API Call -- Is what we think we are querying really what we are querying?

[carey.e.dvorak]

Looking for some guidance on an API Call we have built; it is:

webacs/api/v1/data/RogueApHistoryData?.full=true&containmentLevel=ne(0)&totalRogueclients=ne(0)

We believe the query results show us the following information:

     1)  The controller has detected a Rogue AP, has placed it into a “contained” state and the controller has allocated APs with resources to contain it

     --AND--

     2)  The now “contained” Rogue AP has clients associated to it that would be potential targets for deauthentication frames

Any thoughts if we are actually on-point with this?  Thanks in advance.

--Carey

[Spencer Zier · Accepted solution]

Hey Carey,

RogueApHistoryData is not part of the public API.  As such, it may change or be removed without notice and we can't help you with it's use.  Sorry.

That being said, I don't think we have any resources in the public API that support your use case.  If you'd like, please contact me via email (my address is available on my Communities profile) and we can discuss how to potentially address this in future versions of Prime Infrastructure.

[carey.e.dvorak]

Spencer,

A belated thank you for replying to my question.  That is good information to know that "rogueApHistoryData" is not part of the publicly supported API.  I will email you under separate cover if we want to explore how to potentially address this in future versions of PI.  Thanks again.

--Carey

[rirani]

Hi Spencer,

Has "RogueAPHistoryData" been incorporated or is planned to be incorporated as part of the public PI API ?

Thnx,

Ray.

[Spencer Zier]

Ray,

Yes, we did actually prioritize this story.  So, in Prime Infrastructure 3.2 there's a new API resource (GET data/RogueApAlarms).  It has a response very similar to our GET data/Alarms resource, but includes a rogueApAlarmDetails object in the response.  That objects lists (among other things) the rogue classification type (Friendly, Malicious, Unclassified, or Custom), the rogue MAC, the number of associated clients, the SSID, and the state (ALERT, KNOWN, THREAT, CONTAINED, CONTAINED_PENDING, KNOWN_CONTAINED, WIRE_CONTAINED, and a few other states).