Technical Forum
Ask questions. Discover Answers.
Showing results for 
Search instead for 
Did you mean: 

iControl API and command to retrieve only attack signatures with Modified date after some particular date ?


I'm trying thru CLI to enable for blocking attack signatures released after a particular date of July 13 2020. For that I'm trying to load the signature Ids in a file thru the command below, I got the date converted to microseconds using before putting in the API call. When I ran the command from CLI I see old signatures are also getting loaded. If I check this on the Attack signatures GUI using filter ( update date after July 13 ) it shows 2 signatures only. Am I using the API incorrectly ?


# curl -sku admin:admin$filter=lastUpdateMicros%20gt%1594598400000 | jq '.' | grep -- 'lastUpdateMicros\|signatureId' | grep signatureId | tee signature_list.txt


F5 Employee
F5 Employee

Hello Alok,


You have time in milliseconds (13-digit) in your filter, while it must be in microseconds (16-digit) to correct filtering by lastUpdateMicros field.


Thanks, Ivan