API logging and profiles

[Nikolajs_Matjus]

Hello ! 

Customer is concerned about API logging, generally they want to see logs from API requests/responses in TE blade log in SmartLog. Is that possible ?  If not, what is the way to get similar logging ? (Verdict, filename, malware, etc).

Another question is about NGTX profile - how to apply it to API requests ? 

Thanks in advance !

[PhoneBoy]

Are you querying against the API on a local Threat Emulation appliance or ThreatCloud? 

For a local Threat Emulation appliance, this information should log the same way as if a gateway generated the request.

See also: /var/log/huntress_api_logs 

For ThreatCloud, I'm not sure that's possible.

For your second question, I'm not sure I understand, can you clarify?

[Nikolajs_Matjus]

We are quering local TE appliance.

Regarding second question - how do we define protection profile for API queries ?

Just like we do for protection scope in Threat Prevention tab, or differently ? 

[PhoneBoy]

Profiles do not apply to API calls.

It is up to the application calling the API to determine what to do with the result of the API call.

[Nikolajs_Matjus]

Thank you for quick reply!

But then how do we define emulation environment for API calls ?

[PhoneBoy]

The images you wish to emulate against are specified in the API call.

[freedom_apps]

We are quering local TE appliance.

Regarding second question - how do we define protection profile for API queries ?

Just like we do for protection scope in Threat Prevention tab, or differently ?  Thanks for This MAmazing Forum.

[PhoneBoy]

Threat Prevention profiles don't make sense when you're calling the API directly, which gives you the raw verdict on a given file.

The actual enforcement decision/logic lies elsewhere in this case.