Forum Discussion

Alok_Kumar's avatar
Alok_Kumar
Icon for Altostratus rankAltostratus
Jul 21, 2020

iControl API and command to retrieve only attack signatures with Modified date after some particular date ?

I'm trying thru CLI to enable for blocking attack signatures released after a particular date of July 13 2020. For that I'm trying to load the signature Ids in a file thru the command below, I got the date converted to microseconds using epochconverter.com/ before putting in the API call. When I ran the command from CLI I see old signatures are also getting loaded. If I check this on the Attack signatures GUI using filter ( update date after July 13 ) it shows 2 signatures only. Am I using the API incorrectly ?

 

# curl -sku admin:admin https://10.1.1.4/mgmt/tm/asm/policies/POLICY_ID/signatures?/$filter=lastUpdateMicros%20gt%1594598400000 | jq '.' | grep -- 'lastUpdateMicros\|signatureId' | grep signatureId | tee signature_list.txt

1 Reply

  • Hello Alok,

     

    You have time in milliseconds (13-digit) in your filter, while it must be in microseconds (16-digit) to correct filtering by lastUpdateMicros field.

     

    Thanks, Ivan