topic Re: how to get from FMC, top talkers with API (URI) in Network Security

how to get from FMC, top talkers with API (URI)

fabian-vargas — Mon, 02 Dec 2024 16:23:29 GMT

how to get from FMC, top talkers with API (URI)? The FMC version is 6.6.5.2 (build 14)

Re: how to get from FMC, top talkers with API (URI)

stephan.l.martin1 — Mon, 02 Dec 2024 17:10:06 GMT

Good morning,

Have you explored the API Explorer menu to see if this is an available API? I would suspect that it would be valid- here is an excerpt from the white page:

About the API Explorer

The API Explorer provides a limited interface for the REST API as well as giving a view of the abilities of the REST API.

The API Explorer resides on the Firepower Management Center, and can be accessed via the Firepower Management Center at:

https://<management_center_IP_or_name>:<https_port>/api/api-explorer

This explorer provides the list of APIs available on the Firepower Management Center, and their details.
Firepower Management Center REST API Quick Start Guide, Version 6.2.0 - About the API Explorer [Cisco Secure Firewall Management Center] - Cisco

Most of the API explorers offer the template as well. Hope this helps!

Re: how to get from FMC, top talkers with API (URI)

bigevilbeard — Mon, 02 Dec 2024 17:33:14 GMT

If anything like past versions

https://x.x.x.x/api/fmc/v1/monitor/top-talkers

https://x.x.x.x/api/fmc/v1/top-talkers

I cannot find any good API documents for this

Re: how to get from FMC, top talkers with API (URI)

stephan.l.martin1 — Mon, 02 Dec 2024 17:41:13 GMT

Looking through the API explorer those don't seem to be options. I'm running 7.4 so mileage may vary. Will report back if I find the path on my end.

Re: how to get from FMC, top talkers with API (URI)

stephan.l.martin1 — Mon, 02 Dec 2024 17:46:33 GMT

You may be able to derive the information that you are looking for via /api/fmc_config/v1/domain/{domainUUID}/analysis/useractivity

Alternatively- it may be more appropriate to ingest the NETFLOW data and parse it that way. Not sure if this is an option for your specific use case but could be an additional option. If I find a more specific URI I will post it here.