no data returned anymore by stat_ips_events()

[Olivier6767]

Since I updated to Unifi Network 9.3.45 I do not get data anymore with stat_ips_events().
Returned array is empty.

I have IPS enabled with Notify and Block and in Logs/Security and I can see the Threat Detected and IP Blocked messages.

I've now upgraded to 9.4.17 and it still results an empty array.

Can anyone confirm this is effectively broken?

[CamGitsIT]

Heyyyyy Oliver -- from Atlanta GA here and I have two production sites matching that software version and running IDS. I haven't noticed that however, I would be happy to do some testing in tandem with you. If you wanted to share some screen shots from your site manager, or just the specifics of the settings you're particularly concerned with -- we can serve up some scientific method on this question.

Since I updated to Unifi Network 9.3.45 I do not get data anymore with stat_ips_events().
Returned array is empty.

I have IPS enabled with Notify and Block and in Logs/Security and I can see the Threat Detected and IP Blocked messages.

I've now upgraded to 9.4.17 and it still results an empty array.

Can anyone confirm this is effectively broken?

[malle-pietje]

I think you'll need to switch this method (get_system_log()):

UniFi-API-client/src/Client.php

Lines 3654 to 3710 in ed2ceec

	/**
	* Fetch system log entries.
	*
	* @note - defaults to the past 7*24 hours
	* - results are paged; use $page_number to iterate over pages and $page_size to set page size
	* @param string $class optional, class of the system log entries to fetch, known valid values:
	* 'device-alert', 'next-ai-alert', 'vpn-alert', 'admin-activity', 'update-alert',
	* 'client-alert', 'threat-alert', 'triggers', default value is 'device-alert'
	* @param ?int $start optional, start time in milliseconds since the Unix epoch
	* @param ?int $end optional, end time in milliseconds since the Unix epoch
	* @param int $page_number optional, page number to fetch, default value is 0 (first page)
	* @param int $page_size optional, number of entries to fetch per page, default value is 100
	* @param array $custom_payload optional, an array of additional parameters to pass with the request. Is merged
	* with the default payload array constructed by this method using array_merge().
	* @return array array containing results from the selected system log section/class.
	* The 'data' key in the returned array contains the actual system log entries.
	* The returned array also contains the page number and size, and the total number of entries
	* available.
	* @throws Exception
	*/
	public function get_system_log(string $class = 'device-alert', ?int $start = null, ?int $end = null, int $page_number = 0, int $page_size = 100, array $custom_payload = [])
	{
	$end = empty($end) ? time() * 1000 : $end;
	$start = empty($start) ? $end - (7 * 24 * 3600 * 1000) : $start;
	$payload = [
	'pageNumber' => $page_number,
	'pageSize' => $page_size,
	'timestampFrom' => $start,
	'timestampTo' => $end,
	];
	switch ($class) {
	case 'next-ai-alert':
	$payload['nextAiCategory'] = ['CLIENT', 'DEVICE', 'INTERNET', 'VPN'];
	break;
	case 'admin-activity':
	$payload['activity_keys'] = ['ACCESSED_NETWORK_WEB', 'ACCESSED_NETWORK_IOS', 'ACCESSED_NETWORK_ANDROID'];
	$payload['change_keys'] = ['CLIENT', 'DEVICE', 'HOTSPOT', 'INTERNET', 'NETWORK', 'PROFILE', 'ROUTING', 'SECURITY', 'SYSTEM', 'VPN', 'WIFI'];
	break;
	case 'update-alert':
	$payload['systemLogDeviceTypes'] = ['GATEWAYS', 'SWITCHES', 'ACCESS_POINT', 'SMART_POWER', 'BUILDING_TO_BUILDING_BRIDGES', 'UNIFI_LTE'];
	break;
	case 'client-alert':
	$payload['clientType'] = ['GUEST', 'TELEPORT', 'VPN', 'WIRELESS', 'RADIUS', 'WIRED'];
	$payload['guestAuthorizationMethod'] = ['FACEBOOK_SOCIAL_GATEWAY', 'FREE_TRIAL', 'GOOGLE_SOCIAL_GATEWAY', 'NONE', 'PASSWORD', 'PAYMENT', 'RADIUS', 'VOUCHER'];
	break;
	case 'threat-alert':
	$payload['threatTypes'] = ['HONEYPOT', 'THREAT'];
	break;
	case 'triggers':
	$payload['triggerTypes'] = ['TRAFFIC_RULE', 'TRAFFIC_ROUTE', 'FIREWALL_RULE'];
	break;
	}
	return $this->fetch_results('/v2/api/site/' . $this->site . '/system-log/' . $class, array_merge($payload, $custom_payload));
	}

If anything needs to be changed to the method please let me know and we'll apply the necessary changes to the client.

[Olivier6767]

Thanks for the suggestion!
I tested the method get_system_log() and was able to adjust my script to gather almost the same information I used to get with stat_ips_events() when I filter on class=threat-alert.

The only information I'm missing is the signature information, or even better the detailed description found in the Advanced section.

Here is a screenshot:

Is this exposed by the API? Could it be added to the information returned by get_system-log() ?

Thanks for the support!

[malle-pietje]

Can you share the raw contents from the API for such an event? Sanitize if needed before posting here…

[malle-pietje]

If you’re using the API Browser this is really easy😉😋

[Olivier6767]

Sure, I'm using the API browser 😉
Here is one entry:

{
    "data": [
        {
            "category": "SECURITY",
            "event": "THREAT_BLOCKED",
            "id": "68b2cdbfbeb24f354689498d",
            "key": "THREAT_BLOCKED_V3",
            "message": "A network intrusion attempt from 198.235.24.6 to 10.1.1.75 has been detected and blocked.",
            "message_raw": "A network intrusion attempt from {SRC_IP} to {DST_IP} has been detected and blocked.",
            "parameters": {
                "CONSOLE_NAME": {
                    "id": "Firewall",
                    "name": "Firewall"
                },
                "CONSOLE_WITH_DEVICE_NAME": {
                    "id": "Firewall",
                    "name": "Firewall"
                },
                "DEVICE": {
                    "device_fingerprint_id": 3522,
                    "fingerprint_source": 0,
                    "id": "aa:bb:cc:dd:ee:ff",
                    "ip": "10.1.1.1",
                    "model": "UDM-Pro",
                    "model_name": "UDMPRO",
                    "name": "Firewall",
                    "version": "4.3.6"
                },
                "DST_IP": {
                    "id": "10.1.1.75",
                    "name": "10.1.1.75",
                    "not_actionable": true
                },
                "SRC_IP": {
                    "id": "198.235.24.6",
                    "name": "198.235.24.6",
                    "not_actionable": true
                },
                "INITIATOR_ID": {
                    "id": "68b2cdbebeb24f354689498b"
                }
            },
            "severity": "HIGH",
            "show_on_dashboard": false,
            "status": "NEW",
            "subcategory": "SECURITY_INTRUSION_PREVENTION",
            "target": "DEVICE",
            "timestamp": 1756548543089,
            "title_raw": "Threat Detected and Blocked",
            "type": "THREAT_DETECTION_AND_PREVENTION"
        },

[malle-pietje]

Hmm, not much there to use. I’ll see whether there’s an endpoint we can leverage for this.