Event/Query Worker Configuration API
These APIs enables you to query and make changes to event worker or query worker configurations.
Get Event Worker
This GET API retrieves the list of Event Workers defined in FortiSIEM.
Release Added: 6.5.0
| Input URL | https://<FortiSIEM_Supervisor_IP>/phoenix/rest/system/eventworker
|
Input Credentials
- Enterprise deployments: User name and password of any FortiSIEM account that has the appropriate access. Use "super" as the organization for Enterprise deployments.
Curl example:curl -k -u super/admin:Admin*123 - Service Provider deployments: User name and password of Super Global account or Organization specific account and name. Make sure that the account has the appropriate access.
Curl example with super organization:curl -k -u super/admin:Admin*123
If querying for a specific organization, replace "super" with the organization name.
HTTP Method
GET
Output
When the request succeeds (HTTP response code 200), then a JSON file is returned with the list of Event Workers as defined in GUI. Sample JSON follows.
{
"addresses": [
"wk1.acme.com",
"192.0.2.0"
]
}
Add Event Worker
This POST API enables you to add an Event Worker to the list of Event Workers defined in FortiSIEM.
Release Added: 6.5.0
| Input URL | https://<FortiSIEM_Supervisor_IP>/phoenix/rest/system/add/eventworker
|
Input Credentials
- Enterprise deployments: User name and password of any FortiSIEM account that has the appropriate access. Use "super" as the organization for Enterprise deployments.
Curl example:curl -k -u super/admin:Admin*123 - Service Provider deployments: User name and password of Super Global account or Organization specific account and name. Make sure that the account has the appropriate access.
Curl example with super organization:curl -k -u super/admin:Admin*123
If querying for a specific organization, replace "super" with the organization name.
HTTP Method
POST
Request Body
|
Field |
Type |
Description |
|---|---|---|
| Body | JSON array of Event Worker addresses entry | Event Worker FQDN or IP |
Request Body Example
{
"addresses": ["wk1.acme.com",”wk2.acme.com”]
}
Output
When the request succeeds (HTTP response code 200), then a JSON file is returned with the list of successful and failed additions.
{
"success": [
"Event worker added: wk1.acme.com"
],
"failed": [
"Not a valid worker address: invalidworkaddress"
]
}
Delete Event Worker
This POST API enables you to delete an Event Worker from the list of Event Workers defined in FortiSIEM.
Release Added: 6.5.0
| Request URL | https://<FortiSIEM_Supervisor_IP>/phoenix/rest/system/delete/eventworker
|
Input Credentials
- Enterprise deployments: User name and password of any FortiSIEM account that has the appropriate access. Use "super" as the organization for Enterprise deployments.
Curl example:curl -k -u super/admin:Admin*123 - Service Provider deployments: User name and password of Super Global account or Organization specific account and name. Make sure that the account has the appropriate access.
Curl example with super organization:curl -k -u super/admin:Admin*123
If querying for a specific organization, replace "super" with the organization name.
HTTP Method
POST
Request Body
|
Field |
Type |
Description |
|---|---|---|
| Body | JSON array of Event Worker addresses entry | Event Worker FQDN or IP |
Request Body Example
{
"addresses": ["wk1.acme.com",”wk2.acme.com”]
}
Output
When the request succeeds (HTTP response code 200), then a JSON file is returned with the list of successful and failed additions.
{
"success": [
"Event worker deleted: wk1.acme.com"
],
"failed": [
"Not a valid worker address: invalidworkaddress"
]
}
Get Query Worker
This GET API retrieves the list of Query Workers defined in FortiSIEM.
Release Added: 6.5.0
| Input URL | https://<FortiSIEM_Supervisor_IP>/phoenix/rest/system/queryworker
|
Input Credentials
- Enterprise deployments: User name and password of any FortiSIEM account that has the appropriate access. Use "super" as the organization for Enterprise deployments.
Curl example:curl -k -u super/admin:Admin*123 - Service Provider deployments: User name and password of Super Global account or Organization specific account and name. Make sure that the account has the appropriate access.
Curl example with super organization:curl -k -u super/admin:Admin*123
If querying for a specific organization, replace "super" with the organization name.
HTTP Method
GET
Output
When the request succeeds (HTTP response code 200), then a JSON file is returned with the list of Query Workers as defined in GUI. Sample JSON follows.
{
"addresses": [
"wk1.acme.com",
"192.0.2.84"
]
}
Add Query Worker
This POST API is available to add Query Worker IP addresses or resolvable host names.
Release Added: 6.5.0
| Input URL | https://<FortiSIEM_Supervisor_IP>/phoenix/rest/system/add/queryworker
|
Input Credentials
- Enterprise deployments: User name and password of any FortiSIEM account that has the appropriate access. Use "super" as the organization for Enterprise deployments.
Curl example:curl -k -u super/admin:Admin*123 - Service Provider deployments: User name and password of Super Global account or Organization specific account and name. Make sure that the account has the appropriate access.
Curl example with super organization:curl -k -u super/admin:Admin*123
If querying for a specific organization, replace "super" with the organization name.
HTTP Method
POST
Request Body
|
Field |
Type |
Description |
|---|---|---|
| Body | JSON array of Query Worker addresses entry | Query Worker FQDN or IP |
Request Body Example
{
"addresses": ["wk1.acme.com",”wk2.acme.com”]
}
Output
When the request succeeds (HTTP response code 200), then a JSON file is returned with the list of successful and failed additions.
{
"success": [
"Query worker added: wk1.acme.com"
],
"failed": [
"Not a valid worker address: invalidworkaddress"
]
}
Delete Query Worker
This POST API enables you to delete a Query Worker from the list of Query Workers defined in FortiSIEM.
Release Added: 6.5.0
| Request URL | https://<FortiSIEM_Supervisor_IP>/phoenix/rest/system/delete/queryworker
|
Input Credentials
- Enterprise deployments: User name and password of any FortiSIEM account that has the appropriate access. Use "super" as the organization for Enterprise deployments.
Curl example:curl -k -u super/admin:Admin*123 - Service Provider deployments: User name and password of Super Global account or Organization specific account and name. Make sure that the account has the appropriate access.
Curl example with super organization:curl -k -u super/admin:Admin*123
If querying for a specific organization, replace "super" with the organization name.
HTTP Method
POST
Request Body
|
Field |
Type |
Description |
|---|---|---|
| Body | JSON array of Query Worker FQDN or IP | Query Worker FQDN or IP |
Request Body Example
{
"addresses": ["wk1.acme.com",”wk2.acme.com”]
}
Output
When the request succeeds (HTTP response code 200), then a JSON file is returned with the list of successful and failed additions.
{
"success": [
"Query worker deleted: wk1.acme.com"
],
"failed": [
"Not a valid worker address: invalidworkaddress"
]
}