> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/audit-commands.md).
# Audit Commands
## Audit Commands
* [getAuditAgentReports](#getauditagentreports)
* [getAuditManagementLogs](#getauditmanagementlogs)
#### getAuditAgentReports
***
Gets agent event reports. Supports filtering by multiple fields, which are combined using an AND condition (OR is not supported). When no endpoint ID, endpoint name, type, sub-type, result, or timestamp filter is provided, the command returns the most recent agent audit reports for the tenant (up to the limit, default 30).
Arguments
| Argument Name | Description | Required |
| --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| endpoint\_ids | A comma-separated list of endpoint IDs. | Optional |
| endpoint\_names | A comma-separated list of endpoint names. | Optional |
| types | The report type. Possible values are: Installation, Policy, Action, Agent Service, Agent Modules, Agent Status. | Optional |
| sub\_types | The report subtype. Possible values are: Install, Uninstall, Upgrade, Local Configuration, Content Update, Policy Update, Process Exception, Hash Exception, Scan, File Retrieval, File Scan, Terminate Process, Isolate, Cancel Isolation, Payload Execution, Quarantine, Restore, Stop, Start, Module Initialization, Local Analysis Model, Local Analysis Feature Extraction, Fully Protected, OS Incompatible, Software Incompatible, Kernel Driver Initialization, Kernel Extension Initialization, Proxy Communication, Quota Exceeded, Minimal Content, Reboot Required, Missing Disc Access. | Optional |
| results | The result type. Possible values are: Success, Fail. | Optional |
| timestamp\_gte | Returns agent reports whose timestamp is greater than or equal to this value. Supports milliseconds (e.g. 1579039377301), relative time (e.g. "3 days"), or ISO date (e.g. "2019-10-21T23:45:00"). | Optional |
| timestamp\_lte | Returns agent reports whose timestamp is less than or equal to this value. Supports milliseconds (e.g. 1579039377301), relative time (e.g. "3 days"), or ISO date (e.g. "2019-10-21T23:45:00"). | Optional |
| page | Page number (for pagination). The default is 0 (the first page). Default is 0. | Optional |
| limit | The maximum number of reports to return. Default is 30. | Optional |
| sort\_by | The field by which to sort results. Defaults to "timestamp" on the server side if not provided. Possible values are: type, category, trapsversion, timestamp, domain. | Optional |
| sort\_order | The sort order. Defaults to "desc" on the server side if not provided. Possible values are: asc, desc. | Optional |
Outputs
**Core.AuditAgentReports.ENDPOINTID** *string*
Endpoint ID.
**Core.AuditAgentReports.ENDPOINTNAME** *string*
Endpoint name.
**Core.AuditAgentReports.DOMAIN** *string*
Agent domain.
**Core.AuditAgentReports.TRAPSVERSION** *string*
Traps version.
**Core.AuditAgentReports.RECEIVEDTIME** *number*
Received time in Epoch time.
**Core.AuditAgentReports.TIMESTAMP** *number*
Timestamp in Epoch time.
**Core.AuditAgentReports.CATEGORY** *string*
Report category (e.g., Audit).
**Core.AuditAgentReports.TYPE** *string*
Report type (e.g., Action, Policy).
**Core.AuditAgentReports.SUBTYPE** *string*
Report subtype (e.g., Fully Protected, Policy Update, Cancel Isolation).
**Core.AuditAgentReports.RESULT** *string*
Report result.
**Core.AuditAgentReports.REASON** *string*
Report reason.
**Core.AuditAgentReports.DESCRIPTION** *string*
Agent report description.
**Endpoint.ID** *string*
The endpoint ID.
**Endpoint.Hostname** *string*
The hostname of the endpoint.
**Endpoint.Domain** *string*
The domain of the endpoint.
#### getAuditManagementLogs
***
Gets audit management logs. Multiple field filters are combined with AND (OR is not supported). With no filters, returns the most recent entries (default 30), sorted by timestamp descending.
Arguments
| Argument Name | Description | Required |
| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------- |
| emails | A comma-separated list of user email addresses. | Optional |
| types | A comma-separated list of audit log types. Possible values are: REMOTE\_TERMINAL, RULES, AUTH, RESPONSE, INCIDENT\_MANAGEMENT, ENDPOINT\_MANAGEMENT, ALERT\_WHITELIST, PUBLIC\_API, DISTRIBUTIONS, STARRED\_INCIDENTS, POLICY\_PROFILES, DEVICE\_CONTROL\_PROFILE, HOST\_FIREWALL\_PROFILE, POLICY\_RULES, PROTECTION\_POLICY, DEVICE\_CONTROL\_TEMP\_EXCEPTIONS, DEVICE\_CONTROL\_GLOBAL\_EXCEPTIONS, GLOBAL\_EXCEPTIONS, MSSP, REPORTING, DASHBOARD, BROKER\_VM. | Optional |
| sub\_types | A comma-separated list of audit log subtypes. | Optional |
| results | A comma-separated list of result types. Possible values are: SUCCESS, FAIL, PARTIAL. | Optional |
| timestamp\_gte | Returns logs whose timestamp is greater than or equal to this value. Supports milliseconds (e.g. 1579039377301), relative time (e.g. "3 days"), or ISO date (e.g. "2019-10-21T23:45:00"). | Optional |
| timestamp\_lte | Returns logs whose timestamp is less than or equal to this value. Supports milliseconds (e.g. 1579039377301), relative time (e.g. "3 days"), or ISO date (e.g. "2019-10-21T23:45:00"). | Optional |
| page | Page number (for pagination). Default is 0. | Optional |
| limit | Maximum number of audit logs to return per page. Default is 30. | Optional |
| sort\_by | Specifies the field by which to sort the results. Can be "type", "sub\_type", "result", or "timestamp". Defaults to "timestamp" on the server side if not provided. The server's secondary sort field is "audit\_id". Possible values are: type, sub\_type, result, timestamp. | Optional |
| sort\_order | The sort order. Can be "asc" (ascending) or "desc" (descending). Defaults to "desc" on the server side if not provided. Possible values are: asc, desc. | Optional |
Outputs
**Core.AuditManagementLogs.AUDIT\_ID** *number*
The unique identifier of the audit log entry.
**Core.AuditManagementLogs.AUDIT\_OWNER\_NAME** *string*
The name of the audit log owner.
**Core.AuditManagementLogs.AUDIT\_OWNER\_EMAIL** *string*
The email address of the audit log owner.
**Core.AuditManagementLogs.AUDIT\_ASSET\_JSON** *string*
The asset JSON data associated with the audit log.
**Core.AuditManagementLogs.AUDIT\_ASSET\_NAMES** *string*
The asset names associated with the audit log.
**Core.AuditManagementLogs.AUDIT\_HOSTNAME** *string*
The hostname associated with the audit log.
**Core.AuditManagementLogs.AUDIT\_RESULT** *string*
The result of the audit action.
**Core.AuditManagementLogs.AUDIT\_REASON** *string*
The reason for the audit action.
**Core.AuditManagementLogs.AUDIT\_DESCRIPTION** *string*
The description of the audit action.
**Core.AuditManagementLogs.AUDIT\_ENTITY** *string*
The entity type of the audit log.
**Core.AuditManagementLogs.AUDIT\_ENTITY\_SUBTYPE** *string*
The entity subtype of the audit log.
**Core.AuditManagementLogs.AUDIT\_CASE\_ID** *number*
The case ID associated with the audit log.
**Core.AuditManagementLogs.AUDIT\_INSERT\_TIME** *number*
The timestamp when the audit log was inserted.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/audit-commands.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.