CrowdStrike API - How to pull all active hosts' without specifying Host Id's? - api

I am trying to write a query to get every active host on my network using the GET /devices/entities/online-state/v1 endpoint, however this endpoint requires a specific host's ID as a filter - meaning I would first have to query out to another API functionality to get the host ID, then hard code them into my initial query. Furthermore this API endpoint limits the amount of host Id's to 100 per query. I work on a network with 10's of thousands of endpoints, so this is not practical. I know there has to be a way to blanketly grab every host & its associated status, but I am still very new to the CS API and do not know what function to use. If anyone knows a solution - be it through a CS API endpoint I am unware of, or through syntactical corrections, (for example a wildcard I could use,) to my original query, I would really appreciate some help.

Related

Apache: IP addresses vs users

Suppose you wanna analyze your access log files in order to check users activities. One common way is to assume that a same IP address corresponds to a same user.
However, several internet providers use CGNAT. Which, briefly, allows multiple end users to use a common public IP address.
In that case, users behind a CGNAT and sharing the same public address might be confused with each other. Therefore, causing problems to calculate view counts and to ban disruptive traffic.
Question
Any alternative to mitigate that?
(Preferably using only Apache)
You could consider unique users are unique combinations of IP+user-agent. It would be a bit better but still wouldn't be able to differentiate users on the same IP and using the same browser, on the same platform.
Other than that, you'd need to use a server side scripting technology and track sessions. That would require cookies tho, which is not too much of a biggie. You can't track static assets using that method tho.

Single Softlayer API to collect information from different services

SoftLayer's API has different "services" for the different objects represented in the API. Virtual Guests, Bare Metal Servers, VLANs, IP addresses, etc are all different types of services. There are also links between these services, so I want to use a single API query to get information about multiple services. The Object Mask is one way of joining the different services.
Can anyone please tell me how to achieve it using object mask.
Here you can see information about object mask:
http://sldn.softlayer.com/article/object-Masks
Now all the services are attached to your account, so you need to take a look to the service:
http://sldn.softlayer.com/reference/datatypes/SoftLayer_Account
http://sldn.softlayer.com/reference/services/SoftLayer_Account
The service provides several methods to get differents services such as virtual guest:
http://sldn.softlayer.com/reference/services/SoftLayer_Account/getVirtualGuests
or get all the bare metal servers in your account:
http://sldn.softlayer.com/reference/services/SoftLayer_Account/getHardware
Using Object mask you just need to call the getObject method and add the properties that you want for example see this RESTFul to get the virtual guest, bare metal servers and VLans:
GET https://$USERNAME:$APIKEY#api.softlayer.com/rest/v3.1/SoftLayer_Account/getObject?objectMask=mask[virtualGuests,hardware,networkVlans]
So you can get all the information that you need in a single request however, when your response contains a big amount of data your request will throw an exception, in order to handle that you need to use result limits in your request you can see more information about how to add it to your request here:
https://sldn.softlayer.com/article/REST
Regards

Google maps geocoding returns empty string

Yesterday I created a new Google map geocoding API key on the developper console. I need to get gps coordinates from a server script. When I use the "which key do I need" in the console, it tells me I choosed the right key. I also allowed the fixed IP of my server in the key settings.
Now, when I use "https://maps.googleapis.com/maps/api/geocode/json?address=MY_ADDRESS&sensor=false&key=MY_KEY", it returns an empty string.
When I use "http//maps.googleapis.com/maps/api/geocode/json?address=MY_ADDRESS&sensor=false&key=MY_KEY" it returns a warning about this kind of queries must use https (which is consistent with the doc).
And finally, when I use "http//maps.googleapis.com/maps/api/geocode/json?address=MY_ADDRESS&sensor=false" (no https and no key) I get the relevant data, either in json or xml. As explained in the doc, this can be used with a limit of 2500 geocoding per day, but the problem is that I have different domains on the same server (with the same IP) that geocode, and since google tracks by IP to evaluate daily quotas...
So my question is : what am I missing when trying to geocode an address using https and the key ?
The only thing that crossed my mind is : do I need to activate billing in google maps, even though I know for sure that I will never exceed the free quota of 2500 queries per day, at least with the project to which the key is associated ?
Thanks in advance for any tip or advice.

RESTful API Design: ID values for "owned" resources

When designing a restful API, resource ownership is a consideration when designing the URIs. In my case, I'm working on an API where two of my entities will be people and addresses. Each person can have more than one address, so in the database they'll be in separate tables.
Normally I just use auto incrementing keys, so each new record adding increases the ID number.
A thought I had was that if I uses this approach, it would effectively produce a URI like this:
/people/11/addresses/52
In that case, person 11 doesn't have 52 addresses. It's just person 11, who has an address with an ID of 52.
The other side of it is whether I would even be using a URI like that. Addresses generally won't be retrieved on their own by the client, but as part of a person object retrieved by a single API call (/people/11 would retrieve all addresses associated with that person).
Anyway, I guess the question here is about best practices. Is it common to see an entity owned by another with ID values like that? What are the general practices with this?
Your method is correct.
Also These are general rules (reference):
- An API is a user interface for a developer - so put some effort into making it pleasant
- Use RESTful URLs and actions
- Use SSL everywhere, no exceptions
- An API is only as good as its documentation - so have great documentation
- Version via the URL, not via headers
- Use query parameters for advanced filtering, sorting & searching
- Provide a way to limit which fields are returned from the API
- Return something useful from POST, PATCH & PUT requests
- HATEOAS isn't practical just yet
- Use JSON where possible, XML only if you have to
- You should use camelCase with JSON, but snake_case is 20% easier to read
- Pretty print by default & ensure gzip is supported
- Don't use response envelopes by default
- Consider using JSON for POST, PUT and PATCH request bodies
- Paginate using Link headers
- Provide a way to autoload related resource representations
- Provide a way to override the HTTP method
- Provide useful response headers for rate limiting
- Use token based authentication, transported over OAuth2 where delegation is needed
- Include response headers that facilitate caching
- Define a consumable error payload
- Effectively use HTTP Status codes
Also there are lots of references on web. This page is a good start.
and these are also useful: slide1, devzone tutorial
You would normally use a resource like: /people/11/addresses/52 when you return the details of an address in a personalised manner for the people entity.
If for example, you have entities: people and office which can have addresses, and for people you want to display only the country and for offices you want to display all the details of addresses.
On the other hand, if you don't need customization you can also use an url like: /address/12 , since it will be easier to cache a response like that.
Addresses generally won't be retrieved on their own by the client,
but as part of a person object retrieved by a single API call
(/people/11 would retrieve all addresses associated with that person).
If this is the case you can leave out the detailed addresses url.
Yes, That's correct way to apply many to many relation in APIs. Just remember to check id2 belongs to id1 when returning the value.
For retrieving all the addresses the correct call is /people/11/addresses. Then you know you have to call a join query.

total visitors at any given instance

I am working on site analytics and would like to know how I can find the total number of visitors at any given instance. I am concerned only about the current time and not about past views. Right now I am trying to keep the problem simple by not finding the unique visitors.
One approach I can think of is to get total number of http connections at any given instance, assuming that the connection have very short timeout.
My setup includes apache web server and tomcat servlet container.
I know it is still a generic question but this use case is not specific to any particular language.
How about looking in the logs?
For example:
http://www.geekpad.ca/blog/post/get-unique-visitors-from-apache-log-file