how to get from FMC, top talkers with API (URI)

[fabian-vargas]

how to get from FMC, top talkers with API (URI)? The FMC version is 6.6.5.2 (build 14)

[stephan.l.martin1]

Good morning,

Have you explored the API Explorer menu to see if this is an available API? I would suspect that it would be valid- here is an excerpt from the white page:

About the API Explorer

The API Explorer provides a limited interface for the REST API as well as giving a view of the abilities of the REST API.

The API Explorer resides on the Firepower Management Center, and can be accessed via the Firepower Management Center at:

https://<management_center_IP_or_name>:<https_port>/api/api-explorer

This explorer provides the list of APIs available on the Firepower Management Center, and their details.
Firepower Management Center REST API Quick Start Guide, Version 6.2.0 - About the API Explorer [Cisco Secure Firewall Management Center] - Cisco

Most of the API explorers offer the template as well. Hope this helps!

[bigevilbeard]

If anything like past versions

https://x.x.x.x/api/fmc/v1/monitor/top-talkers 

https://x.x.x.x/api/fmc/v1/top-talkers 

I cannot find any good API documents for this

[stephan.l.martin1]

Looking through the API explorer those don't seem to be options. I'm running 7.4 so mileage may vary. Will report back if I find the path on my end. 

[stephan.l.martin1]

You may be able to derive the information that you are looking for via /api/fmc_config/v1/domain/{domainUUID}/analysis/useractivity

Alternatively- it may be more appropriate to ingest the NETFLOW data and parse it that way. Not sure if this is an option for your specific use case but could be an additional option. If I find a more specific URI I will post it here.