Views:
Retrieve current filter override settings for a profile. This is a POST request, and requires you to provide an XML file that identifies the profile and the filter(s). When the SMS receives a current filter settings service request, it:
  • Validates the filter ID using the DV metadata.
  • Finds the category the filter ID belongs to.
  • Finds the setting of the category from the profile specified by the Profile ID and version.
  • Sets the filter ID in the response XML.
The setting of a given filter might be changed by IPS administrators. The changes are defined in the POLICY response XML defined by the existing service interface.

Definition

ipsProfileMgmt/getFilters

Request Schema

The Remote Profile Management API uses the following XML schema for current filter settings status requests. 
<?xml version="1.0" encoding="UTF-8"?>
  <xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">
   <xs:simpleType name="uuid">
    <xs:restriction base="xs:string">
     <xs:pattern value="[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]
      {4}-[0-9a-f]{4}-[0-9a-f]{12}"/>
     </xs:restriction>
    </xs:simpleType>
    <xs:element name="getFilters">
      <xs:complexType>
        <xs:sequence>
          <xs:element name="profile">
            <xs:complexType>
              <xs:attribute name="id" type="uuid"/>
              <xs:attribute name="name" type="xs:string"/>
           </xs:complexType>
         </xs:element>
         <xs:element name="filter" maxOccurs="unbounded">
          <xs:complexType>
           <xs:sequence>
            <xs:element name="number" type="xs:positiveInteger"minOccurs="0"/>
            <xs:element name="name" type="xs:string" minOccurs="0"/>
            <xs:element name="signature-id" type="uuid" minOccurs="0"/>
            <xs:element name="policy-id" type="uuid" minOccurs="0"/>
          </xs:sequence>
         </xs:complexType>
        </xs:element>
      </xs:sequence>
    </xs:complexType>
  </xs:element>
</xs:schema>

Request parameters

Parameter Type Description
profile string Empty element with these attributes:
  • id
  • name
  • version
number integer Unique filter number.
name string Filter name.
signature-id string Internally assigned filter ID.
policy-id string Internally assigned policy ID.

Response parameters

Parameter Type Description
profile string Empty element with these attributes:
  • id
  • name
  • version
name string Filter name.
policy-id string Internally assigned policy ID.
version integer IPS TOS version for the filter.
locked boolean Indicates whether the filter is locked. You cannot remotely change a locked filter.
useParent boolean Indicates whether the action set on the filter is inherited from a parent profile.
comment string User comments.
severity string Filter severity.
  • Low
  • Minor
  • Major
  • Critical
enabled boolean
  • enabled
  • disabled
actionset string
  • refid
  • name
control string
Controlling element of the filter actionset setting.
  • category: controlled by the category action set.
  • filter: controlled by the overriding default action set.
afc boolean Indicates whether the filter is managed by the Adaptive Filter Configuration (AFC). If a filter is managed by AFC, then the filter is automatically disabled when the IPS device is under heavy load and the given filter is triggered without an actual filter match.
policyGroup Profile group identified by a refid, expressed in UUID format. This parameter is never used by a filter.
trigger Trigger frequency detection parameter for the filter. Used only for scan/sweep filters.
  • threshold: specify the number of filter triggers.
  • timeout: specify the time period under which the number of triggers are being counted (in seconds).
capability
Element with a device name attribute having these child elements:
  • enabled
  • actionset: specifies the filter setting.
  • refid: maps to the action set ID for the capability.

Example

curl -X POST -k --header "X-SMS-API-KEY: <string>" --form name=@getFilters.xml 
https://<sms_server>/ipsProfileMgmt/getFilters
The following sample shows how the getFilters XML file is composed according to the schema. You must provide values for the profile name and at least one of the filter search terms: number, signature ID, policy ID, or name. 
<?xml version="1.0"?>
<getFilters>
    <profile name="Default"/>
    <filter>
        <number>3295</number>
    </filter>
    <filter>
        <signature-id>00000001-0001-0001-0001-000000000027</signature-id>
    </filter>
    <filter>
        <policy-id>00000002-0002-0002-0002-000000000051</policy-id>
    </filter>
    <filter>
        <name>0050: IP Options: Unknown Code</name>
    </filter>
</getFilters>

Response Schema

<?xml version="1.0" encoding="utf-8"?>
<xs:schema xmlns:xs"http://www.w3.org/2001/XMLSchema">
 <xs:simpleType name="uuid">
   <xs:restriction base="xs:string">
    <xs:pattern
value="[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"/>
  <xs:restriction>
 <xs:simpleType>
  <xs:element name="filters">
    <xs:complexType>
     <xs:sequence>
      <xs:element name="profile">
  <xs:compleType>
      <xs:attribute name="name" type="xs:string"/>
      <xs:attribute name="id" type="xs:string"/>
      <xs:attribute name="version" type="xs:string"/>
  </xs:complexType>
			</xs:element>
    <xs:element name="filter" maxOccurs="unbounded">
     <xs:complexType>
      <xs:sequence>
         <xs:element name="name" type="xs:string"/>
            <xs:element name="policy-id" type="uuid"/>
            <xs:element name="version" type="xs:string"/>
            <xs:element name="locked" type="xs:boolean"/>
            <xs:element name="useParent" type="xs:boolean"/>
            <xs:element name="comment" type="xs:string" minOccurs="0"/>
            <xs:element name="description" type="xs:string" minOccurs="0"/>
            <xs:element name="severity" minOccurs="0">
         <xs:simpleType>
          <xs:restriction base="xs:string">
               <xs:enumeration value="Low"/>
               <xs:enumeration value="Minor"/>
               <xs:enumeration value="Major"/>
               <xs:enumeration value="Critical"/>
          </xs:restriction>
         </xs:simpleType>
       </xs:element>
         <xs:element name="enabled" type="xs:boolean"/>
         <xs:element name="actionset" minOccurs="0">
        <xs:complexType>
         <xs:attribute name="refid" type="uuid"/>
         <xs:attribute name="name" type="xs:string"/>
        </xs:complexType>
      </xs:element>
    <xs:element name="control">
     <xs:simpleType>
         <xs:restriction base="xs:string">
         <xs:enumeration value="Category"/>
         <xs:enumeration value="Filter"/>
     </xs:restriction>
    </xs:simpleType>
   </xs:element>
   <xs:element name="afc" type="xs:boolean"/>
   <xs:element name="policyGroup" minOccurs="0">
     <xs:complexType>
       <xs:attribute name="refid" type="uuid"/>
    </xs:complexType>
   </xs:element>
   <xs:element name="trigger" minOccurs="0">
    <xs:complexType>
      <xs:attribute name="threshold">
        <xs:simpleType>
          <xs:restriction base="xs:integer">
            <xs:minInclusive value="2"/>
            <xs:maxInclusive value="10000"/>
          </xs:restriction>
       </xs:simpleType>
     </xs:attribute>
     <xs:attribute name="timeout">
       <xs:simpleType>
         <xs:restriction base="xs:long">
           <xs:minInclusive value="0"/>
           <xs:maxInclusive value="999999"/>
         </xs:restriction>
       </xs:simpleType>
     </xs:attribute>
    </xs:complexType>
   </xs:element>
   <xs:element name="capability" minOccurs="0" maxOccurs="unbounded">
    <xs:complexType>
      <xs:sequence>
        <xs:element name="enabled" type="xs:boolean"/>
        <xs:element name="actionset" minOccurs="0">
          <xs:complexType>
               <xs:attribute name="refid" type="uuid"/>
               <xs:attribute name="name" type="xs:string"/>
          </xs:complexType>
         </xs:element>
        </xs:sequence>
            <xs:attribute name="name" type="xs:string"/>
           </xs:complexType>
          </xs:element>
         </xs:sequence> 
        </xs:complexType>
       </xs:element>
      </xs:sequence>
     </xs:complexType>
    </xs:element>
   </xs:schema>