--- title: "Node Check-in" method: POST path: "/connect/node" tags: ["Grid"] --- # Node Check-in `POST /connect/node` Used by Security Onion agent nodes to check-in with their current metrics and request any pending jobs assigned to it. It is not recommended to make calls to this API endpoint, as this is intended to be used exclusively by official Security Onion nodes only. ## Request body - ModelNode - `address` string — The IP address of this node - `captureLossPct` number — The current percentage capture loss experienced by the network, if applicable to this node - `connectionStatus` string — The connectivity status between this node and the manager node: unknown, ok, fault - `consumptionEps` integer — The events per second (EPS) consumed by this node - `cpuUsedPct` number — The current CPU usage of the node, across all cores - `description` string — The node's optional description - `diskTotalNsmGB` number — Total size, in gigabytes, of the NSM data disk/partition - `diskTotalRootGB` number — Total size, in gigabytes, of the root operating system disk/partition - `diskUsedElasticGB` number — The disk space used, in gigabytes, on the backend data store system (Elasticsearch) - `diskUsedInfluxDbGB` number — The disk space used, in gigabytes, on the metrics data store system (InfluxDB) - `diskUsedNsmPct` number — Percentage usage of the NSM data disk/partition - `diskUsedRootPct` number — Percentage usage of the root system disk/partition - `epochTime` string — The node's data epoch; this is the date and time of the oldest known PCAP data available to the node - `eventstoreStatus` string — The event storage status; this refers to the backend status, such as Elasticsearch: unknown, ok, fault - `failedEvents` integer — The count of failed events (currently not in use)" - `fpsEnabled` integer — Indicates whether federal information processing standards are enabled on this node - `gmdEnabled` integer — Indicates whether guaranteed message delivery is enabled on this node - `gridId` string — Grid ID, used for subgrids - `highstateAgeSeconds` integer — How long ago, in seconds, the last highstate completed on this node - `id` string — The node ID - `imageBack` string — The Security Onion appliance back image, if available - `imageFront` string — The Security Onion appliance front image, if available - `ioWaitPct` number — The IO wait percentage for this node - `lksEnabled` integer — Indicates whether disk encryption is enabled on this node - `load15m` number — The node's 15-minute load metric - `load1m` number — The node's 1-minute load metric - `load5m` number — The node's 5-minute load metric - `memoryTotalGB` number — Total size, in gigabytes, of the system memory, or RAM - `memoryUsedPct` number — Percentage usage of the system memory, or RAM - `metricsEnabled` boolean — Indicates whether the metric subsytem is available - `mgmtMac` string — The MAC address assigned to this node's management NIC - `model` string — The Seurity Onion appliance model, or N/A if this is not an official Security Onion appliance - `nonCriticalNode` boolean — Indicates whether this node is a non-critical node of the overall grid. An examples of a non-critical nodes is a desktop node - `onlineTime` string — The date and time when this node first came online; best estimate based on the node's apparent file system age - `osNeedsRestart` integer — Indicates whether the node needs to be restarted to apply kernel updates: 0 = no restart needed, 1 = needs restarted - `osUptimeSeconds` integer — The number of seconds that the operating system has been "up" since its last reboot - `pcapDays` number — The number of days of PCAP storage available to this node - `processJson` string — The status of each individual process on the node, in JSON format - `processStatus` string — The overall status of the node's Security Onion processes: unknown, ok, fault - `productionEps` integer — The events per second (EPS) produced by this node (not currently populated) - `raidStatus` string — The raid status, if applicable: unknown, ok, fault - `redisQueueSize` integer — The backlog of events waiting to be processed - `role` string — The node's assigned role; assigned during node setup - `status` string — The current state of the node: unknown, ok, fault, pending, restart - `stenoLossPct` number — The current percentage packet loss experienced by Stenographer, if applicable to this node - `suriLossPct` number — The current percentage packet loss experienced by Suricata, if applicable to this node - `suriRulesFailed` integer — The number of Suricata rules that failed to load, if applicable to this node - `suriRulesLoaded` integer — The number of Suricata rules currently loaded, if applicable to this node - `suriRulesReloadTime` string — The timestamp of the last Suricata rule reload, if applicable to this node - `suriRulesStatus` string — The status of Suricata rule loading: ok, unknown - `swapTotalGB` number — Total size, in gigabytes, of the system swap memory - `swapUsedPct` number — Percentage usage of the system swap memory - `trafficManInMbs` number — The inbound traffic rate, in megabytes per second, to this node's management network interface - `trafficManOutMbs` number — The outbound traffic rate, in megabytes per second, from this node's management network interface - `trafficMonInDropsMbs` number — The inbound traffic packet drop rate, in megabytes per second, to this node's monitor network interface - `trafficMonInMbs` number — The inbound traffic rate, in megabytes per second, to this node's monitor network interface - `updateTime` string — The date and time when this node was most recently updated" - `uptimeSeconds` integer — The number of seconds since this node first came online and joined the grid - `version` string — The version of Security Onion installed on this node - `zeekLossPct` number — The current percentage packet loss experienced by Zeek, if applicable to this node ## Response `200` The array of assigned, pending jobs that this node is responsible for processing, if any - ModelJob[] - `completeTime` string — The date and time when the job was completed - `createTime` string — The date and time when the job was created - `failCount` integer — The number of times the job was processed but failed - `failTime` string — The date and time when the job last failed and was marked incomplete - `failure` string — The failure reason - `fileExtension` string — The file extension for any attached job result/output data - `filter` ModelFilter — Optional filter for the job, typically used for packet filtering - `beginTime` string — The begin time for the packet filtering; only packets with timestamps between the BeginTime and EndTime will be included in this filter - `dstIp` string — The destintion IP to capture; Note that the PCAP job will allow destination and source data to be interchanged to ensure packets are not missed in certain capture scenarios" - `dstPort` integer — The destination port to capture; Note that the PCAP job will allow destination and source data to be interchanged to ensure packets are not missed in certain capture scenarios" - `endTime` string — The end time for the packet filtering; only packets with timestamps between the BeginTime and EndTime will be included in this filter - `importId` string — An optional import ID to use for locating related import packets - `parameters` object — Additional, untyped filter parameters; used by non-PCAP job processors - `protocol` string — Require the captured packets to be using this protocol" - `srcIp` string — The source IP to capture; Note that the PCAP job will allow destination and source data to be interchanged to ensure packets are not missed in certain capture scenarios" - `srcPort` integer — The source port to capture; Note that the PCAP job will allow destination and source data to be interchanged to ensure packets are not missed in certain capture scenarios" - `id` integer — The unique Job ID - `kind` string — The kind of job that this object represents; blank values represent pcap jobs - `nodeId` string — The unique node ID that is responsible for completing this job - `owner` string — Owner field [not actively used by the API] - `results` ModelJobResult[] — The array of job results; will be empty for jobs that only attach output streams - `data` unknown - `id` string — The ID or name of the result; varies depending on the job processor - `summary` string — Brief summarization of the job result - `sensorId` string — Legacy sensor ID field - `size` integer — The size of the job stream output, if a stream output was attached - `status` integer — The current state of the job. 0 = pending, 1 = complete, 2 = incomplete, 3 = deleted - `userId` string — The unique user ID that created this job ## Other responses - `400` — The provided input object or parameters are malformed or invalid - `401` — Request was not properly authenticated - `500` — Internal SOC error; review SOC logs --- [API](https://skmtc.net/security-onion-solutions/apis/security-onion-connect-api.md) · [All operations](https://skmtc.net/security-onion-solutions/apis/security-onion-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/security-onion-solutions/security-onion-connect-api/versions/0576ce393f8d/schema)