Technical Forum
Ask questions. Discover Answers.
cancel
Showing results for 
Search instead for 
Did you mean: 

iControl API and command to retrieve only attack signatures with Modified date after some particular date ?

Alok_Kumar
Altostratus
Altostratus

I'm trying thru CLI to enable for blocking attack signatures released after a particular date of July 13 2020. For that I'm trying to load the signature Ids in a file thru the command below, I got the date converted to microseconds using epochconverter.com/ before putting in the API call. When I ran the command from CLI I see old signatures are also getting loaded. If I check this on the Attack signatures GUI using filter ( update date after July 13 ) it shows 2 signatures only. Am I using the API incorrectly ?

 

# curl -sku admin:admin https://10.1.1.4/mgmt/tm/asm/policies/POLICY_ID/signatures?/$filter=lastUpdateMicros%20gt%1594598400000 | jq '.' | grep -- 'lastUpdateMicros\|signatureId' | grep signatureId | tee signature_list.txt

1 REPLY 1

Ivan_Chernenkii
F5 Employee
F5 Employee

Hello Alok,

 

You have time in milliseconds (13-digit) in your filter, while it must be in microseconds (16-digit) to correct filtering by lastUpdateMicros field.

 

Thanks, Ivan