getIPSList

Prev Next

Available in Classic and VPC

Get the list of security events that occurred while using the IPS (Intrusion Prevention System) service.

Request

The following describes the request format for the endpoint. The request format is as follows:

Method URI
POST /getIPSList

Request headers

For headers common to Security Monitoring APIs, see Security Monitoring request headers.

Request body

The following describes the request body.

Field Type Required Description
startDateTime Long Required Security event query start time (Unix timestamp)
  • <E.g.> 1720540427000
endDateTime Long Required Security event query end time (Unix timestamp)
  • <E.g.> 1720540427000
page Integer Required Page number
countPerPage Integer Required Displayed number per page
order String Optional Event detection time sort order
  • asc | desc (default)
    • asc: ascending
    • desc: descending
regionCode String Optional Region code
  • KR | DEN | JPN | SGN | USWN
    • KR: Korea
    • DEN: Germany
    • JPN: Japan
    • SGN: Singapore
    • USWN: U.S.
zoneName String Optional Zone type
  • KR-1 | KR-2
eventNm String Optional Name of the event detected
attackIp String Optional Attacker IP address
targetIp String Optional IP address targeted for the attack
attackType String Optional Detected attack type
  • Only available in the Classic environment
protocol String Optional Attack protocol
  • Only available in the VPC environment

Request example

The following is a sample request.

curl --location --request POST 'https://securitymonitoring.apigw.ntruss.com/vsecuritymonitoring/v1/getIPSList'
--header 'x-ncp-apigw-timestamp: {Timestamp}'
--header 'x-ncp-iam-access-key: {Access Key}' 
--header 'x-ncp-apigw-signature-v2: {API Gateway Signature}' 
--data '{
  "startDateTime": 1719849227000,
  "endDateTime": 1720108427000,
  "page": 1,
  "countPerPage": 20
}'

Response

The following describes the response format.

Response body

The following describes the response body.

Field Type Required Description
returnCode Integer - Processing result code for the request
ipsDataList[] Array - IPS security event list
ipsDataList[].ticketId String - Unique number assigned to the security event
ipsDataList[].date String - Detection time of the security event (Unix timestamp)
ipsDataList[].product String - Service type
  • IPS | IPS_V2
    • IPS: Classic environment
    • IPS_V2: VPC environment
ipsDataList[].eventNm String - Name of the security event detected
ipsDataList[].attackType String - Type of attack detected
ipsDataList[].attackerIp String - Attacker IP address
ipsDataList[].attackerPort String - Attacker port number
ipsDataList[].targetIp String - IP address targeted for the attack
ipsDataList[].targetPort String - Attack target port number
ipsDataList[].protocol String - Attack protocol
ipsDataList[].detect String - Number of detected security events
ipsDataList[].region String - Region
ipsDataList[].zoneName String - Zone type
  • KR-1 | KR-2
ipsDataList[].platForm String - Platform type
  • CLASSIC | VPC
ipsDataList[].vpcName String - VPC name
returnMessage String - Processing result message for the request
totalRows Integer - Total number of lists searched
page Integer - No. of page requested

Response status codes

For error codes common to Security Monitoring APIs, see Common Security Monitoring error codes.

Response example

The following is a sample example.

{
    "returnCode": 0,
    "ipsDataList": [
        {
            "ticketId": "526068436",
            "date": "1720044443000",
            "product": "IPS_V2",
            "eventNm": "Deep Security Apache Log4j Remote Code Execution Vulnerability (CVE-2021-44228)",
            "attackType": null,
            "attackerIp": "***.***.***.***",
            "attackerPort": "51185",
            "targetIp": "***.***.***.***",
            "targetPort": "80",
            "protocol": "TCP",
            "detect": "1",
            "region": "Korea",
            "zoneName": "KR-2",
            "platForm": "VPC",
            "vpcName": "kr-sm-vpc"
        }
    ],
    "returnMessage": "SUCCESS",
    "totalRows": 1,
    "page": 1
}