ContextQMD
Back to Ntopng

Historical Class

python/docs/python_API_Historical.md

6.610.3 KB
Original Source

Historical Class

The Historical class provides access to historical information including flows and alerts.

Constructor

__init__(self, ntopng_obj, ifid=None)

Constructs a new Historical object.

  • ntopng_obj: The ntopng handle

Methods

get_alert_type_counters(self, epoch_begin, epoch_end)

Returns statistics about the number of alerts per alert type.

  • epoch_begin: Start of the time interval (epoch)
  • epoch_end: End of the time interval (epoch)
  • Returns: Statistics (object)

get_alert_severity_counters(self, epoch_begin, epoch_end)

Returns statistics about the number of alerts per alert severity.

  • epoch_begin: Start of the time interval (epoch)
  • epoch_end: End of the time interval (epoch)
  • Returns: Statistics (object)

get_alerts(self, alert_family, epoch_begin, epoch_end, select_clause, where_clause, maxhits, group_by, order_by)

Runs queries on the alert database.

  • alert_family: The alert family (flow, host, interface, etc)
  • epoch_begin: Start of the time interval (epoch)
  • epoch_end: End of the time interval (epoch)
  • select_clause: Select clause (SQL syntax)
  • where_clause: Where clause (SQL syntax)
  • maxhits: Max number of results (limit)
  • group_by: Group by condition (SQL syntax)
  • order_by: Order by condition (SQL syntax)
  • Returns: Query result (object)

get_alerts_stats(self, epoch_begin, epoch_end, host=None)

Returns flow alerts stats.

  • epoch_begin: Start of the time interval (epoch)
  • epoch_end: End of the time interval (epoch)
  • host (optional): Host IP address
  • Returns: Flow alert stats (object)

get_flow_alerts_stats(self, epoch_begin, epoch_end)

Returns flow alerts statistics.

  • epoch_begin: Start of the time interval (epoch)
  • epoch_end: End of the time interval (epoch)
  • Returns: Flow alert statistics (object)

get_flow_alerts(self, epoch_begin, epoch_end, select_clause, where_clause, maxhits, group_by, order_by)

Returns flow alerts matching the specified criteria.

  • epoch_begin: Start of the time interval (epoch)
  • epoch_end: End of the time interval (epoch)
  • select_clause: Select clause (SQL syntax)
  • where_clause: Where clause (SQL syntax)
  • maxhits: Max number of results (limit)
  • group_by: Group by condition (SQL syntax)
  • order_by: Order by condition (SQL syntax)
  • Returns: Query result (object)

get_active_monitoring_alerts(self, epoch_begin, epoch_end, select_clause, where_clause, maxhits, group_by, order_by)

Returns alerts matching the specified criteria for active monitoring.

  • epoch_begin: Start of the time interval (epoch)
  • epoch_end: End of the time interval (epoch)
  • select_clause: Select clause (SQL syntax)
  • where_clause: Where clause (SQL syntax)
  • maxhits: Max number of results (limit)
  • group_by: Group by condition (SQL syntax)
  • order_by: Order by condition (SQL syntax)
  • Returns: Query result (object)

get_host_alerts(self, epoch_begin, epoch_end, select_clause, where_clause, maxhits, group_by, order_by)

Returns host alerts matching the specified criteria.

  • epoch_begin: Start of the time interval (epoch)
  • epoch_end: End of the time interval (epoch)
  • select_clause: Select clause (SQL syntax)
  • where_clause: Where clause (SQL syntax)
  • maxhits: Max number of results (limit)
  • group_by: Group by condition (SQL syntax)
  • order_by: Order by condition (SQL syntax)
  • Returns: Query result (object)

get_interface_alerts(self, epoch_begin, epoch_end, select_clause, where_clause, maxhits, group_by, order_by)

Returns interface alerts matching the specified criteria.

  • epoch_begin: Start of the time interval (epoch)
  • epoch_end: End of the time interval (epoch)
  • select_clause: Select clause (SQL syntax)
  • where_clause: Where clause (SQL syntax)
  • maxhits: Max number of results (limit)
  • group_by: Group by condition (SQL syntax)
  • order_by: Order by condition (SQL syntax)
  • Returns: Query result (object)

get_mac_alerts(self, epoch_begin, epoch_end, select_clause, where_clause, maxhits, group_by, order_by)

Returns MAC alerts matching the specified criteria.

  • epoch_begin: Start of the time interval (epoch)
  • epoch_end: End of the time interval (epoch)
  • select_clause: Select clause (SQL syntax)
  • where_clause: Where clause (SQL syntax)
  • maxhits: Max number of results (limit)
  • group_by: Group by condition (SQL syntax)
  • order_by: Order by condition (SQL syntax)
  • Returns: Query result (object)

get_network_alerts(self, epoch_begin, epoch_end, select_clause, where_clause, maxhits, group_by, order_by)

Returns network alerts matching the specified criteria.

  • epoch_begin: Start of the time interval (epoch)
  • epoch_end: End of the time interval (epoch)
  • select_clause: Select clause (SQL syntax)
  • where_clause: Where clause (SQL syntax)
  • maxhits: Max number of results (limit)
  • group_by: Group by condition (SQL syntax)
  • order_by: Order by condition (SQL syntax)
  • Returns: Query result (object)

get_snmp_alerts(self, epoch_begin, epoch_end, select_clause, where_clause, maxhits, group_by, order_by)

Returns SNMP alerts matching the specified criteria.

  • epoch_begin: Start of the time interval (epoch)
  • epoch_end: End of the time interval (epoch)
  • select_clause: Select clause (SQL syntax)
  • where_clause: Where clause (SQL syntax)
  • maxhits: Max number of results (limit)
  • group_by: Group by condition (SQL syntax)
  • order_by: Order by condition (SQL syntax)
  • Returns: Query result (object)

get_system_alerts(self, epoch_begin, epoch_end, select_clause, where_clause, maxhits, group_by, order_by)

Returns system alerts matching the specified criteria.

  • epoch_begin: Start of the time interval (epoch)
  • epoch_end: End of the time interval (epoch)
  • select_clause: Select clause (SQL syntax)
  • where_clause: Where clause (SQL syntax)
  • maxhits: Max number of results (limit)
  • group_by: Group by condition (SQL syntax)
  • order_by: Order by condition (SQL syntax)
  • Returns: Query result (object)

get_user_alerts(self, epoch_begin, epoch_end, select_clause, where_clause, maxhits, group_by, order_by)

Returns user alerts matching the specified criteria.

  • epoch_begin: Start of the time interval (epoch)
  • epoch_end: End of the time interval (epoch)
  • select_clause: Select clause (SQL syntax)
  • where_clause: Where clause (SQL syntax)
  • maxhits: Max number of results (limit)
  • group_by: Group by condition (SQL syntax)
  • order_by: Order by condition (SQL syntax)
  • Returns: Query result (object)

timeseries_to_pandas(self, rsp)

Converts timeseries response to a pandas DataFrame.

  • rsp: Timeseries response data
  • Returns: Pandas DataFrame (object)

get_timeseries(self, ts_schema, ts_query, epoch_begin, epoch_end)

Returns timeseries data in a pandas DataFrame for a specified schema and query.

  • ts_schema: The timeseries schema (e.g., 'host:traffic')
  • ts_query: The timeseries query (e.g., 'ifid:0,host:10.0.0.1')
  • epoch_begin: Start of the time interval (epoch)
  • epoch_end: End of the time interval (epoch)
  • Returns: Timeseries data (object, pandas DataFrame)

get_timeseries_stats(self, ts_schema, ts_query, epoch_begin, epoch_end)

Returns statistics from timeseries.

  • ts_schema: The timeseries schema (e.g., 'host:traffic')
  • ts_query: The timeseries query (e.g., 'ifid:0,host:10.0.0.1')
  • epoch_begin: Start of the time interval (epoch)
  • epoch_end: End of the time interval (epoch)
  • Returns: Timeseries statistics (object)

get_timeseries_metadata(self)

Returns timeseries metadata (lists all available timeseries).

  • Returns: Timeseries metadata (object)

get_host_timeseries(self, host_ip, ts_schema, epoch_begin, epoch_end)

Returns timeseries data in a pandas DataFrame for a specified interface and host.

  • host_ip: The host IP
  • ts_schema: The timeseries schema
  • epoch_begin: Start of the time interval (epoch)
  • epoch_end: End of the time interval (epoch)
  • Returns: Timeseries data (object, pandas DataFrame)

get_host_timeseries_stats(self, host_ip, ts_schema, epoch_begin, epoch_end)

Returns timeseries statistics for a specified interface and host.

  • host_ip: The host IP
  • ts_schema: The timeseries schema
  • epoch_begin: Start of the time interval (epoch)
  • epoch_end: End of the time interval (epoch)
  • Returns: Timeseries statistics (object)

get_interface_timeseries(self, ts_schema, epoch_begin, epoch_end)

Returns timeseries data in a pandas DataFrame for a specified interface.

  • ts_schema: The timeseries schema
  • epoch_begin: Start of the time interval (epoch)
  • epoch_end: End of the time interval (epoch)
  • Returns: Timeseries data (object, pandas DataFrame)

get_interface_timeseries_stats(self, ts_schema, epoch_begin, epoch_end)

Returns timeseries statistics for a specified interface.

  • ts_schema: The timeseries schema
  • epoch_begin: Start of the time interval (epoch)
  • epoch_end: End of the time interval (epoch)
  • Returns: Timeseries statistics (object)

get_flows(self, epoch_begin, epoch_end, select_clause, where_clause, maxhits, group_by, order_by)

Runs queries on the historical flows database (ClickHouse).

  • epoch_begin: Start of the time interval (epoch)
  • epoch_end: End of the time interval (epoch)
  • select_clause: Select clause (SQL syntax)
  • where_clause: Where clause (SQL syntax)
  • maxhits: Max number of results (limit)
  • group_by: Group by condition (SQL syntax)
  • order_by: Order by condition (SQL syntax)
  • Returns: Query result (object)

get_topk_flows(self, epoch_begin, epoch_end, max_hits, where_clause)

Retrieves Top-K results from the historical flows database.

  • epoch_begin: Start of the time interval (epoch)
  • epoch_end: End of the time interval (epoch)
  • max_hits: Max number of results (limit)
  • where_clause: Where clause (SQL syntax)
  • Returns: Query result (object)

get_top_conversations(self, epoch_begin, epoch_end, host=None)

Returns Top Conversations.

  • epoch_begin: Start of the time interval (epoch)
  • epoch_end: End of the time interval (epoch)
  • host (optional): Host IP address
  • Returns: Top conversations (object)

get_host_top_protocols(self, host, epoch_begin, epoch_end)

Returns Top protocols for a specified host.

  • host: Host IP address
  • epoch_begin: Start of the time interval (epoch)
  • epoch_end: End of the time interval (epoch)
  • Returns: Top protocols (object)