Get security settings

This method returns risky activities rules and automatic remediation settings of the PTA Server configuration.

URL

 

Make sure there are no spaces in the URL.

The following characters are not supported in URL values: + & %

 

 

https://<IIS_Server_Ip>/PasswordVault/API/pta/API/Settings

The following values can be added in the URL. None of them are mandatory.

Resource information

HTTP method

GET

Content type

application/json

Header parameter

Parameter

Authorization

Type

String

Description

The JWT token that identifies the session.

Valid values

A session token that was returned from the “Logon” method.

Body parameters

None

Result

 

This is an example of the result for an array of events.

 
[ 
    {
    "riskyActivities": [
   {
       "id": "0", 
       "category": "KEYSTROKES",
       "regex": "(.*)netsh(.*)wlan(.*)key=clear(.*)", 
      "score": 40, 
      "description": "Indication of a privileged user using a decoding command in clear text to retrieve a WIFI password.", 
      "response": "NONE", 
       "active": true
    }
    {
       "id": "1", 
       "category": "SSH",
       "regex": "(.*)ssh(.*)start(.*)", 
      "score": 30, 
      "description": "Restarting the SSH service after a possible configuration change.", 
      "response": "NONE", 
       "active": true
    } 
     ],
"automaticRemediations": {
   "changePassword_SuspectedCredentialsTheft": false,
   "changePassword_OverPassTheHash": false,
   "reconcilePassword_SuspectedPasswordChange": true,
   "pendAccount_UnmanagedPrivilegedAccount": true
    }
 }
]

 

Parameter

riskyActivities

Type

Array

Description

Section that contains the current settings for PSM Risky Activities

Parameter

id

Type

String

Description

Unique string ID of the activity. Must be a valid positive number

Parameter

category

Type

String

Description

Categories of risky activities
Valid values:

  • SSH
  • WINDOWS
  • SCP
  • KEYSTROKES
  • SQL

Parameter

regex

Type

String

Description

Risky activity expression in regex form. Must support all characters (including "/" and escaping characters)

Parameter

score

Type

Integer

Description

Activity score. Number must be between 1 and 100

Parameter

description

Type

String

Description

Activity description. The field is mandatory but can be empty

Parameter

response

Type

String

Description

Automatic response to be executed
Valid values:

  • NONE
  • TERMINATE
  • SUSPEND

Parameter

active

Type

Boolean

Description

Indicates if the command is active

automaticRemediation

Parameter

changePassword_SuspectedCredentialsTheft

Type

Boolean

Description

Indicates if the command is active

Parameter

changePassword_OverPassTheHash

Type

Boolean

Description

Indicates if the command is active

Parameter

reconcilePassword_SuspectedPasswordChange

Type

Boolean

Description

Indicates if the command is active

Parameter

pendAccount_UnmanagedPrivilegedAccount

Type

Boolean

Description

Indicates if the command is active

Return codes

For a complete list of return codes, see Return Codes.