.. _ddos_detection:

ddos detection
==============

DDoS Detection Commands


detection Specification
-----------------------

	===================================== =======================================================
	 **Parameter**                         **Value** 

	===================================== =======================================================
	 **Type**                              *Configuration Resource*

	 **Element Name**                      detection

	 **Element URI**                       /axapi/v3/ddos/detection

	 **Element Attributes**                detection_attributes

	 **Partition Visibility**              shared

	 **Schema**                             :download:`detection schema <ddos-detection/ddos-detection.txt>`
	===================================== =======================================================





	**Operations Allowed:**




.. raw:: html

   <script type="text/javascript">
 function showExample(a,b) { document.getElementById(a+'_div').style.display = 'block'; document.getElementById(a+'_cl').style.display = 'block'; document.getElementById(a+'_eg').style.display = 'none';}
   function closeExample(a,b) { document.getElementById(a+'_div').style.display = 'none'; document.getElementById(a+'_cl').style.display = 'none'; document.getElementById(a+'_eg').style.display = 'block';}
 </script>
   <table width='90%' style='margin-left:5%'>



.. raw:: html

   <tr style='border-bottom: thin solid; border-top: thin solid'><th width=15%>Operation</th><th width=10%>Method</th><th>URI</th><th width=15%>Payload</th><th width=10%></th></tr>




.. raw:: html

   <tr  style='border-bottom: thin solid;'><td valign = 'top'>


Create Object



.. raw:: html

   </td><td valign = 'top'>


POST



.. raw:: html

   </td><td valign = 'top'>


/axapi/v3/ddos/detection



.. raw:: html

   </td><td valign = 'top'>


:ref:`102_detection_attributes`



.. raw:: html

   </td><td><button id='post_eg' onClick="showExample('post')">example</button> <button id='post_cl' onClick="closeExample('post')" style='display:none'>close</button></td></tr>




.. raw:: html

   <tr><td colspan=5 style='padding: 0         % 0    %;' valign = 'top'><div id='post_div' style='display:none'>


.. include:: ../artifacts/ddos_detection_POST.txt
   :literal:




.. raw:: html

   </div></td></tr>


.. raw:: html

   <tr  style='border-bottom: thin solid;'><td valign = 'top'>


Get Object



.. raw:: html

   </td><td valign = 'top'>


GET



.. raw:: html

   </td><td valign = 'top'>


/axapi/v3/ddos/detection



.. raw:: html

   </td><td valign = 'top'>


:ref:`102_detection_attributes`



.. raw:: html

   </td><td><button id='get_eg' onClick="showExample('get')">example</button> <button id='get_cl' onClick="closeExample('get')" style='display:none'>close</button></td></tr>




.. raw:: html

   <tr><td colspan=5 style='padding: 0         % 0    %;' valign = 'top'><div id='get_div' style='display:none'>


.. include:: ../artifacts/ddos_detection_GET.txt
   :literal:




.. raw:: html

   </div></td></tr>


.. raw:: html

   <tr  style='border-bottom: thin solid;'><td valign = 'top'>


Modify Object



.. raw:: html

   </td><td valign = 'top'>


POST



.. raw:: html

   </td><td valign = 'top'>


/axapi/v3/ddos/detection



.. raw:: html

   </td><td valign = 'top'>


:ref:`102_detection_attributes`



.. raw:: html

   </td><td></td></tr>




.. raw:: html

   <tr  style='border-bottom: thin solid;'><td valign = 'top'>


Replace Object



.. raw:: html

   </td><td valign = 'top'>


PUT



.. raw:: html

   </td><td valign = 'top'>


/axapi/v3/ddos/detection



.. raw:: html

   </td><td valign = 'top'>


:ref:`102_detection_attributes`



.. raw:: html

   </td><td><button id='put_eg' onClick="showExample('put')">example</button> <button id='put_cl' onClick="closeExample('put')" style='display:none'>close</button></td></tr>




.. raw:: html

   <tr><td colspan=5 style='padding: 0         % 0    %;' valign = 'top'><div id='put_div' style='display:none'>


.. include:: ../artifacts/ddos_detection_PUT.txt
   :literal:




.. raw:: html

   </div></td></tr>


.. raw:: html

   <tr  style='border-bottom: thin solid;'><td valign = 'top'>


Delete Object



.. raw:: html

   </td><td valign = 'top'>


DELETE



.. raw:: html

   </td><td valign = 'top'>


/axapi/v3/ddos/detection



.. raw:: html

   </td><td valign = 'top'>


:ref:`102_detection_attributes`



.. raw:: html

   </td><td><button id='delete_eg' onClick="showExample('delete')">example</button> <button id='delete_cl' onClick="closeExample('delete')" style='display:none'>close</button></td></tr>




.. raw:: html

   <tr><td colspan=5 style='padding: 0         % 0    %;' valign = 'top'><div id='delete_div' style='display:none'>


.. include:: ../artifacts/ddos_detection_DELETE.txt
   :literal:




.. raw:: html

   </div></td></tr>


.. raw:: html

   </table>

.. _102_detection_attributes:

detection attributes
--------------------

    **agent-list**

        **Type:** List

        **Reference Object:** :doc:`/axapi/v3/ddos/detection/agent/{agent-name} <ddos_detection_agent>`

    **ddos-script**

        **Description:** ddos-script is a **JSON Block**.  Please see below for :ref:`102_ddos-script` 

        **Type:** Object

        **Reference Object:** :doc:`/axapi/v3/ddos/detection/ddos-script <ddos_detection_ddos_script>`

    **disable**

        **Description** Disable DDoS detection (default: enabled)

        **Type:** boolean

        **Supported Values:** true, false, 1, 0

        **Default:** 0

    **resource-usage**

        **Description:** resource-usage is a **JSON Block**.  Please see below for :ref:`102_resource-usage` 

        **Type:** Object

        **Reference Object:** :doc:`/axapi/v3/ddos/detection/resource-usage <ddos_detection_resource_usage>`

    **settings**

        **Description:** settings is a **JSON Block**.  Please see below for :ref:`102_settings` 

        **Type:** Object

        **Reference Object:** :doc:`/axapi/v3/ddos/detection/settings <ddos_detection_settings>`

    **statistics**

        **Description:** statistics is a **JSON Block**.  Please see below for :ref:`102_statistics` 

        **Type:** Object

        **Reference Object:** :doc:`/axapi/v3/ddos/detection/statistics <ddos_detection_statistics>`

    **uuid**

        **Description** uuid of the object

        **Type:** string

        **Maximum Length:** 64 characters

        **Maximum Length:** 1 characters

.. _102_resource-usage:

resource-usage
^^^^^^^^^^^^^^
	=============================== ===================================================
	**Specification**                 **Value**
	=============================== ===================================================
	 **Type**                        *object*

	=============================== ===================================================

    **uuid**

        **Description** uuid of the object

        **Type:** string

        **Maximum Length:** 64 characters

        **Maximum Length:** 1 characters

.. _102_statistics:

statistics
^^^^^^^^^^
	=============================== ===================================================
	**Specification**                 **Value**
	=============================== ===================================================
	 **Type**                        *object*

	=============================== ===================================================

    **uuid**

        **Description** uuid of the object

        **Type:** string

        **Maximum Length:** 64 characters

        **Maximum Length:** 1 characters

.. _102_settings:

settings
^^^^^^^^
	=============================== ===================================================
	**Specification**                 **Value**
	=============================== ===================================================
	 **Type**                        *object*

	=============================== ===================================================

    **de-escalation-quiet-time**

        **Description** Configure de-escalation needed time in minutes from level 1 to 0.(default 1 minutes)

        **Type:** number

        **Range:** 1-60

    **detection-window-size**

        **Description** Configure detection window size in seconds (DDoS detection window size in seconds(default: 1))

        **Type:** number

        **Range:** 1-60

        **Default:** 1

    **detector-mode**

        **Description** 'standalone': Standalone detector; 'on-box': Mitigator and Detector on the same box; 'auto-svc-discovery': Auto Service discovery using Visibility module; 

        **Type:** string

        **Supported Values:** standalone, on-box, auto-svc-discovery

    **initial-learning-interval**

        **Description** Initial learning interval (in hours) before processing

        **Type:** number

        **Range:** 1-168

    **notification-debug-log**

        **Description** 'enable': Enable detection notification debug log (default: disabled); 

        **Type:** string

        **Supported Values:** enable

    **pkt-sampling**

        **Description:** pkt-sampling is a **JSON Block**.  Please see below for :ref:`102_settings_pkt-sampling` 

        **Type:** Object

    **standalone-settings**

        **Description:** standalone-settings is a **JSON Block**.  Please see below for :ref:`102_settings_standalone-settings` 

        **Type:** Object

        **Reference Object:** :doc:`/axapi/v3/ddos/detection/settings/standalone-settings <ddos_detection_settings_standalone_settings>`

    **uuid**

        **Description** uuid of the object

        **Type:** string

        **Maximum Length:** 64 characters

        **Maximum Length:** 1 characters

.. _102_settings_standalone-settings:

settings_standalone-settings
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
	=============================== ===================================================
	**Specification**                 **Value**
	=============================== ===================================================
	 **Type**                        *object*

	=============================== ===================================================

    **netflow**

        **Description:** netflow is a **JSON Block**.  Please see below for :ref:`102_settings_standalone-settings_netflow` 

        **Type:** Object

        **Reference Object:** :doc:`/axapi/v3/ddos/detection/settings/standalone-settings/netflow <ddos_detection_settings_standalone_settings_netflow>`

    **sflow**

        **Description:** sflow is a **JSON Block**.  Please see below for :ref:`102_settings_standalone-settings_sflow` 

        **Type:** Object

        **Reference Object:** :doc:`/axapi/v3/ddos/detection/settings/standalone-settings/sflow <ddos_detection_settings_standalone_settings_sflow>`

    **uuid**

        **Description** uuid of the object

        **Type:** string

        **Maximum Length:** 64 characters

        **Maximum Length:** 1 characters

.. _102_settings_standalone-settings_netflow:

settings_standalone-settings_netflow
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
	=============================== ===================================================
	**Specification**                 **Value**
	=============================== ===================================================
	 **Type**                        *object*

	=============================== ===================================================

    **listening-port**

        **Description** Netflow port to receive packets (Netflow port number(default 9996))

        **Type:** number

        **Range:** 1-65535

        **Default:** 9996

    **template-active-timeout**

        **Description** Configure active timeout of the netflow templates received in mins (Template active timeout(mins)(default 30mins))

        **Type:** number

        **Range:** 2-300

        **Default:** 30

    **uuid**

        **Description** uuid of the object

        **Type:** string

        **Maximum Length:** 64 characters

        **Maximum Length:** 1 characters

.. _102_settings_standalone-settings_sflow:

settings_standalone-settings_sflow
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
	=============================== ===================================================
	**Specification**                 **Value**
	=============================== ===================================================
	 **Type**                        *object*

	=============================== ===================================================

    **listening-port**

        **Description** sFlow port to receive packets (sFlow port number(default 6343))

        **Type:** number

        **Range:** 1-65535

        **Default:** 6343

    **uuid**

        **Description** uuid of the object

        **Type:** string

        **Maximum Length:** 64 characters

        **Maximum Length:** 1 characters

.. _102_settings_pkt-sampling:

settings_pkt-sampling
^^^^^^^^^^^^^^^^^^^^^
	=============================== ===================================================
	**Specification**                 **Value**
	=============================== ===================================================
	 **Type**                        *object*

	=============================== ===================================================

    **assign-index**

        **Description** Lower index is more aggressive sampling

        **Type:** number

        **Range:** 1-64

    **assign-rate**

        **Description** Assign rate to given index

        **Type:** number

        **Range:** 1-50000000

    **override-rate**

        **Description** Sample 1 in X packets (default: X=1)

        **Type:** number

        **Range:** 1-50000000

.. _102_ddos-script:

ddos-script
^^^^^^^^^^^
	=============================== ===================================================
	**Specification**                 **Value**
	=============================== ===================================================
	 **Type**                        *object*

	=============================== ===================================================

    **action**

        **Description** 'delete': delete; 

        **Type:** string

        **Supported Values:** delete

    **file**

        **Description** startup-config local file name

        **Type:** string

        **Maximum Length:** 63 characters

        **Maximum Length:** 1 characters

    **uuid**

        **Description** uuid of the object

        **Type:** string

        **Maximum Length:** 64 characters

        **Maximum Length:** 1 characters

.. _102_agent-list:

agent-list
^^^^^^^^^^
	=============================== ===================================================
	**Specification**                 **Value**
	=============================== ===================================================
	 **Type**                        *list*

	 **Block object keys**             

	=============================== ===================================================

    **agent-name**

        **Description** Specify name for the agent

        **Type:** string

        **Format:** string-rlx

        **Maximum Length:** 63 characters

        **Maximum Length:** 1 characters

    **agent-v4-addr**

        **Description** Configure agent's IPv4 address

        **Type:** string

        **Format:** ipv4-address

    **agent-v6-addr**

        **Description** Configure agent's IPv6 address

        **Type:** string

        **Format:** ipv6-address

    **netflow**

        **Description:** netflow is a **JSON Block**.  Please see below for :ref:`102_agent-list_netflow` 

        **Type:** Object

        **Reference Object:** :doc:`/axapi/v3/ddos/detection/agent/{agent-name}/netflow <ddos_detection_agent>`

    **sflow**

        **Description:** sflow is a **JSON Block**.  Please see below for :ref:`102_agent-list_sflow` 

        **Type:** Object

        **Reference Object:** :doc:`/axapi/v3/ddos/detection/agent/{agent-name}/sflow <ddos_detection_agent>`

    **user-tag**

        **Description** Customized tag

        **Type:** string

        **Format:** string-rlx

        **Maximum Length:** 127 characters

        **Maximum Length:** 1 characters

    **uuid**

        **Description** uuid of the object

        **Type:** string

        **Maximum Length:** 64 characters

        **Maximum Length:** 1 characters

.. _102_agent-list_sflow:

agent-list_sflow
^^^^^^^^^^^^^^^^
	=============================== ===================================================
	**Specification**                 **Value**
	=============================== ===================================================
	 **Type**                        *object*

	=============================== ===================================================

    **sflow-pkt-samples-collection**

        **Description** 'enable': Enable sflow packet samples collection(default); 'disable': Disable sflow packet samples collection; 

        **Type:** string

        **Supported Values:** enable, disable

        **Default:** enable

    **uuid**

        **Description** uuid of the object

        **Type:** string

        **Maximum Length:** 64 characters

        **Maximum Length:** 1 characters

.. _102_agent-list_netflow:

agent-list_netflow
^^^^^^^^^^^^^^^^^^
	=============================== ===================================================
	**Specification**                 **Value**
	=============================== ===================================================
	 **Type**                        *object*

	=============================== ===================================================

    **netflow-samples-collection**

        **Description** 'enable': Enable Netflow flow samples collection(default); 'disable': Disable Netflow flow samples collection; 

        **Type:** string

        **Supported Values:** enable, disable

        **Default:** enable

    **netflow-sampling-rate**

        **Description** Configure agent's netflow sampling rate

        **Type:** number

        **Range:** 1-65535

        **Default:** 1

    **uuid**

        **Description** uuid of the object

        **Type:** string

        **Maximum Length:** 64 characters

        **Maximum Length:** 1 characters