5. REST APIs

BuffaLogs REST APIs

Five views were implemented using DRF - Django-Rest Framework, in order to provide the possible to query the charts data. In particular, the supplied APIs are:

API's name	API result
users_pie_chart_api	It returns the association between the risk level and the number of users with that risk score
alerts_line_chart_api
world_map_chart_api
alerts_api	It returns
risk_score_api	It provides the association between user and risk level for the users whose risk changed in the requested timeframe

Users pie chart API

API's name: users_pie_chart_api

Input: start and end datetime captured in the URL: users_pie_chart_api/start=...&end=...

Output: a JSON with user risk as keys and user count as value Example:

{   "No risk": 32
    "Low": 2
    "Medium": 86
    "High": 4
}

Alerts line chart API

API's name: alerts_line_chart_api

Input: start and end datetime captured in the URL: alerts_line_chart_api/start=...&end=...

Output: A dictionary containing a list of datetime and a value representing the amount of data for that datetime.

The data is formatted differently based on start and end time duration. There are three types of formats:

• hour
• day
• month

Alerts line chart API - HOUR example

Request using start=2023-06-15T14:00:00Z and end=2023-06-15T16:00:00Z

{
 "Timeframe": "hour",
 "2023-06-15T14:00:00Z": 23,
 "2023-06-15T15:00:00Z": 43,
}

The first value represents the number of alerts triggered between 14:00:00Z and 15:00:00Z. the second represents the number of alerts triggered between 15:00:00Z and 16:00:00Z.

Alerts line chart API - DAY example

Request using start=2023-06-15T00:00:00Z and end=2023-06-16T23:59:59Z

{
 "Timeframe": "day"
 "2023-06-15T": 434,
 "2023-06-16T": 23
}

Alerts line chart API - MONTH example

Request using start=2023-05-01T00:00:00Z and end=2023-06-31:23:59:59Z

{
 "Timeframe": "month"
 "2023-06": 4344,
 "2023-05": 2332
}

World map chart API

Input: start and end datetime captured in the URL: world_map_chart_api/start=...&end=...

Output: a JSON with the list of all countries (saved in the impossible_travel/dashboard/countries.json file) and the number of alerts triggered in that place.

Example:

{
 "ad": 0,
 "ae": 0,
 [ ... ]
 "sd":43,
 "it": 10
}

Alerts API

Input: start and end datetime captured in the URL: alerts_api/start=...&end=...

Output: a JSON with a list of dictionaries each of which contains the timestamp, username and rule of the alert triggered

Example:

[
	{
	 "timestamp": "2023-06-15T14:00:00Z",
	 "username": "Lorena Goldoni",
	 "rule_name": "Impossible travel detected"
	},
	{"timestamp": "2023-06-15T14:30:00Z",
	 "username": "Lorena Goldoni",
	 "rule_name": "Login from new country"
	}
]

Risk Score API

Input: start and end datetime captured in the URL: risk_score_api/start=...&end=...

Output: a JSON with usernames as keys and the relative risk score as value

Example:

{
	"Lorena Goldoni": "No risk",
	"Lory Goldoni": "High"
}