--- title: "Get Grid Nodes" method: GET path: "/connect/grid/" tags: ["Grid"] --- # Get Grid Nodes `GET /connect/grid/` Retrieves the list of nodes that have recently checked-in with SOC. Nodes are grid members that have recently checked in with SOC. Under certain scenarios this may not include nodes that are accepted members of the grid but currently offline. Effectively, the results of this API call will match the view of the Grid screen in SOC (Not the Grid Members screen). ## Response `200` The list of grid nodes or an empty list is insufficient permissions - ModelNode[] - `address` string — The IP address of this node - `captureLossPct` number — The current percentage capture loss experienced by the network, if applicable to this node - `connectionStatus` string — The connectivity status between this node and the manager node: unknown, ok, fault - `consumptionEps` integer — The events per second (EPS) consumed by this node - `cpuUsedPct` number — The current CPU usage of the node, across all cores - `description` string — The node's optional description - `diskTotalNsmGB` number — Total size, in gigabytes, of the NSM data disk/partition - `diskTotalRootGB` number — Total size, in gigabytes, of the root operating system disk/partition - `diskUsedElasticGB` number — The disk space used, in gigabytes, on the backend data store system (Elasticsearch) - `diskUsedInfluxDbGB` number — The disk space used, in gigabytes, on the metrics data store system (InfluxDB) - `diskUsedNsmPct` number — Percentage usage of the NSM data disk/partition - `diskUsedRootPct` number — Percentage usage of the root system disk/partition - `epochTime` string — The node's data epoch; this is the date and time of the oldest known PCAP data available to the node - `eventstoreStatus` string — The event storage status; this refers to the backend status, such as Elasticsearch: unknown, ok, fault - `failedEvents` integer — The count of failed events (currently not in use)" - `fpsEnabled` integer — Indicates whether federal information processing standards are enabled on this node - `gmdEnabled` integer — Indicates whether guaranteed message delivery is enabled on this node - `gridId` string — Grid ID, used for subgrids - `highstateAgeSeconds` integer — How long ago, in seconds, the last highstate completed on this node - `id` string — The node ID - `imageBack` string — The Security Onion appliance back image, if available - `imageFront` string — The Security Onion appliance front image, if available - `ioWaitPct` number — The IO wait percentage for this node - `lksEnabled` integer — Indicates whether disk encryption is enabled on this node - `load15m` number — The node's 15-minute load metric - `load1m` number — The node's 1-minute load metric - `load5m` number — The node's 5-minute load metric - `memoryTotalGB` number — Total size, in gigabytes, of the system memory, or RAM - `memoryUsedPct` number — Percentage usage of the system memory, or RAM - `metricsEnabled` boolean — Indicates whether the metric subsytem is available - `mgmtMac` string — The MAC address assigned to this node's management NIC - `model` string — The Seurity Onion appliance model, or N/A if this is not an official Security Onion appliance - `nonCriticalNode` boolean — Indicates whether this node is a non-critical node of the overall grid. An examples of a non-critical nodes is a desktop node - `onlineTime` string — The date and time when this node first came online; best estimate based on the node's apparent file system age - `osNeedsRestart` integer — Indicates whether the node needs to be restarted to apply kernel updates: 0 = no restart needed, 1 = needs restarted - `osUptimeSeconds` integer — The number of seconds that the operating system has been "up" since its last reboot - `pcapDays` number — The number of days of PCAP storage available to this node - `processJson` string — The status of each individual process on the node, in JSON format - `processStatus` string — The overall status of the node's Security Onion processes: unknown, ok, fault - `productionEps` integer — The events per second (EPS) produced by this node (not currently populated) - `raidStatus` string — The raid status, if applicable: unknown, ok, fault - `redisQueueSize` integer — The backlog of events waiting to be processed - `role` string — The node's assigned role; assigned during node setup - `status` string — The current state of the node: unknown, ok, fault, pending, restart - `stenoLossPct` number — The current percentage packet loss experienced by Stenographer, if applicable to this node - `suriLossPct` number — The current percentage packet loss experienced by Suricata, if applicable to this node - `suriRulesFailed` integer — The number of Suricata rules that failed to load, if applicable to this node - `suriRulesLoaded` integer — The number of Suricata rules currently loaded, if applicable to this node - `suriRulesReloadTime` string — The timestamp of the last Suricata rule reload, if applicable to this node - `suriRulesStatus` string — The status of Suricata rule loading: ok, unknown - `swapTotalGB` number — Total size, in gigabytes, of the system swap memory - `swapUsedPct` number — Percentage usage of the system swap memory - `trafficManInMbs` number — The inbound traffic rate, in megabytes per second, to this node's management network interface - `trafficManOutMbs` number — The outbound traffic rate, in megabytes per second, from this node's management network interface - `trafficMonInDropsMbs` number — The inbound traffic packet drop rate, in megabytes per second, to this node's monitor network interface - `trafficMonInMbs` number — The inbound traffic rate, in megabytes per second, to this node's monitor network interface - `updateTime` string — The date and time when this node was most recently updated" - `uptimeSeconds` integer — The number of seconds since this node first came online and joined the grid - `version` string — The version of Security Onion installed on this node - `zeekLossPct` number — The current percentage packet loss experienced by Zeek, if applicable to this node ## Other responses - `401` — Request was not properly authenticated - `403` — Insufficient permissions for this request - `500` — Internal SOC error; review SOC logs --- [API](https://skmtc.net/security-onion-solutions/apis/security-onion-connect-api.md) · [All operations](https://skmtc.net/security-onion-solutions/apis/security-onion-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/security-onion-solutions/security-onion-connect-api/versions/0576ce393f8d/schema)