api/events
Returns events in a given time range.
| Parameter | Description | Mandatory |
|---|---|---|
| tsstart | Start period timestamp (format YYYYMMDDHHMMSS) | Yes |
| tsend | End period timestamp (format YYYYMMDDHHMMSS) | Yes |
| tenant | In a multitenant environment, a user of the master tenant can use this parameter to specify the target tenant. If more than one tenant is passed, the result will be a cross-tenant search. | No |
| classid | Class IDs (Array) | No |
| hostid | Host IDs (Array) | No |
| patternid | Pattern IDs (Array) | No |
| multi_patternid | In a multitenant environment, use this parameter to specify different patterns for different tenants. Example: “multi_patternid”: {“tenant1” : [“11640”,“11630”],“tenant2” : [“10060”,“10061”]} | No |
| limit | Limit of the number of returned results | No |
| search | Filter on values of specified parameters. Example: “search”: [{“paramid”: “10433”, “paramval”: “.*admin”, “type”: “regex”}, {“paramid”: “10433”, “paramval”: “user1”}] | No |
| search_op | Search operator for filters - “AND” or “OR” - default is AND | No |
Request
curl -s -k -X POST -H "Content-Type: application/json" -H "APIKEY: [YOUR_API_KEY]" -H "username: [YOUR_USERNAME]" -H "password: [YOUR_PASSWORD]" -d '{"tsstart": "20260703000000", "tsend": "20260703235959", "tenant" : ["tenant1"], "limit": 3}' 'https://1.2.3.4:4000/api/events'Response
[
{
"uuid": "76561378-7661-11f1-86aa-000000001767",
"ts": "20260703000000",
"hostid": 4,
"classid": 0,
"class_name": "PFSense Connections",
"patternid": 11286,
"pattern_name": "[PFSense] allowed TCP connection",
"host_name": "",
"host_ip": "[THIS_IS_AN_IP]",
"tenant": "tenant1",
"tenant_name": "Test1",
"ancestors": "",
"values": {
"SourceIP": "[THIS_IS_AN_IP]",
"DestinationIP": "[THIS_IS_AN_IP]",
"Port": "443",
"Size": "47286",
"(GEO) DestinationIP": "Unknown",
"(GEO) SourceIP": "Unknown",
"Interface": "em0"
}
},
{
"uuid": "76561378-7661-11f1-86aa-00000000176b",
"ts": "20260703000000",
"hostid": 4,
"classid": 0,
"class_name": "PFSense Web surfing",
"patternid": 10763,
"pattern_name": "[PFSense] Web surfing",
"host_name": "",
"host_ip": "[THIS_IS_AN_IP]",
"tenant": "tenant1",
"tenant_name": "Test1",
"ancestors": "",
"values": {
"SourceIP": "[THIS_IS_AN_IP]",
"DestinationIP": "[THIS_IS_AN_IP]",
"FWAction": "pass",
"DestinationPort": "443",
"(GEO) DestinationIP": "Unknown",
"FWInterface": "igb1"
}
},
{
"uuid": "76561378-7661-11f1-86aa-00000000176b",
"ts": "20260703000000",
"hostid": 4,
"classid": 0,
"class_name": "PFSense Connections",
"patternid": 11286,
"pattern_name": "[PFSense] allowed TCP connection",
"host_name": "",
"host_ip": "[THIS_IS_AN_IP]",
"tenant": "tenant1",
"tenant_name": "Test1",
"ancestors": "",
"values": {
"SourceIP": "[THIS_IS_AN_IP]",
"DestinationIP": "[THIS_IS_AN_IP]",
"Port": "443",
"Size": "1534",
"(GEO) DestinationIP": "Unknown",
"(GEO) SourceIP": "Italy",
"Interface": "igb1"
}
}
]api/logs
Return logs in a given time range
| Parameter | Description | Mandatory |
|---|---|---|
| tsstart | Start period timestamp (format YYYYMMDDHHMMSS) | Yes |
| tsend | End period timestamp (format YYYYMMDDHHMMSS) | Yes |
| tenant | In a multitenant environment, a user of the master tenant can use this parameter to specify the target tenant. If more than one tenant is passed, the result will be a cross-tenant search. | No |
| hostid | Host IDs (array) | No |
| search | String filter as in SGBox Historical Search page | No |
| case | Case sensitive search flag (boolean) | No |
| limit | Limit of the number of returned results | No |
Request
curl -s -k -X POST -H "Content-Type: application/json" -H "APIKEY: [YOUR_API_KEY]" -H "username: [YOUR_USERNAME]" -H "password: [YOUR_PASSWORD]" -d '{"tsstart": "20260703000000", "tsend": "20260703235959", "tenant" : ["tenant1"], "limit": 3, "search":"logon OR logoff" }' 'https://1.2.3.4:4000/api/logs'Response
[
{
"uuid": "76561378-7661-11f1-86aa-0000000003c8",
"ts": "2026-07-03 00:00:00",
"hostid": 18,
"tsdec": "000000",
"host_ip": "[THIS_IS_AN_IP]",
"hostname": "",
"line": "this is the log line",
"tenant": "tenant1"
},
{
"uuid": "76561378-7661-11f1-86aa-0000000003c9",
"ts": "2026-07-03 00:00:00",
"hostid": 18,
"tsdec": "000000",
"host_ip": "[THIS_IS_AN_IP]",
"hostname": "",
"line": "this is the log line",
"tenant": "tenant1"
},
{
"uuid": "76561378-7661-11f1-86aa-0000000003ca",
"ts": "2026-07-03 00:00:00",
"hostid": 18,
"tsdec": "000000",
"host_ip": "[THIS_IS_AN_IP]",
"hostname": "",
"line": "this is the log line",
"tenant": "tenant1"
}
]api/events_count
Count events extracted in a given time range
| Parameter | Description | Mandatory |
|---|---|---|
| tsstart | Start period timestamp (format YYYYMMDDHHMMSS) | Yes |
| tsend | End period timestamp (format YYYYMMDDHHMMSS) | Yes |
| tenant | In a multitenant environment, a user of the master tenant can use this parameter to specify the target tenant. If more than one tenant is passed, the result will be a cross-tenant search. | No |
| hostid | Host IDs (Array) | No |
| patternid | Pattern IDs (Array) | No |
| group_by | Specifies grouping (‘host’ or ‘pattern’). Without any grouping, all events are counted together | No |
| search | Filter on values of specified parameters. Example: “search”: [{“paramid”: “10433”, “paramval”: “.*admin”, “type”: “regex”}, {“paramid”: “10433”, “paramval”: “user1”}] | No |
| search_op | Search operator for filters - “AND” or “OR” - default is AND | No |
Request
curl -s -k -X POST -H "Content-Type: application/json" -H "APIKEY: [YOUR_API_KEY]" -H "username: [YOUR_USERNAME]" -H "password: [YOUR_PASSWORD]" -d '{"tsstart": "20260703000000", "tsend": "20260703235959", "tenant" : ["tenant1"]}' 'https://1.2.3.4:4000/api/events_count'Response
[
{
"count": "1086459"
}
]api/logs_count
Count logs received in a given time range, with size in bytes also
| Parameter | Description | Mandatory |
|---|---|---|
| tsstart | Start period timestamp/date | Yes |
| tsend | End period timestamp/date | Yes |
| tenant | In a multitenant environment, a user of the master tenant can use this parameter to specify the target tenant. If more than one tenant is passed, the result will be a cross-tenant search. | No |
| hostid | Host IDs (Array) | No |
| severity | filter severity (e.g. warning, error) | No |
| facility | filter facility | No |
| group_by | Specifies grouping (‘host’ or ‘tenant’). Without any grouping, all events are counted together | No |
Request
curl -s -k -X POST -H "Content-Type: application/json" -H "APIKEY: [YOUR_API_KEY]" -H "username: [YOUR_USERNAME]" -H "password: [YOUR_PASSWORD]" -d '{"tsstart": "20260703000000", "tsend": "20260703235959", "tenant" : ["tenant1"]}' 'https://1.2.3.4:4000/api/logs_count'Response
[
{
"count": "8855281",
"size": "1831219344"
}
]