Highlighted
Regular Contributor.
Regular Contributor.
1870 views

How to run ESM reports with custom parameters using API

Hi,

I am trying to run a report using API on ESM. I am able to run report with default parameters.

I have found out that the url to run the report is:

https://mymanager:8443/www/manager-service/rest/ArchiveReportService/initDefaultArchiveReportDownloadById?authToken=akshegfsjfcksclsldcsdckbe6E.&reportId=9675l3RK2hb3oAV-Q==&reportType=Manual&fieldValueList=

I want to specify starttime, endtime and a custom parameter to this report but can't figure out how to specify these three values in "fieldValueList". I am not able to find any proper documentation on how to use.

Please help if somebody have any idea about fieldvalueset.

Sreejith

Labels (1)
Tags (4)
0 Likes
Reply
15 Replies
Highlighted
Honored Contributor.
Honored Contributor.

Hi Sreejith

Thanks for your email referencing your post. Unfortunately, I cannot add any valuable comments to answer your question at this time and must suggest that you await further contributions from the Protect community.

Wishing you the best of luck.

Martyn.

0 Likes
Reply
Highlighted
Regular Contributor.
Regular Contributor.

Hi Martyn,

Thank you for your response.

Sreejith

0 Likes
Reply
Highlighted
Acclaimed Contributor.
Acclaimed Contributor.

Hi Sreejith,

U can run the Report with Custom placeholder in the Report Query " Attacker Address=@AttackerAddress" . It will pop out Custom Run time Parameter. I think u know it.

Otherwise u have to try the Advanced Velocity Expressions..

0 Likes
Reply
Highlighted
Regular Contributor.
Regular Contributor.

Hi Balahasan,

The custom placeholder you mentioned and velocity templates are used in arcsight console.

My question is how to call those parameters in a REST API.

Regards,

Sreejith

0 Likes
Reply
Highlighted
Absent Member.
Absent Member.

Hi Sreejith,

I had the same question about a year ago, and sent an email to the REST API developer (his email address is in the REST API documentation in the JAR file).

Whilst there is a function which looks like it should generate a report, i had conformation that it had *not* been implemented.  There is no way of generating a report using a custom parameter in the current version of the ESM REST API.

The API can only be used to download archived reports which have already been generated by the report scheduler......

You might want to look at the Plugin (see protect 2012 presentation Plug It In!) or perhaps using a scheduled report and some external report manipulation code to do what you need.

Ian

0 Likes
Reply
Highlighted
Honored Contributor.
Honored Contributor.

Hi Sreejith,

You can do that using SOAP and Java. After setting the custom placeholder in the query, you can use the ArchiveReportService to generate the report passing the custom parameter.

Here is an example java code to pass a IP address as parameter. In my case, the query condition is "SourceAddress=@source="

CustomReportParameter[] customReportParameters = new CustomReportParameter[1];

customReportParameters[0] = new CustomReportParameter();

customReportParameters[0].setName("source");

customReportParameters[0].setValue("8.8.8.8");

ArchiveReportServiceClientFactory archiveReportServiceClientFactory = new ArchiveReportServiceClientFactory();

ArchiveReportService archiveReportService = archiveReportServiceClientFactory.createClient();

fileId = archiveReportService.archiveReport(authToken, reportId, null, null, customReportParameters, null, null, "Manual", null);

Finally, you can download the report in the URL:

https://express-host:8443/www/manager-service/fileservlet?file.command=download&file.id=fileId

Regards,

Jorge

0 Likes
Reply
Highlighted
Regular Contributor.
Regular Contributor.

Hi Jorge,

Thank you for the info. We will check whether the same is possible in REST as well.

Regards,
Sreejith

0 Likes
Reply
Highlighted
Absent Member.
Absent Member.

Sreejith,

Did you ever determine if this behavior could be implemented in REST? If so, would you mind sharing a sample of your code?

Thanks,

Jordan

0 Likes
Reply
Highlighted
Absent Member.
Absent Member.

Thanks for the code!

I was wondering how one would set the email parameter to have the report emailed once it is completed?

Thanks,

- Brandon

0 Likes
Reply
Highlighted
Honored Contributor.
Honored Contributor.

Hi Brandon,

I didn't test it, but probably you could set the email in the CommonParameters param of the archiveReport method.

Here is some code that could help you.

// Get the report common parameters

ResourceServiceClientFactory resourceServiceClientFactory = new ResourceServiceClientFactory();

ResourceService service = resourceServiceClientFactory.createClient();

Resource resource = null;

resource = service.findByUUID(authToken, reportId);

Report report = (Report)resource;

ReportParameter[] commonParams = report.getCommonParameters();

for (ReportParameter param : commonParams) {

    if (param.getName().equals("Email Addresses"))

        param.setValue(emailList);

}

fileId = archiveReportService.archiveReport(authToken, reportId, commonParams, null, null, null, null, "Manual", null);

Tell us if works.

Regards,

Jorge

0 Likes
Reply
Highlighted
Absent Member.
Absent Member.

Hi Jorge,

I tried this exact code but i am not able to pass custom parameters to the report.

Can you please look into this and help me out

Here is the code:

package org.helloworld;

import com.arcsight.product.core.service.v1.client.ws.LoginServiceClientFactory;

import com.arcsight.product.core.service.v1.client.ws.api.LoginService;

import com.arcsight.product.manager.resource.service.v1.client.ws.ArchiveReportServiceClientFactory;

import com.arcsight.product.manager.resource.service.v1.client.ws.DataMonitorServiceClientFactory;

import com.arcsight.product.manager.resource.service.v1.client.ws.api.ArchiveReportService;

import com.arcsight.product.manager.resource.service.v1.client.ws.api.DataMonitorService;

import com.arcsight.product.manager.resource.service.v1.model.CustomReportParameter;

import com.arcsight.product.manager.resource.service.v1.api.*;

public class Program {

      public static void main(String[] args) {         

            XTrustProvider.install();

            LoginServiceClientFactory loginServiceClientFactory = new LoginServiceClientFactory();

            System.setProperty("com.arcsight.coma.client.ws.baseURL",

                        "https://arcsightexpress.yesbank.com:8443/www/");

            LoginService loginService = loginServiceClientFactory.createClient();

            String authToken = loginService.login(null, "test.admin",

                        "123456");

          

            ArchiveReportServiceClientFactory archiveReportServiceClientFactory = new ArchiveReportServiceClientFactory();

            ArchiveReportService archiveReportService = archiveReportServiceClientFactory

                        .createClient();

          

            String reportId = "9J19MYU0BABCAM8n2XKBMPw==";        

            CustomReportParameter[] customReportParameters = new CustomReportParameter[1];

            customReportParameters[0] = new CustomReportParameter();

            customReportParameters[0].setName("test");

            customReportParameters[0].setValue("30806910439");

            String fileId = archiveReportService.archiveReport(authToken, reportId,

                        null, null, customReportParameters, null, null, "Manual", null);

            System.out.println(fileId);

      }

}

Regards,

Vishal

0 Likes
Reply
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.