Audit Log

APIs for audit logs

Get Audit Management Log

post

Get audit management logs.

• Response is concatenated using AND condition (OR is not supported).
• Maximum result set size is 100.
• Offset is the zero-based number of cases from the start of the result set.

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

Header parameters

AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Body

Responses

200

Successful response

application/json

400

Bad Request. Got an invalid JSON.

application/json

401

Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.

application/json

402

Unauthorized access. User does not have the required license type to run this API.

application/json

403

Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.

application/json

500

Internal server error. A unified status for API communication type errors.

post/public_api/v1/audits/management_logs

POST /public_api/v1/audits/management_logs HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 95

{
  "request_data": {
    "search_from": 0,
    "search_to": 100,
    "sort": {
      "field": "timestamp",
      "keyword": "asc"
    }
  }
}

{
  "reply": {
    "total_count": 1,
    "result_count": 1,
    "data": [
      {
        "AUDIT_ID": 1,
        "AUDIT_OWNER_NAME": "User Name",
        "AUDIT_OWNER_EMAIL": "[e-mail]",
        "AUDIT_ASSET_JSON": "{}",
        "AUDIT_ASSET_NAMES": "",
        "AUDIT_HOSTNAME": "",
        "AUDIT_RESULT": "SUCCESS",
        "AUDIT_REASON": "",
        "AUDIT_DESCRIPTION": "",
        "AUDIT_ENTITY": "AUTH",
        "AUDIT_ENTITY_SUBTYPE": "Login",
        "AUDIT_SESSION_ID": 382303947890,
        "AUDIT_CASE_ID": 473829372,
        "AUDIT_INSERT_TIME": 1565074114053,
        "AUDIT_SEVERITY": "SEV_020_LOW",
        "AUDIT_LINK": null,
        "AUDIT_SOURCE_IP": "31.174.156.148",
        "AUDIT_USER_AGENT": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36",
        "AUDIT_USER_ROLES": [
          "Account Admin"
        ],
        "AUDIT_ADDITIONAL_INFORMATION": {
          "endpoint_names": [
            "WIN-fgo6762G"
          ],
          "endpoint_count": 1
        },
        "AUDIT_OBJECT_ID": null
      }
    ]
  }
}

Get Audit Agent Report

post

Get agent event reports.

• Response is concatenated using AND condition (OR is not supported).
• Maximum result set size is 100.
• Offset is the zero-based number of cases from the start of the result set.

Header parameters

AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Body

Responses

200

OK

application/json

400

Bad Request. Got an invalid JSON.

application/json

401

Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, ID, or other invalid authentication parameters.

application/json

402

Unauthorized access. User does not have the required license type to run this API.

application/json

403

Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.

application/json

500

Internal server error. A unified status for API communication type errors.

application/json

post/public_api/v1/audits/agents_reports

POST /public_api/v1/audits/agents_reports HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 19

{
  "request_data": {}
}

{
  "reply": {
    "total_count": 1,
    "result_count": 1,
    "data": [
      {
        "TIMESTAMP": 1,
        "RECEIVEDTIME": 1,
        "ENDPOINTID": "text",
        "ENDPOINTNAME": "text",
        "DOMAIN": "text",
        "TRAPSVERSION": "text",
        "CATEGORY": "text",
        "TYPE": "text",
        "SUBTYPE": "text",
        "RESULT": "text",
        "REASON": "text",
        "DESCRIPTION": "text"
      }
    ]
  }
}