# Configuration APIs

Using Configuration APIs, you can configure and manage following entities in a Fabric-enabled Logpoint:

* Devices
* Device groups
* Distributed Collectors
* Normalization policies
* Repos
* Distributed LogPoints
* Parsers
* Enrichment sources
* Enrichment policies
* Routing policies
* Processing policies
* SNMP policies
* LogCollection policies
* RawSyslog forwarder
* UEBA Settings

## Devices API

**Devices** are the machines from which LogPoint collects logs.

<table data-header-hidden><thead><tr><th width="250.66668701171875"></th><th></th></tr></thead><tbody><tr><td><strong>Endpoint</strong></td><td><strong>Description</strong></td></tr><tr><td>AddIgnoredIps</td><td>Adds a device to the ignored IP list.</td></tr><tr><td>Attach</td><td>Attaches devices on behalf of the collector LogPoint from the main LogPoint in a Distributed LogPoint setup.</td></tr><tr><td>Create</td><td>Creates a new device.</td></tr><tr><td>Detach</td><td>Detaches devices on behalf of the collector LogPoint from the main LogPoint in a Distributed LogPoint setup.</td></tr><tr><td>Edit</td><td>Edits the device configurations with the given ID.</td></tr><tr><td>Get</td><td>Fetches the device configurations with the given ID.</td></tr><tr><td>GetPlugins</td><td>Fetches the plugins with the given ID.</td></tr><tr><td>Install</td><td>Installs the given CSV file with device configurations.</td></tr><tr><td>List</td><td>Lists the devices.</td></tr><tr><td>ListBlockedIps</td><td>Lists the IPs of all the devices in the blocked IP list.</td></tr><tr><td>ListIgnoredIps</td><td>Lists the IPs of all the devices in the ignored IP list.</td></tr><tr><td>ListPrivateUploads</td><td>Lists the files from the private storage of the API.</td></tr><tr><td>ListPublicUploads</td><td>Lists the files from the public storage of the API.</td></tr><tr><td>RefreshBlockedIps</td><td>Updates the blocked IP list.</td></tr><tr><td>Trash</td><td>Deletes the device with the given ID.</td></tr><tr><td>TrashIgnoredIps</td><td>Removes the device IP of the given ID from the ignored IP list.</td></tr><tr><td>TrashPrivateUploads</td><td>Deletes the file with the given name from the private storage of the API.</td></tr><tr><td>TrashPublicUploads</td><td>Deletes the file with the given name from the public storage of the API.</td></tr><tr><td>Upload</td><td>Uploads the given file in the private storage of the API.</td></tr><tr><td>UploadPublic</td><td>Uploads the given file in the public storage of the API.</td></tr></tbody></table>

{% hint style="info" %}
The following endpoints can be accessed using Fabric-enabled LogPoint v6.7.2 and later:
{% endhint %}

* Devices - Install
* Devices - ListPrivateUploads
* Devices - ListPublicUploads
* Devices - TrashPrivateUploads
* Devices - TrashPublicUploads
* Devices - Upload
* Devices - UploadPublic

## DeviceGroups API

*Device Groups* are a cluster of log collecting devices. One device can be associated with more than one device group.

<table data-header-hidden><thead><tr><th width="249.8333740234375"></th><th></th></tr></thead><tbody><tr><td><strong>Endpoint</strong></td><td><strong>Description</strong></td></tr><tr><td>Create</td><td>Creates a new device group.</td></tr><tr><td>Edit</td><td>Edits the settings of the device group with the given ID.</td></tr><tr><td>Get</td><td>Fetches the device group with the given ID.</td></tr><tr><td>List</td><td>Lists the device groups.</td></tr><tr><td>Trash</td><td>Deletes the device group with the given ID.</td></tr></tbody></table>

## DistributedCollectors API

The **DistributedCollectors** API allows you to activate, deactivate, and delete **LogPoint Collectors** of a Fabric-enabled LogPoint.

A *LogPoint Collector* collects logs from different sources, normalizes them against the signatures applied, and forwards them.

<table data-header-hidden><thead><tr><th width="249.83331298828125"></th><th></th></tr></thead><tbody><tr><td><strong>Endpoint</strong></td><td><strong>Description</strong></td></tr><tr><td>Activate</td><td>Activates the distributed collector with the given ID.</td></tr><tr><td>Deactivate</td><td>Deactivates the distributed collector with the given ID.</td></tr><tr><td>Get</td><td>Fetches the distributed collector with the given ID.</td></tr><tr><td>List</td><td>Lists the distributed collectors.</td></tr><tr><td>RefreshList</td><td>Updates the distributed collectors data list.</td></tr><tr><td>Trash</td><td>Deletes the distributed collector with the given ID.</td></tr></tbody></table>

## NormalizationPolicy API

*Normalization policies* determine the process through which data in the incoming logs are grouped into key-value pairs. Each normalization policy is a combination of one or more normalization packages.

<table data-header-hidden><thead><tr><th width="250.66668701171875"></th><th></th></tr></thead><tbody><tr><td><strong>Endpoint</strong></td><td><strong>Description</strong></td></tr><tr><td>Create</td><td>Creates a new normalization policy.</td></tr><tr><td>Edit</td><td>Edits the settings of the normalization policy with the given ID.</td></tr><tr><td>Get</td><td>Fetches the normalization policy with the given ID.</td></tr><tr><td>List</td><td>Lists the normalization policies.</td></tr><tr><td>Trash</td><td>Deletes the normalization policy with the given ID.</td></tr></tbody></table>

## Repos API

*Repos* (repositories) in a LogPoint collect streaming logs and store them securely. A single repo consists of one or more repo paths with their respective retention policies. The retainment of the logs in the repos depends on the retention policy.

<table data-header-hidden><thead><tr><th width="250.66668701171875"></th><th></th></tr></thead><tbody><tr><td><strong>Endpoint</strong></td><td><strong>Description</strong></td></tr><tr><td>Create</td><td>Creates a new repo.</td></tr><tr><td>Edit</td><td>Updates the configuration settings of a repo with the given ID.</td></tr><tr><td>FetchRemoteRepos</td><td>Fetches the local and remote repos.</td></tr><tr><td>Get</td><td>Fetches the repo with the given ID.</td></tr><tr><td>List</td><td>Lists the repos.</td></tr><tr><td>ListRepoPaths</td><td>Lists the allowed repo paths created from LogPoint by the <strong>li-admin</strong> user.</td></tr><tr><td>RefreshRepoPaths</td><td>Syncs the repo path with LogPoint repo path.</td></tr><tr><td>Trash</td><td>Deletes the repo with the given ID.</td></tr></tbody></table>

## DistributedLogPoints API

Using this API, you can connect multiple Fabric-enabled LogPoint instances and store their logs. You can monitor, configure, and analyze the logs on the connected machines.

<table data-header-hidden><thead><tr><th width="249.8333740234375"></th><th></th></tr></thead><tbody><tr><td><strong>Endpoint</strong></td><td><strong>Description</strong></td></tr><tr><td>Create</td><td>Adds a distributed LogPoint.</td></tr><tr><td>Edit</td><td>Edits the distributed LogPoint settings with the given ID.</td></tr><tr><td>Get</td><td>Fetches the distributed LogPoint with the given ID.</td></tr><tr><td>List</td><td>Lists the distributed LogPoints.</td></tr><tr><td>RefreshList</td><td>Syncs the distributed LogPoint's data.</td></tr><tr><td>Trash</td><td>Deletes the distributed LogPoint with the given ID.</td></tr></tbody></table>

## Parsers API

*Parsers* analyze the incoming log data and extract individual logs from them. These logs are then broken into smaller elements so that further processing can be done on each log separately.

<table data-header-hidden><thead><tr><th width="249.8333740234375"></th><th></th></tr></thead><tbody><tr><td><strong>Endpoint</strong></td><td><strong>Description</strong></td></tr><tr><td>Check</td><td>Checks the regex pattern.</td></tr><tr><td>Create</td><td>Creates a new parser.</td></tr><tr><td>Edit</td><td>Edits the parser with the given ID.</td></tr><tr><td>Get</td><td>Fetches the parser with the given ID.</td></tr><tr><td>List</td><td>Lists the parsers.</td></tr><tr><td>Trash</td><td>Deletes the parser with the given ID.</td></tr></tbody></table>

## EnrichmentSource API

An *enrichment source* maintains the data that a Fabric-enabled LogPoint can use to enrich its logs.

<table data-header-hidden><thead><tr><th width="248.16668701171875"></th><th></th></tr></thead><tbody><tr><td><strong>Endpoint</strong></td><td><strong>Description</strong></td></tr><tr><td>Get</td><td>Fetches an enrichment source with the given ID.</td></tr><tr><td>List</td><td>Lists the enrichment sources.</td></tr><tr><td>RefreshList</td><td>Syncs the enrichment sources.</td></tr></tbody></table>

## EnrichmentPolicy API

An *enrichment policy* is a set of *enrichment specifications* which consist of *enrichment criteria* and *enrichment rules*. The enrichment criteria are the conditions that must match the key-value pairs of the normalized event logs. Once the criteria are matched, the Fabric-enabled LogPoint uses the enrichment rules to enrich the logs.

<table data-header-hidden><thead><tr><th width="250.66668701171875"></th><th></th></tr></thead><tbody><tr><td><strong>Endpoint</strong></td><td><strong>Description</strong></td></tr><tr><td>Create</td><td>Creates a new enrichment policy.</td></tr><tr><td>Edit</td><td>Edits the enrichment policy with the given ID.</td></tr><tr><td>Get</td><td>Fetches the enrichment policy with the given ID.</td></tr><tr><td>List</td><td>Lists the enrichment policies.</td></tr><tr><td>Trash</td><td>Deletes the enrichment policy with the given ID.</td></tr></tbody></table>

## RoutingPolicies API

*Routing policies* allow you to selectively direct the incoming logs into different repos. You can perform routing by *key-value match* or *key-present criteria*.

<table data-header-hidden><thead><tr><th width="249.00006103515625"></th><th></th></tr></thead><tbody><tr><td><strong>Endpoint</strong></td><td><strong>Description</strong></td></tr><tr><td>Create</td><td>Creates a new routing policy.</td></tr><tr><td>Edit</td><td>Edits the routing policy with the given ID.</td></tr><tr><td>Get</td><td>Fetches the routing policy with the given ID.</td></tr><tr><td>List</td><td>Lists the routing policies.</td></tr><tr><td>Trash</td><td>Deletes the routing policy with the given ID.</td></tr></tbody></table>

## ProcessingPolicy API

A *processing policy* integrates a normalization policy, an enrichment policy, and a routing policy into a single policy. This method eliminates the need to add a normalization policy, an enrichment policy, and a routing policy every time you configure a collector or a fetcher.

<table data-header-hidden><thead><tr><th width="249.8333740234375"></th><th></th></tr></thead><tbody><tr><td><strong>Endpoint</strong></td><td><strong>Description</strong></td></tr><tr><td>Create</td><td>Creates a new processing policy.</td></tr><tr><td>Edit</td><td>Edits the processing policy with the given ID.</td></tr><tr><td>Get</td><td>Fetches the processing policy with the given ID.</td></tr><tr><td>List</td><td>Lists the processing policies.</td></tr><tr><td>Trash</td><td>Deletes the processing policy with the given ID.</td></tr></tbody></table>

## SNMPPolicy API

<table data-header-hidden><thead><tr><th width="251.50006103515625"></th><th></th></tr></thead><tbody><tr><td><strong>Endpoint</strong></td><td><strong>Description</strong></td></tr><tr><td>Create</td><td>Creates a new SNMP policy.</td></tr><tr><td>Edit</td><td>Edits the SNMP policy with the given ID.</td></tr><tr><td>Get</td><td>Fetches the SNMP policy with the given ID.</td></tr><tr><td>List</td><td>Lists the SNMP policies.</td></tr><tr><td>Trash</td><td>Deletes the SNMP policy with the given ID.</td></tr></tbody></table>

## LogCollectionPolicies API

*Log Collection Policies* are the rules that Fabric-enabled LogPoint uses to collect logs.

<table data-header-hidden><thead><tr><th width="251.5"></th><th></th></tr></thead><tbody><tr><td><strong>Endpoint</strong></td><td><strong>Description</strong></td></tr><tr><td>Create</td><td>Creates a new log collection policy.</td></tr><tr><td>Edit</td><td>Edits the log collection policy with the given ID.</td></tr><tr><td>Get</td><td>Fetches the log collection policy with the given ID.</td></tr><tr><td>GetPlugins</td><td>Fetches the plugins that use the log collection policy with the given ID.</td></tr><tr><td>List</td><td>Lists the log collection policies.</td></tr><tr><td>Trash</td><td>Deletes the log collection policy with the given ID.</td></tr></tbody></table>

{% hint style="info" %}
You can configure log collection policies for Fabric-enabled LogPoint v6.7.2 and later.
{% endhint %}

## RawSyslogForwarder API

LogPoint collects and forwards the raw syslog messages from the devices to the targets. *Raw Syslog Forwarder (RSF)* collects logs from different sources and forwards the raw messages to a remote server. Refer to the [Raw Syslog Forwarder](https://docs.logpoint.com/director/director-apis/director-console-api-documentation/rawsyslogforwarder) section for more details.

<table data-header-hidden><thead><tr><th width="249.8333740234375"></th><th></th></tr></thead><tbody><tr><td><strong>Endpoint</strong></td><td><strong>Description</strong></td></tr><tr><td>Create</td><td>Creates a new raw syslog forwarder device.</td></tr><tr><td>CreateTarget</td><td>Creates a new target.</td></tr><tr><td>Edit</td><td>Updates the existing configuration of the raw syslog forwarder with the given ID.</td></tr><tr><td>EditTarget</td><td>Edits the target settings with the given ID.</td></tr><tr><td>Get</td><td>Fetches the raw syslog forwarder with the given ID.</td></tr><tr><td>GetTarget</td><td>Fetches the target with the given ID.</td></tr><tr><td>List</td><td>Lists all raw syslog forwarders.</td></tr><tr><td>ListTarget</td><td>Lists all targets in the Fabric-enabled Logpoint.</td></tr><tr><td>Trash</td><td>Deletes the raw syslog fowarder with the given ID.</td></tr><tr><td>TrashTarget</td><td>Deletes the target with the given id.</td></tr></tbody></table>

{% hint style="info" %}
You can configure and manage raw syslog forwarders and target devices for Fabric-enabled LogPoint v7.0.0 and later.
{% endhint %}

## UEBA API

Using the UEBA endpoints, you can:

* Enable and disable UEBA,
* Add UEBA license,
* Select repos, alert logs, and entities for UEBA analysis, and
* Monitor the health status and validation logs of the UEBA system.

User and Entity Behavior Analytics (UEBA) enables LogPoint to detect abnormal and risky behaviors by evaluating activities that differ from the previously set baselines. To learn more, see the [UEBA](https://docs.logpoint.com/docs/ueba-onboarding/en/latest/) guide.

<table data-header-hidden><thead><tr><th width="249.00006103515625"></th><th></th></tr></thead><tbody><tr><td><strong>Endpoint</strong></td><td><strong>Description</strong></td></tr><tr><td>ConfigureAlertLogs</td><td>Configures risk score for UEBA alerts. LogPoint uses the risk score to categorize the UEBA anomalies based on their risk level.</td></tr><tr><td>ConfigureRepo</td><td>Adds the given repositories for UEBA analysis.</td></tr><tr><td>EnableUEBAMode</td><td>Enables or disables the UEBA configurations in the given LogPoint.</td></tr><tr><td>CreateEntity</td><td>Adds new entities for UEBA analysis.</td></tr><tr><td>EditEntity</td><td>Updates the UEBA entity with the given ID.</td></tr><tr><td>FetchHealthStatus</td><td>Returns UEBA's health status and validation information summary.</td></tr><tr><td>FetchUEBALicenseState</td><td>Returns the current status of the UEBA license in the given LogPoint.</td></tr><tr><td>FetchValidationReport</td><td>Returns the details of the violated logs for all data sources in the given LogPoint.</td></tr><tr><td>GetEntity</td><td>Fetches the details of the UEBA entity with the given ID.</td></tr><tr><td>InstallUEBALicense</td><td>Installs the UEBA license in the given LogPoint.</td></tr><tr><td>ListEntities</td><td>Returns an array of the UEBA entities' information.</td></tr><tr><td>ListPrivateUploads</td><td>Returns the list of the UEBA license package files available in the API server's private storage.</td></tr><tr><td>ListPublicUploads</td><td>Returns the list of the UEBA license package files available in the API server's public storage.</td></tr><tr><td>ListUEBAConfiguration</td><td>Returns the details of UEBA License consumption in the given LogPoint.</td></tr><tr><td>ListUEBALicenseInfo</td><td>Lists the details of the UEBA license currently used in the given LogPoint.</td></tr><tr><td>RefreshConfigurationLists</td><td>Syncs the UEBA configuration list in the API server with LogPoint's configuration list.</td></tr><tr><td>RefreshEntityLists</td><td>Syncs UEBA entity list in the API server with LogPoint's entity list.</td></tr><tr><td>TrashEntity</td><td>Deletes the UEBA entity with the given ID.</td></tr><tr><td>TrashPrivateUploads</td><td>Deletes the UEBA license with the given name from the API server's private storage.</td></tr><tr><td>TrashPublicUploads</td><td>Deletes the UEBA license with the given name from the API server's public storage.</td></tr><tr><td>UpdateEntityPriorities</td><td>Updates the UEBA entities' priorities.</td></tr><tr><td>Upload</td><td>Uploads the given UEBA license package file to the API server's private storage.</td></tr><tr><td>UploadPublic</td><td>Uploads the given UEBA license package file to the API server's public storage.</td></tr></tbody></table>

{% hint style="info" %}
You can configure and manage the UEBA settings for Fabric-enabled Logpoint v7.1.0 and later.
{% endhint %}
