sonar-ticket-events

Retrieves the list of events contained in the ticket with the specified GUID.

Command properties

Item	Description
Command type	Driver query
Required permission	Login required
License usage	N/A
Parallel execution	Not supported
Distributed execution	Not supported

Syntax

sonar-ticket-events guid=STR

Options

guid=STR: GUID of the ticket whose events you want to retrieve

Output fields

Field	Type	Description
`_time`	timestamp	Event time
`priority`	string	Priority. `HIGH`, `MEDIUM`, `LOW`
`guid`	string	Event GUID
`device_name`	string	Device name
`device_ip`	ipaddr	Device IP address
`site`	string	Site name
`ticket_guid`	string	Ticket GUID
`rule_id`	integer	Scenario ID
`rule_type`	string	Scenario type. `STREAM`, `BATCH`
`rule_name`	string	Scenario name
`user`	string	Account
`host_ip`	ipaddr	Host IP address
`src_ip`	ipaddr	Source IP address
`src_country`	string	Source country code. Example: `KR`
`src_port`	integer	Source port
`dst_ip`	ipaddr	Destination IP address
`dst_country`	string	Destination country code. Example: `KR`
`dst_port`	integer	Destination port
`protocol`	string	Protocol. Example: `TCP`, `UDP`, `ICMP`
`action`	string	Action. Example: `PERMIT`, `DENY`
`mail_from`	string	Sender address
`mail_to`	string	Recipient address
`mail_cc`	string	CC address
`md5`	string	MD5 hash
`url`	string	URL
`msg`	string	Message
`logger_id`	integer	Logger ID
`logger_name`	string	Logger name
`field_order`	string	Field order

Error codes

Parse errors

Error code	Message	Description
300101	Invalid sonar session.	The session is invalid or the user cannot be found.
300133	Specify guid option in the sonar-ticket-events command	The `guid` option is not specified.
300134	Specify valid GUID in the sonar-ticket-events command.	The `guid` option value is not in GUID format.
300135	Ticket not found.	No ticket exists for the specified GUID.

Runtime errors

N/A

Description

The sonar-ticket-events command retrieves the list of events linked to the ticket with the specified GUID. If the ticket does not exist, a parse error occurs.

Examples

Retrieve the event list for a specific ticket
```
sonar-ticket-events guid="550e8400-e29b-41d4-a716-446655440000"
```
Retrieves the list of events contained in the ticket with the specified GUID.

Aggregate events by source IP

sonar-ticket-events guid="550e8400-e29b-41d4-a716-446655440000"
| stats count by src_ip
| sort count desc

Aggregates ticket events by source IP and sorts them in descending order.