swagger: '2.0'
info:
  description: Secure Docker and Kubernetes based container deployments with the NeuVector run-time security solution.
  version: 5.6.0
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0.html
  title: NeuVector Log API
  contact:
    email: support@neuvector.com
schemes:
- https
tags:
- name: Log
  description: Operations about Log
paths:
  /v1/log/activity:
    get:
      tags:
      - Log
      summary: Get activity list
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      produces:
      - application/json
      responses:
        '200':
          description: Success
          schema:
            $ref: '#/definitions/RESTEventsData'
  /v1/log/audit:
    get:
      tags:
      - Log
      summary: Get a list of audits
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      produces:
      - application/json
      responses:
        '200':
          description: Success
          schema:
            $ref: '#/definitions/RESTAuditsData'
  /v1/log/event:
    get:
      tags:
      - Log
      summary: Get a list of events
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      produces:
      - application/json
      responses:
        '200':
          description: Success
          schema:
            $ref: '#/definitions/RESTEventsData'
  /v1/log/incident:
    get:
      tags:
      - Log
      summary: Get a list of incidents
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      produces:
      - application/json
      responses:
        '200':
          description: Success
          schema:
            $ref: '#/definitions/RESTIncidentsData'
  /v1/log/threat:
    get:
      tags:
      - Log
      summary: Get a list of threats
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      produces:
      - application/json
      responses:
        '200':
          description: Success
          schema:
            $ref: '#/definitions/RESTThreatsData'
  /v1/log/threat/{id}:
    get:
      tags:
      - Log
      summary: Show threat
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      produces:
      - application/json
      parameters:
      - in: path
        name: id
        description: Threat ID
        required: true
        type: string
      responses:
        '200':
          description: Success
          schema:
            $ref: '#/definitions/RESTThreatData'
  /v1/log/violation:
    get:
      tags:
      - Log
      summary: Get a list of violations
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      produces:
      - application/json
      responses:
        '200':
          description: Success
          schema:
            $ref: '#/definitions/RESTPolicyViolationsData'
  /v1/log/violation/workload:
    get:
      tags:
      - Log
      summary: Get violation workloads
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      produces:
      - application/json
      responses:
        '200':
          description: Success
          schema:
            $ref: '#/definitions/RESTPolicyViolationsWLData'
  /v1/log/security:
    get:
      tags:
      - Log
      summary: Get security event list
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      produces:
      - application/json
      responses:
        '200':
          description: Success
          schema:
            $ref: '#/definitions/RESTSecurityData'
definitions:
  Audit:
    type: object
    required:
    - level
    - reported_timestamp
    - reported_at
    - cluster_name
    - host_id
    - host_name
    - enforcer_id
    - enforcer_name
    - base_os
    - high_vul_cnt
    - medium_vul_cnt
    - cvedb_version
    - message
    - user
    - error
    - aggregation_from
    - count
    - platform
    - platform_version
    properties:
      name:
        type: string
        example: Container.Managed
      level:
        type: string
        example: INFO
      reported_timestamp:
        type: integer
        format: int64
        example: 1516832670
      reported_at:
        type: string
        format: date-time
        example: 2018-01-24 22:24:30+00:00
      cluster_name:
        type: string
        example: cluster1
      response_rule_id:
        type: integer
        example: 10007
      host_id:
        type: string
        example: 2AU7:TIEN:O5KX:QK56:LFQP:IJSV:FXBN:QJV7
      host_name:
        type: string
        example: ubuntu64
      enforcer_id:
        type: string
        example: bced57295eefbd3f3bd0cf798b6184fa789
      enforcer_name:
        type: string
        example: allinone
      workload_id:
        type: string
        example: 7df6a19648e2860c89fe12c8d5b1c52079a
      workload_name:
        type: string
        example: ''
      workload_domain:
        type: string
        example: ''
      workload_image:
        type: string
        example: ''
      workload_service:
        type: string
        example: ''
      image:
        type: string
        example: alpine:3.16.1
      image_id:
        type: string
        example: d572b7ee3511b21a2b78b8915bc03c5786ad01949704c1418624224c4cae2c5f
      registry:
        type: string
        example: https://registry.hub.docker.com/
      registry_name:
        type: string
        example: ''
      repository:
        type: string
        example: alpine
      tag:
        type: string
        example: latest
      base_os:
        type: string
        example: ubuntu:16.04
      high_vul_cnt:
        type: integer
        example: 1
      medium_vul_cnt:
        type: integer
        example: 1
      high_vuls:
        type: array
        items:
          type: string
          example: ''
      medium_vuls:
        type: array
        items:
          type: string
          example: ''
      cvedb_version:
        type: string
        example: '1.011'
      message:
        type: string
        example: ''
      user:
        type: string
        example: root
      error:
        type: string
        example: Request failed
      aggregation_from:
        type: integer
        format: int64
        example: 1516832670
      count:
        type: integer
        example: 10
      items:
        type: array
        items:
          type: string
          example: ''
      platform:
        type: string
        example: ''
      platform_version:
        type: string
        example: ''
      packages:
        type: array
        items:
          type: string
          example: ''
      package_ver:
        type: string
      fixed_ver:
        type: string
      score:
        type: number
        format: float32
        example: 7.3
      score_v3:
        type: number
        format: float32
        example: 7.3
      vectors:
        type: string
      vectors_v3:
        type: string
      link:
        type: string
      description:
        type: string
      pub_date:
        type: string
      last_mod_date:
        type: string
      image_layer_digest:
        type: string
        example: sha256:08614570918e6832c44397cc7bce8037f07a8e2b87aec19d57a3da5eff274c7b
      cmds:
        type: string
  Incident:
    type: object
    required:
    - name
    - level
    - reported_timestamp
    - reported_at
    - cluster_name
    - response_rule_id
    - host_id
    - host_name
    - enforcer_id
    - enforcer_name
    - id
    - workload_id
    - workload_name
    - workload_domain
    - workload_image
    - workload_service
    - remote_workload_id
    - remote_workload_name
    - remote_workload_domain
    - remote_workload_image
    - remote_workload_service
    - proc_name
    - proc_path
    - proc_cmd
    - proc_real_uid
    - proc_effective_uid
    - proc_real_user
    - proc_effective_user
    - file_path
    - file_name
    - client_ip
    - server_ip
    - client_port
    - server_port
    - server_conn_port
    - ether_type
    - ip_proto
    - conn_ingress
    - proc_parent_name
    - proc_parent_path
    - action
    - group
    - rule_id
    - aggregation_from
    - count
    - message
    properties:
      name:
        type: string
        example: Host.Suspicious.Process
      level:
        type: string
        example: WARNING
      reported_timestamp:
        type: integer
        format: int64
        example: 1515020888
      reported_at:
        type: string
        format: date-time
        example: 2018-01-03 23:08:08+00:00
      cluster_name:
        type: string
        example: cluster1
      response_rule_id:
        type: integer
        example: 10006
      host_id:
        type: string
        example: ubuntu64:ZYA3:UZL5:2WOT:QYEF:SLVT:LIBD
      host_name:
        type: string
        example: ubuntu64
      enforcer_id:
        type: string
        example: a928be54f34fbb696426890a7249c067
      enforcer_name:
        type: string
        example: allinone
      id:
        type: string
        example: e6e19591-75a0-43e9-bebb-145d588e6718
      workload_id:
        type: string
        example: 83e76eabd68494649440fa0a35451315289c70eb3094454e419952dffaa7715a
      workload_name:
        type: string
        example: iperfserver
      workload_domain:
        type: string
        example: ''
      workload_image:
        type: string
        example: iperfserver
      workload_service:
        type: string
        example: iperfserver
      remote_workload_id:
        type: string
        example: external
      remote_workload_name:
        type: string
        example: iperfclient
      remote_workload_domain:
        type: string
        example: ''
      remote_workload_image:
        type: string
        example: iperfclient
      remote_workload_service:
        type: string
        example: iperfclient
      proc_name:
        type: string
        example: nc
      proc_path:
        type: string
        example: /bin/nc.traditional
      proc_cmd:
        type: string
        example: ./dns_tunneling/iodine/bin/iodine -f -r 172.17.0.3 -P
      proc_real_uid:
        type: integer
        example: 1000
      proc_effective_uid:
        type: integer
        example: 1000
      proc_real_user:
        type: string
        example: test
      proc_effective_user:
        type: string
        example: root
      file_path:
        type: string
        example: ''
      file_name:
        type: array
        items:
          type: string
          example: ''
      client_ip:
        type: string
        example: 192.168.1.62
      server_ip:
        type: string
        example: 10.1.4.3
      client_port:
        type: integer
        format: uint16
        example: 56564
      server_port:
        type: integer
        format: uint16
        example: 80
      server_conn_port:
        type: integer
        format: uint16
        example: 80
      ether_type:
        type: integer
        format: uint16
        example: 2048
      ip_proto:
        type: integer
        format: uint8
        example: 6
      conn_ingress:
        type: boolean
        example: false
      proc_parent_name:
        type: string
        example: sh
      proc_parent_path:
        type: string
        example: /bin/dash
      action:
        type: string
        example: violate
      group:
        type: string
        example: nv.iperfserver
      rule_id:
        type: string
        example: 00000000-0000-0000-0000-000000000001
      aggregation_from:
        type: integer
        format: int64
        example: 1515020888
      count:
        type: integer
        example: 1
      message:
        type: string
        example: dns tunneling
  RESTAuditsData:
    type: object
    required:
    - audits
    properties:
      audits:
        type: array
        items:
          $ref: '#/definitions/Audit'
  RESTPolicyViolationsData:
    type: object
    required:
    - violations
    properties:
      violations:
        type: array
        items:
          $ref: '#/definitions/Violation'
  Event:
    type: object
    required:
    - level
    - reported_timestamp
    - reported_at
    - cluster_name
    - host_id
    - host_name
    - enforcer_id
    - enforcer_name
    - controller_id
    - controller_name
    - workload_id
    - workload_name
    - workload_domain
    - workload_image
    - workload_service
    - category
    - user
    - user_roles
    - user_addr
    - user_session
    - message
    properties:
      name:
        type: string
        example: Container.Managed
      level:
        type: string
        example: INFO
      reported_timestamp:
        type: integer
        format: int64
        example: 1516832670
      reported_at:
        type: string
        format: date-time
        example: 2018-01-24 22:24:30+00:00
      cluster_name:
        type: string
        example: cluster1
      response_rule_id:
        type: integer
        example: 10009
      host_id:
        type: string
        example: QK56:LFQP:IJSV:FXBN:QJV7:5MBB:6PL5
      host_name:
        type: string
        example: ubuntu64
      enforcer_id:
        type: string
        example: bced57295eefbd3f3bd0cf798b6184fa789
      enforcer_name:
        type: string
        example: allinone
      controller_id:
        type: string
        example: ''
      controller_name:
        type: string
        example: ''
      workload_id:
        type: string
        example: 7df6a19648e2860c89fe12c8d5b1c52079a
      workload_name:
        type: string
        example: kafkadocker_zookeeper_1
      workload_domain:
        type: string
        example: ''
      workload_image:
        type: string
        example: zookeeper
      workload_service:
        type: string
        example: ''
      category:
        type: string
        example: WORKLOAD
      user:
        type: string
        example: user
      user_roles:
        type: object
        description: map key is domain(string type)
        additionalProperties:
          type: string
        example:
          domain1: admin
          domain2: reader
      user_addr:
        type: string
        example: ''
      user_session:
        type: string
        example: ''
      rest_method:
        type: string
        example: ''
      rest_request:
        type: string
        example: ''
      rest_body:
        type: string
        example: ''
      enforcer_limit:
        type: integer
        example: 0
      license_expire:
        type: string
        example: ''
      message:
        type: string
        example: Start managing container kafkadocker_zookeeper_1
  Violation:
    type: object
    required:
    - level
    - reported_timestamp
    - reported_at
    - cluster_name
    - host_id
    - host_name
    - enforcer_id
    - enforcer_name
    - id
    - client_id
    - client_name
    - server_id
    - server_name
    - server_port
    - ip_proto
    - applications
    - servers
    - sessions
    - policy_action
    - policy_id
    - client_ip
    - server_ip
    - fqdn
    properties:
      name:
        type: string
        example: ''
      level:
        type: string
        example: WARNING
      reported_timestamp:
        type: integer
        format: int64
        example: 1516160219
      reported_at:
        type: string
        format: date-time
        example: 2018-01-17 03:36:59+00:00
      cluster_name:
        type: string
        example: cluster1
      response_rule_id:
        type: integer
        example: 10008
      host_id:
        type: string
        example: 2AU7:TIEN:O5KX:QK56:LFQP:IJSV:FXBN:QJV7
      host_name:
        type: string
        example: ubuntu64
      enforcer_id:
        type: string
        example: bced57295eefbd3f3bd0cf798b6184fa789
      enforcer_name:
        type: string
        example: allinone
      id:
        type: string
        example: e6e19591-75a0-43e9-bebb-145d588e6718
      client_id:
        type: string
        example: 25f773945fff1d8880b9eb67d26be22f5321d
      client_name:
        type: string
        example: iperfclient
      client_domain:
        type: string
        example: ''
      client_image:
        type: string
        example: ''
      client_service:
        type: string
        example: ''
      server_id:
        type: string
        example: 0350077d87164505597268494acbc8a25109e3
      server_name:
        type: string
        example: iperfserver
      server_domain:
        type: string
        example: ''
      server_image:
        type: string
        example: ''
      server_service:
        type: string
        example: ''
      server_port:
        type: integer
        format: uint16
        example: 5000
      ip_proto:
        type: integer
        format: uint8
        example: 6
      applications:
        type: array
        items:
          type: string
          example: HTTP
      servers:
        type: array
        items:
          type: string
        example:
        - server1
        - server2
      sessions:
        type: integer
        format: uint32
        example: 0
      policy_action:
        type: string
        example: violate
      policy_id:
        type: integer
        format: uint32
        example: 9999
      client_ip:
        type: string
        example: 172.17.0.4
      server_ip:
        type: string
        example: 172.17.0.3
      fqdn:
        type: string
        example: www.suse.com
  RESTEventsData:
    type: object
    required:
    - events
    properties:
      events:
        type: array
        items:
          $ref: '#/definitions/Event'
  RESTThreatData:
    type: object
    required:
    - threat
    properties:
      threat:
        $ref: '#/definitions/Threat'
  RESTScanBrief:
    type: object
    required:
    - status
    - high
    - medium
    - result
    - scanned_timestamp
    - scanned_at
    - base_os
    - scanner_version
    - cvedb_create_time
    properties:
      status:
        type: string
        example: scheduled
      high:
        type: integer
        example: 0
      medium:
        type: integer
        example: 0
      result:
        type: string
        example: success
      scanned_timestamp:
        type: integer
        format: int64
        example: 1516561253
      scanned_at:
        type: string
        format: date-time
        example: 2018-01-21 19:00:53+00:00
      base_os:
        type: string
        example: ubuntu:16.04
      scanner_version:
        type: string
        example: '1.011'
      cvedb_create_time:
        type: string
        format: date-time
        example: 2018-06-20 19:00:53+00:00
  RESTWorkloadBrief:
    type: object
    required:
    - id
    - name
    - display_name
    - pod_name
    - image
    - image_id
    - image_created_at
    - platform_role
    - domain
    - state
    - service
    - author
    - service_group
    - cap_sniff
    - cap_quarantine
    - cap_change_mode
    - policy_mode
    - profile_mode
    - scan_summary
    - children
    - service_mesh
    - service_mesh_sidecar
    - privileged
    - run_as_root
    - baseline_profile
    properties:
      id:
        type: string
        example: 7304e72fd093155c4cbcd65d07375329b2db82cc679
      name:
        type: string
        example: k8s_POD.d86c_calico-node-mzhtk_kube-system_0050565a_365c13d
      display_name:
        type: string
        example: calico-node-mzhtk
      pod_name:
        type: string
        example: istio-policy-5cdbc47674-t67p4
      image:
        type: string
        example: calico
      image_id:
        type: string
        example: d572b7ee3511b21a2b78b8915bc03c5786ad01949704c1418624224c4cae2c5f
      image_digest:
        type: array
        items:
          type: string
          example: c2ced31c5dda37cb805f481e3fa34b742cc8980f439b20af3111b08e66cff8e1
      image_created_at:
        type: string
        format: date-time
        example: 2018-01-18 00:44:02+00:00
      image_reg_scanned:
        type: boolean
        example: false
      platform_role:
        type: string
        example: core
      domain:
        type: string
        example: ''
      state:
        type: string
        example: exit
      service:
        type: string
        example: kafkazookeeper
      author:
        type: string
        example: ''
      service_group:
        type: string
        example: nv.calico
      share_ns_with:
        type: string
        example: cc0709d522749203042e89dba28bf6924a4b0d360648
      cap_sniff:
        type: boolean
        example: true
      cap_quarantine:
        type: boolean
        example: true
      cap_change_mode:
        type: boolean
        example: true
      policy_mode:
        type: string
        example: Discover
      profile_mode:
        type: string
        example: Discover
      scan_summary:
        $ref: '#/definitions/RESTScanBrief'
      children:
        type: array
        items:
          $ref: '#/definitions/RESTWorkloadBrief'
      quarantine_reason:
        type: string
        example: violation
      service_mesh:
        type: boolean
        example: true
      service_mesh_sidecar:
        type: boolean
        example: true
      privileged:
        type: boolean
        example: true
      run_as_root:
        type: boolean
        example: true
      baseline_profile:
        type: string
        example: ''
  RESTPolicyViolationsWLData:
    type: object
    required:
    - violation_workloads
    properties:
      violation_workloads:
        type: array
        items:
          $ref: '#/definitions/RESTViolationWorkload'
  RESTThreatsData:
    type: object
    required:
    - threats
    properties:
      threats:
        type: array
        items:
          $ref: '#/definitions/Threat'
  RESTIncidentsData:
    type: object
    required:
    - incidents
    properties:
      incidents:
        type: array
        items:
          $ref: '#/definitions/Incident'
  Threat:
    type: object
    required:
    - level
    - reported_timestamp
    - reported_at
    - cluster_name
    - host_id
    - host_name
    - enforcer_id
    - enforcer_name
    - id
    - threat_id
    - client_workload_id
    - client_workload_name
    - server_workload_id
    - server_workload_name
    - severity
    - action
    - count
    - ether_type
    - client_port
    - server_port
    - server_conn_port
    - icmp_code
    - icmp_type
    - ip_proto
    - client_ip
    - server_ip
    - application
    - sensor
    - group
    - target
    - monitor
    - message
    properties:
      name:
        type: string
        example: HTTP.Request.Slowloris
      level:
        type: string
        example: CRIT
      reported_timestamp:
        type: integer
        format: int64
        example: 1505755712
      reported_at:
        type: string
        example: '2017-09-18T17:28:32Z'
      cluster_name:
        type: string
        example: cluster1
      response_rule_id:
        type: integer
        example: 10005
      host_id:
        type: string
        example: ubuntu64:ZYA3:NPGZ:IU64:XJ3P:SUU3:QYEF:SLVT
      host_name:
        type: string
        example: ubuntu64
      enforcer_id:
        type: string
        example: 2fdc03e027d6483633376609
      enforcer_name:
        type: string
        example: allinone
      id:
        type: string
        example: 999-9c96-11e7-83c1-17580b
      threat_id:
        type: integer
        format: uint32
        example: 2017
      client_workload_id:
        type: string
        example: 7e31a2a4d4074ba459f8c22ee90
      client_workload_name:
        type: string
        example: iperfclient
      client_workload_domain:
        type: string
        example: ''
      client_workload_image:
        type: string
        example: ''
      client_workload_service:
        type: string
        example: ''
      server_workload_id:
        type: string
        example: 2cbab37b43efe049e583924a73a764b096ce8f15ea
      server_workload_name:
        type: string
        example: iperfserver
      server_workload_domain:
        type: string
        example: ''
      server_workload_image:
        type: string
        example: ''
      server_workload_service:
        type: string
        example: ''
      severity:
        type: string
        example: critical
      action:
        type: string
        example: monitor
      count:
        type: integer
        format: uint32
        example: 1
      ether_type:
        type: integer
        format: uint16
        example: 2048
      client_port:
        type: integer
        format: uint16
        example: 53825
      server_port:
        type: integer
        format: uint16
        example: 5000
      server_conn_port:
        type: integer
        format: uint16
        example: 5000
      icmp_code:
        type: integer
        format: uint8
        example: 0
      icmp_type:
        type: integer
        format: uint8
        example: 0
      ip_proto:
        type: integer
        format: uint8
        example: 6
      client_ip:
        type: string
        example: 172.17.0.4
      server_ip:
        type: string
        example: 172.17.0.3
      application:
        type: string
        example: HTTP
      sensor:
        type: string
        example: ''
      group:
        type: string
        example: ''
      target:
        type: string
        example: 'true'
      monitor:
        type: boolean
        example: true
      cap_len:
        type: integer
        format: uint16
        example: 32043
      packet:
        type: string
        example: base64string
      message:
        type: string
        example: Header duration=3s, threshold=3s
  RESTViolationWorkload:
    type: object
    required:
    - workload
    - count
    properties:
      workload:
        $ref: '#/definitions/RESTWorkloadBrief'
      count:
        type: integer
        example: 2
  RESTSecurityData:
    type: object
    required:
    - threats
    - incidents
    - violations
    properties:
      threats:
        type: array
        items:
          $ref: '#/definitions/Threat'
      incidents:
        type: array
        items:
          $ref: '#/definitions/Incident'
      violations:
        type: array
        items:
          $ref: '#/definitions/Violation'
securityDefinitions:
  ApiKeyAuth:
    type: apiKey
    in: header
    name: X-Auth-Apikey
  TokenAuth:
    type: apiKey
    in: header
    name: X-Auth-Token
externalDocs:
  description: Find out more about NeuVector
  url: https://www.suse.com/products/neuvector/