{% extends "base.html" %} {% block content %}

### API Documentation

The websnort API is currently implemented as a blocking synchronous HTTP POST. If you have a large ruleset defined for your instance or many concurrent requests, timeout issues could be a problem. An asynchronous job submission API is possible if there is enough interest.

URL | Method | Description | Successful Response | Unsuccessful Response
--- | --- | --- | --- | ---
/api/submit | POST | Accepts a multipart/form-data submission containing the pcap file to scan and returns a results json dictionary. | {"apiversion": "version", "status": "Success", "filename": "filename" "filesize": bytes, "md5": "hexstring", "start": "YYYY-MM-DDTHH:mm:SS.sssssss", "duration": seconds, "analyses": [ {"status": "Success", "name": "configname", "module": "idsname", "version": "idsversion", "ruleset": "label", "duration": seconds, "alerts":[ {"source": "ipaddress", "destination": "ipaddress", "protocol": "protocol name", "classtype": "alert classification (optional)", "sid": signature_id, "timestamp": "YYYY-MM-DDTHH:mm:SS.sssssss", "message": "alert description", "revision": signature_revision}]}, ]} | {"apiversion": "version", "status": "Failed", "filename": "filename" "filesize": bytes, "md5": "hexstring", "start": "YYYY-MM-DDTHH:mm:SS.sssssss", "duration": seconds, "errors": ["Error description / details"] "analyses": []}

### Example

    $ curl -i --form file=@test.pcap http://localhost:8080/api/submit
    HTTP/1.0 200 OK
    Date: Sun, 31 Aug 2014 02:52:50 GMT
    Server: WSGIServer/0.1 Python/2.7.6
    Content-Length: 1001
    Content-Type: application/json

    {
        "status": "Success",
        "errors": [],
        "apiversion": "0.4",
        "filename": "test.pcap",
        "start": "2014-08-31T12:52:48.828358",
        "filesize": 12373,
        "duration": 2.134792,
        "analyses": [
            {
                "status": "Success",
                "name": "snort",
                "alerts": [
                    {
                        "source": "10.1.1.132:58650",
                        "classtype": "Detection of a Network Scan",
                        "protocol": "UDP",
                        "sid": 1917,
                        "timestamp": "2014-01-28T21:26:04.885446",
                        "message": "SCAN UPnP service discover attempt",
                        "destination": "239.255.255.250:1900",
                        "revision": 6
                    }
                ],
                "module": "snort",
                "version": "2.9.6.0 GRE (Build 47)",
                "ruleset": "community",
                "duration": 2.131043
            }
        ],
        "md5": "22bd2cfbdea14676ef4211e539cbb535"
    }

{% endblock %}