Importing records into a context table

POST /api/v2/contextTables/import

The target correlator must be running.

Access: General administrator, Tenant administrator, Tier 2 analyst, Tier 1 analyst (can import data into any correlator table of an accessible tenant, even if the context table was created in the Shared tenant).

Query parameters (URL Query)

Name

Data type

Mandatory

Description

Value example

correlatorID

string

Yes

Correlator service ID

00000000-0000-0000-0000-000000000000

contextTableID

string

If contextTableName is not specified

Context table ID

00000000-0000-0000-0000-000000000000

contextTableName

string

If contextTableID is not specified

Name of the context table

Attackers

format

string

Yes

Format of imported entries

CSV, TSV, internal

clear

bool

No

Clear the context table before importing. If the parameter is present in the URL query, its value is assumed to be true. The values specified by the user are ignored.

/api/v2/contextTables/import?clear

Request body

Format

Contents

CSV

The first row is the header, which lists the comma-separated fields. The rest of the rows are the comma-separated values corresponding to the fields in the header. The number of fields in each row must be the same, and it must match the number of fields in the schema of the context table. List field values are separated by the "|" character. For example, the value of a list of integers might be 1|2|3.

TSV

The first row is the header, which lists the TAB-separated fields. The rest of the rows are the TAB-separated values corresponding to the fields in the header. The number of fields in each row must be the same, and it must match the number of fields in the schema of the context table. List field values are separated by the "|" character.

internal

Each line contains one individual JSON object. Data in the 'internal' format can be obtained by exporting the contents of the context table from the correlator in the KUMA web console.

Response

HTTP code: 204

Possible errors

HTTP code

Description

message field value

details field value

400

Correlator service ID is not specified.

query parameter required

correlatorID

400

Neither the contextTableID parameter nor the contextTableName parameter is specified

one of query parameters required

contextTableID, contextTableName

400

The 'format' parameter is not specified

query parameter required

format

400

The 'format' parameter is invalid

invalid query parameter value

format

400

The request body has zero length

request body required

-

400

Error parsing the request body, including the non-conformance of the field names and types of the record being imported with the schema of the context table.

correlator API request failed

variable

403

The user does not have the required role in the correlator tenant.

access denied

-

404

The service with the specified ID (correlatorID) was not found.

service not found

-

404

The context table was not found.

context table not found

-

406

The service with the specified ID (correlatorID) is not a correlator.

service is not correlator

-

406

The correlator did not execute the first start.

service not paired

-

406

The tenant of the correlator is disabled.

tenant disabled

-

406

More than one context table found by a search for contextTableName.

more than one matching context tables found

-

50x

Failed to gain access to the correlator API.

correlator API request failed

variable

500

Error preparing data for importing into the correlator service.

context table process import request failed

variable

500

Any other internal error.

variable

variable

Page top