Event/Query Worker Configuration API
These APIs enables you to query and make changes to event worker or query worker configurations.
Get Event Worker
This GET API retrieves the list of Event Workers defined in FortiSIEM.
Release Added: 6.5.0
| Input URL | https://<FortiSIEM_Supervisor_IP>/phoenix/rest/system/eventworker
|
Input Credentials
User name and password of Supervisor account, or Organization specific user name and password, Organization name.
HTTP Method
GET
Output
When the request succeeds (HTTP response code 200), then a JSON file is returned with the list of Event Workers as defined in GUI. Sample JSON follows.
{
"addresses": [
"wk1.acme.com",
"192.0.2.0"
]
}
Add Event Worker
This POST API enables you to add an Event Worker to the list of Event Workers defined in FortiSIEM.
Release Added: 6.5.0
| Input URL | https://<FortiSIEM_Supervisor_IP>/phoenix/rest/system/add/eventworker
|
Input Credentials
User name and password of Supervisor account, or Organization specific user name and password, Organization name.
HTTP Method
POST
Request Body
|
Field |
Type |
Description |
|---|---|---|
| Body | JSON array of Event Worker addresses entry | Event Worker FQDN or IP |
Request Body Example
{
"addresses": ["wk1.acme.com",”wk2.acme.com”]
}
Output
When the request succeeds (HTTP response code 200), then a JSON file is returned with the list of successful and failed additions.
{
"success": [
"Event worker added: wk1.acme.com"
],
"failed": [
"Not a valid worker address: invalidworkaddress"
]
}
Delete Event Worker
This POST API enables you to delete an Event Worker from the list of Event Workers defined in FortiSIEM.
Release Added: 6.5.0
| Request URL | https://<FortiSIEM_Supervisor_IP>/phoenix/rest/system/delete/eventworker
|
Input Credentials
User name and password of Supervisor account, or Organization specific user name and password, Organization name.
HTTP Method
POST
Request Body
|
Field |
Type |
Description |
|---|---|---|
| Body | JSON array of Event Worker addresses entry | Event Worker FQDN or IP |
Request Body Example
{
"addresses": ["wk1.acme.com",”wk2.acme.com”]
}
Output
When the request succeeds (HTTP response code 200), then a JSON file is returned with the list of successful and failed additions.
{
"success": [
"Event worker deleted: wk1.acme.com"
],
"failed": [
"Not a valid worker address: invalidworkaddress"
]
}
Get Query Worker
This GET API retrieves the list of Query Workers defined in FortiSIEM.
Release Added: 6.5.0
| Input URL | https://<FSM-Super-IP>/phoenix/rest/system/queryworker
|
Input Credentials
User name and password of Supervisor account, or Organization specific user name and password, Organization name.
HTTP Method
GET
Output
When the request succeeds (HTTP response code 200), then a JSON file is returned with the list of Query Workers as defined in GUI. Sample JSON follows.
{
"addresses": [
"wk1.acme.com",
"192.0.2.84"
]
}
Add Query Worker
This POST API is available to add Query Worker IP addresses or resolvable host names.
Release Added: 6.5.0
| Input URL | https://<FortiSIEM_Supervisor_IP>/phoenix/rest/system/add/queryworker
|
Input Credentials
User name and password of Supervisor account, or Organization specific user name and password, Organization name.
HTTP Method
POST
Request Body
|
Field |
Type |
Description |
|---|---|---|
| Body | JSON array of Query Worker addresses entry | Query Worker FQDN or IP |
Request Body Example
{
"addresses": ["wk1.acme.com",”wk2.acme.com”]
}
Output
When the request succeeds (HTTP response code 200), then a JSON file is returned with the list of successful and failed additions.
{
"success": [
"Query worker added: wk1.acme.com"
],
"failed": [
"Not a valid worker address: invalidworkaddress"
]
}
Delete Query Worker
This POST API enables you to delete a Query Worker from the list of Query Workers defined in FortiSIEM.
Release Added: 6.5.0
| Request URL | https://<FortiSIEM_Supervisor_IP>/phoenix/rest/system/delete/queryworker
|
Input Credentials
User name and password of Supervisor account, or Organization specific user name and password, Organization name.
HTTP Method
POST
Request Body
|
Field |
Type |
Description |
|---|---|---|
| Body | JSON array of Query Worker FQDN or IP | Query Worker FQDN or IP |
Request Body Example
{
"addresses": ["wk1.acme.com",”wk2.acme.com”]
}
Output
When the request succeeds (HTTP response code 200), then a JSON file is returned with the list of successful and failed additions.
{
"success": [
"Query worker deleted: wk1.acme.com"
],
"failed": [
"Not a valid worker address: invalidworkaddress"
]
}