> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/python-development-quick-start-guide/cortex-xsoar-python-development-quick-start-guide/development-tools-and-resources/cortex-xsoar-automation-scripts/query-the-audit-trail.md).

# Query the Audit Trail

During the incident investigation, you may need retrieve the audit trail.

In this example, the Cortex XSOAR REST API queries for the audit trail since that data is not available in the incident context.  You can view the audit trail in the Cortex XSOAR console under **Settings** → **Advanced** → **Audit Trail**.

{% hint style="info" %}

### Note

For list options, no spaces are allowed.
{% endhint %}

1. Create an automation and use the **Settings** button to add the mandatory argument **timeframe**. This argument specifies the number of hours prior to the present time to query for audit trail entries.
2. Use the basic automation template to create the following code.

   The parameter to the REST API is a dictionary with two keys: **`uri`** is the Cortex XSOAR endpoint for the API and **`body`** is a sub-dictionary with additional parameters for the API, in this case **`size`** and **`query`**.

   Once the API parameters are created, the **`demisto.executeCommand()`** function is used to invoke the API with the **`demisto-api-post`** command.

   The results of the query are displayed in the War Room using the **`return_results()`** function.

   ```programlisting
   def main():
       try:
           timeframe   = demisto.args()['timeframe']
           timefrom    = datetime.now() - 
               timedelta(hours=int(timeframe))
           timestring  = timefrom.strftime("%Y-%m-%dT%H:%M:%S")
           parameters  = {
               'uri': "/settings/audits",
               'body': {
                   'size': 1000, 
                   'query': f"modified:>{timestring}"
               }
           }
           results = demisto.executeCommand('demisto-api-post', 
               parameters
           )
           return_results(results[0]['Contents']['response'])
       except Exception as ex:
           demisto.error(traceback.format_exc())
           return_error("Failed querying the audit trail: " +
               str(ex)
           )

   if __name__ in ("__main__", "__builtin__", "builtins"):
       main()
   ```
3. Save the completed automation and run it in the War Room of an open incident or the Playground to test it.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/python-development-quick-start-guide/cortex-xsoar-python-development-quick-start-guide/development-tools-and-resources/cortex-xsoar-automation-scripts/query-the-audit-trail.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.