Audit Commands
Audit Commands
getAuditAgentReports
Gets agent event reports. Supports filtering by multiple fields, which are combined using an AND condition (OR is not supported). When no endpoint ID, endpoint name, type, sub-type, result, or timestamp filter is provided, the command returns the most recent agent audit reports for the tenant (up to the limit, default 30).
Arguments
endpoint_ids
A comma-separated list of endpoint IDs.
Optional
endpoint_names
A comma-separated list of endpoint names.
Optional
types
The report type. Possible values are: Installation, Policy, Action, Agent Service, Agent Modules, Agent Status.
Optional
sub_types
The report subtype. Possible values are: Install, Uninstall, Upgrade, Local Configuration, Content Update, Policy Update, Process Exception, Hash Exception, Scan, File Retrieval, File Scan, Terminate Process, Isolate, Cancel Isolation, Payload Execution, Quarantine, Restore, Stop, Start, Module Initialization, Local Analysis Model, Local Analysis Feature Extraction, Fully Protected, OS Incompatible, Software Incompatible, Kernel Driver Initialization, Kernel Extension Initialization, Proxy Communication, Quota Exceeded, Minimal Content, Reboot Required, Missing Disc Access.
Optional
results
The result type. Possible values are: Success, Fail.
Optional
timestamp_gte
Returns agent reports whose timestamp is greater than or equal to this value. Supports milliseconds (e.g. 1579039377301), relative time (e.g. "3 days"), or ISO date (e.g. "2019-10-21T23:45:00").
Optional
timestamp_lte
Returns agent reports whose timestamp is less than or equal to this value. Supports milliseconds (e.g. 1579039377301), relative time (e.g. "3 days"), or ISO date (e.g. "2019-10-21T23:45:00").
Optional
page
Page number (for pagination). The default is 0 (the first page). Default is 0.
Optional
limit
The maximum number of reports to return. Default is 30.
Optional
sort_by
The field by which to sort results. Defaults to "timestamp" on the server side if not provided. Possible values are: type, category, trapsversion, timestamp, domain.
Optional
sort_order
The sort order. Defaults to "desc" on the server side if not provided. Possible values are: asc, desc.
Optional
Outputs
Core.AuditAgentReports.ENDPOINTID string
Endpoint ID.
Core.AuditAgentReports.ENDPOINTNAME string
Endpoint name.
Core.AuditAgentReports.DOMAIN string
Agent domain.
Core.AuditAgentReports.TRAPSVERSION string
Traps version.
Core.AuditAgentReports.RECEIVEDTIME number
Received time in Epoch time.
Core.AuditAgentReports.TIMESTAMP number
Timestamp in Epoch time.
Core.AuditAgentReports.CATEGORY string
Report category (e.g., Audit).
Core.AuditAgentReports.TYPE string
Report type (e.g., Action, Policy).
Core.AuditAgentReports.SUBTYPE string
Report subtype (e.g., Fully Protected, Policy Update, Cancel Isolation).
Core.AuditAgentReports.RESULT string
Report result.
Core.AuditAgentReports.REASON string
Report reason.
Core.AuditAgentReports.DESCRIPTION string
Agent report description.
Endpoint.ID string
The endpoint ID.
Endpoint.Hostname string
The hostname of the endpoint.
Endpoint.Domain string
The domain of the endpoint.
getAuditManagementLogs
Gets audit management logs. Multiple field filters are combined with AND (OR is not supported). With no filters, returns the most recent entries (default 30), sorted by timestamp descending.
Arguments
emails
A comma-separated list of user email addresses.
Optional
types
A comma-separated list of audit log types. Possible values are: REMOTE_TERMINAL, RULES, AUTH, RESPONSE, INCIDENT_MANAGEMENT, ENDPOINT_MANAGEMENT, ALERT_WHITELIST, PUBLIC_API, DISTRIBUTIONS, STARRED_INCIDENTS, POLICY_PROFILES, DEVICE_CONTROL_PROFILE, HOST_FIREWALL_PROFILE, POLICY_RULES, PROTECTION_POLICY, DEVICE_CONTROL_TEMP_EXCEPTIONS, DEVICE_CONTROL_GLOBAL_EXCEPTIONS, GLOBAL_EXCEPTIONS, MSSP, REPORTING, DASHBOARD, BROKER_VM.
Optional
sub_types
A comma-separated list of audit log subtypes.
Optional
results
A comma-separated list of result types. Possible values are: SUCCESS, FAIL, PARTIAL.
Optional
timestamp_gte
Returns logs whose timestamp is greater than or equal to this value. Supports milliseconds (e.g. 1579039377301), relative time (e.g. "3 days"), or ISO date (e.g. "2019-10-21T23:45:00").
Optional
timestamp_lte
Returns logs whose timestamp is less than or equal to this value. Supports milliseconds (e.g. 1579039377301), relative time (e.g. "3 days"), or ISO date (e.g. "2019-10-21T23:45:00").
Optional
page
Page number (for pagination). Default is 0.
Optional
limit
Maximum number of audit logs to return per page. Default is 30.
Optional
sort_by
Specifies the field by which to sort the results. Can be "type", "sub_type", "result", or "timestamp". Defaults to "timestamp" on the server side if not provided. The server's secondary sort field is "audit_id". Possible values are: type, sub_type, result, timestamp.
Optional
sort_order
The sort order. Can be "asc" (ascending) or "desc" (descending). Defaults to "desc" on the server side if not provided. Possible values are: asc, desc.
Optional
Outputs
Core.AuditManagementLogs.AUDIT_ID number
The unique identifier of the audit log entry.
Core.AuditManagementLogs.AUDIT_OWNER_NAME string
The name of the audit log owner.
Core.AuditManagementLogs.AUDIT_OWNER_EMAIL string
The email address of the audit log owner.
Core.AuditManagementLogs.AUDIT_ASSET_JSON string
The asset JSON data associated with the audit log.
Core.AuditManagementLogs.AUDIT_ASSET_NAMES string
The asset names associated with the audit log.
Core.AuditManagementLogs.AUDIT_HOSTNAME string
The hostname associated with the audit log.
Core.AuditManagementLogs.AUDIT_RESULT string
The result of the audit action.
Core.AuditManagementLogs.AUDIT_REASON string
The reason for the audit action.
Core.AuditManagementLogs.AUDIT_DESCRIPTION string
The description of the audit action.
Core.AuditManagementLogs.AUDIT_ENTITY string
The entity type of the audit log.
Core.AuditManagementLogs.AUDIT_ENTITY_SUBTYPE string
The entity subtype of the audit log.
Core.AuditManagementLogs.AUDIT_CASE_ID number
The case ID associated with the audit log.
Core.AuditManagementLogs.AUDIT_INSERT_TIME number
The timestamp when the audit log was inserted.
Last updated
Was this helpful?