IPS-API

The IPS-API is a RESTful api.
IPS or Intrusion Prevention Service will require you to have a server and account in the CenturyLink Platform.

Supported Managed Operating Systems

Current supported operating systems can be found here Operating System Support

Authentication

In order to use the IPS-API you must retrieve a bearer token from CLC.
This will be used during each of the calls. For more, see the CLC Authentication documentation.

Headers

To interact with the IPS-API you will need to provide in the headers two fields

Install

Installs an IPS agent on the designated host.

URL

Structure

POST https://api.client-security.ctl.io/ips/api/app/

{
    "hostName":"serverName",
    "accountAlias":"CLC Account Alias"
}

Content Properties

Example

{
    "hostName":"VA1CLCDTEST04",
    "accountAlias":"CLCD"
}

Uninstall

Uninstalls an IPS agent from a designated host.

URL

Structure

DELETE https://api.client-security.ctl.io/ips/api/app/

{
    "hostName":"serverName",
    "accountAlias":"CLC Account Alias"
}

Content Properties

Example

{
    "hostName":"VA1CLCDTEST04",
    "accountAlias":"CLCD"
}

Notification Destination

Configuration Process via our API

The calls below will perform all of the operations for configuring, retrieving, updating, and deleting a notification destination.
Calls to this operation must include a token acquired from the authentication endpoint.
See the Login API for information on acquiring this token.

Note: If you have any questions, or would like assistance from us in setting up your notifications, please email us at help@ctl.io. We're happy to help at anytime!

URL

Structure

Create and Update

PUT https://api.client-security.ctl.io/ips/api/notifications/{accountAlias}/{serverName}

{
    "url":{some URL},
    "typeCode":{endpoint type}
}

Retrieve

GET https://api.client-security.ctl.io/ips/api/notifications/{accountAlias}/{serverName}

Delete

DELETE https://api.client-security.ctl.io/ips/api/notifications/{accountAlias}/{serverName}

Request

URI Parameters

Content Properties

Notification Destination Definition

TypeCode currently consists of: SYSLOG, EMAIL, and WEBHOOK

Note: If you have any questions, or would like assistance from us in setting up your notifications, please email us at help@ctl.io. We're happy to help at anytime!

SysLogSettings Definition

Facility is to set the type of program logging messages.
The options are 16-23 for descriptions follow the link: https://en.wikipedia.org/wiki/Syslog

Example

PUT http://api.client-security.ctl.io/ips/api/notification/ALIAS/VA1ALIASMYSVR01

{
    "url": "http://my.slack.webhook",
    "typeCode": "SLACK"
},
{
    "url": "http://my.generic.webhook",
    "typeCode": "WEBHOOK"
},
{
    "typeCode": "SYSLOG",
    "sysLogSettings":
        {
            "ipAddress": "12345",
            "udpPort": "8081",
            "facility": "16"
        }
},
{
    "typeCode": "EMAIL",
    "emailAddress": "youremail@site.com"
}

The following key-value pairs are sent to the notification destination when an event is triggered. If you are using the generic "WEBHOOK" type for your notifications the following will be sent in json format.

Response Object

Note: If you have any questions, or would like assistance from us in setting up your notifications, please email us at help@ctl.io. We're happy to help at anytime!

Syslog Firewall Rules

• Add the following rules to the Firewall that the Syslog server sits behind if located in another location

  • dsm01.client-security.ctl.io 514/udp

  • dsm02.client-security.ctl.io 514/udp