5.53 cpu_system_new: 2.97 host_name: vm201 cpu_min5_avg: 0.1425 id: 5YphkH8BPIGvVbrdtzXi pageInfo: startTime: '1647394800045' endTime: '1647394800047' scrollId: DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAf4WcUlydS1uYzlTdXFhR05GTlBpTFJ4QQ== hasMoreData: true count: 2 totalCount: 11140 '400': description: Bad Request '403': description: Forbidden '500': description: Internal Server Error x-roles-required: Device Monitoring-read /statistics/sul/connections/query/fields: get: tags: - Monitoring - Security Unified Logging Connection Events description: Get query fields operationId: getStatQueryFields_MonitoringSecurityUnifiedLoggingConnectionEvents_4003 responses: '200': description: Success content: application/json: schema: type: object examples: Query result count: description: Query result count value: data: - property: entry_time name: Event Time isRequired: true dataType: date fieldData: type: dateList options: - key: last_1_hour value: Last 1 hour number: '1' enableDateFields: false - key: last_3_hours value: Last 3 hours number: '3' enableDateFields: false - key: last_6_hours value: Last 6 hours number: '6' enableDateFields: false - key: last_12_hours value: Last 12 hours number: '12' enableDateFields: false - key: last_24_hours value: Last 24 hours number: '24' enableDateFields: false isSelected: true - key: last_168_hours value: Last 7 days number: '168' enableDateFields: false - key: custom value: Custom enableDateFields: true - property: vdevice_name name: Device name isRequired: true multiSelect: false dataType: string '400': description: Bad Request '403': description: Forbidden '500': description: Internal Server Error