Forensic Search MomentQuest (VMDA) API

The POST request (see Search request) for search start must contain JSON of one of the following types:

Constructor describing parameters for metadata database request.
There are three logical parts of the search request:
1. Request type (queryType, see Types of requests and their parameters).
2. Parameters specific for the specified type of request (figures, queryProperties, see Additional conditions).
3. Additional filter conditions (objectProperties, conditions, see Additional conditions).

Direct request in metadata database language.

{
 "query": "figure fZone=polygon(0.4647676,0.3973333,0.7946027,0.5493333,0.8650675,0.7946666,0.4647676,0.7946666); figure fDir=(ellipses(-10000, -10000, 10000, 10000) -        ellipses(-0, -0, 0, 0));set r = group[obj=vmda_object] { res = or(fZone((obj.left + obj.right) / 2, obj.bottom)) }; result = r.res;"
}

Important!

If input JSON has both the constructor and the direct request sections, the direct request has higher priority.

Important!

If the body of POST request is empty, then the search will return all alarm intervals.

Note

To perform search in offline analytics data, use the following request:

POST /search/vmda/SERVER-NAME/OfflineAnalytics.c95ad5a581094845995ee28a7f097797/SourceEndpoint.vmda:AVDetector:1/past/future

This request will be performed even if C-Werk archive is removed, but VMDA metadata is saved.

Object ID is to be specified without the hosts/ prefix.

Valid request: /search/vmda/SERVER-NAME/OfflineAnalytics...

Invalid request: /search/vmda/hosts/SERVER-NAME/OfflineAnalytics...

The search result is the following JSON response:

{
	"intervals" : [
		{
			"endTime" : "20210228T124302.313000",
			"positions" : [
				{ 
					"bottom" : 0.60026908397674561, 
					"left" : 0.42527302742004397, 
					"right" : 0.48125132560729983, 
					"top" : 0.50307014942169193 
				}
							],
			"startTime" : "20210228T124256.673000"
		},
		{
			"endTime" : "20210228T124259.513000",
			"positions" : [
				{ 
					"bottom" : 0.45109353065490726, 
					"left" : 0.41891927719116212, 
					"right" : 0.4565316200256348, 
					"top" : 0.34989043235778811 }
							],
				"startTime" : "20210228T124256.673000"
				}
					]
}

where Intervals is a set of time intervals for which the search condition is fulfilled.
.

Space shortcuts

Page tree

Documentation for C-Werk 2.0.