Audit Log

APIs for audit logs

Get Audit Management Log

post

Get audit management logs. - Response is concatenated using AND condition (OR is not supported). - Maximum result set size is 100. - Offset is the zero-based number of incidents from the start of the result set.

Header parameters

authorizationstringRequired

api-key

Example: {{api_key}}

x-xdr-auth-idstringRequired

api-key-id

Example: {{api_key_id}}

Body

Other propertiesanyOptional

Responses

200

Successful response

application/json

Other propertiesanyOptional

400

Bad Request. Got an invalid JSON.

application/json

401

Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.

application/json

402

Unauthorized access. User does not have the required license type to run this API.

application/json

403

Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.

application/json

422

Unprocessable Entity

application/json

500

Internal server error. A unified status for API communication type errors.

application/json

post/public_api/v1/audits/management_logs/

POST /public_api/v1/audits/management_logs/ HTTP/1.1
Host: api-{{fqdn}}
authorization: {{api_key}}
x-xdr-auth-id: {{api_key_id}}
Content-Type: application/json
Accept: */*
Content-Length: 263

{
  "request_data": {
    "filters": [
      {
        "field": "email",
        "operator": "in",
        "value": 1,
        "ANY_ADDITIONAL_PROPERTY": "anything"
      }
    ],
    "search_from": 0,
    "search_to": 100,
    "sort": {
      "field": "timestamp",
      "keyword": "desc",
      "ANY_ADDITIONAL_PROPERTY": "anything"
    }
  },
  "ANY_ADDITIONAL_PROPERTY": "anything"
}

{
  "reply": {
    "total_count": 1,
    "result_count": 1,
    "data": [
      {
        "AUDIT_ID": 1,
        "AUDIT_OWNER_NAME": "text",
        "AUDIT_OWNER_EMAIL": "text",
        "AUDIT_ASSET_JSON": {},
        "AUDIT_ASSET_NAMES": "text",
        "AUDIT_HOSTNAME": "text",
        "AUDIT_RESULT": "text",
        "AUDIT_REASON": "text",
        "AUDIT_DESCRIPTION": "text",
        "AUDIT_ENTITY": "LIVE_TERMINAL",
        "AUDIT_ENTITY_SUBTYPE": "text",
        "AUDIT_SESSION_ID": "text",
        "AUDIT_CASE_ID": "text",
        "AUDIT_INSERT_TIME": 1,
        "AUDIT_SEVERITY": "text",
        "AUDIT_LINK": "text",
        "AUDIT_SOURCE_IP": "text",
        "AUDIT_USER_AGENT": "text",
        "AUDIT_USER_ROLES": [
          "text"
        ],
        "ANY_ADDITIONAL_PROPERTY": "anything"
      }
    ],
    "ANY_ADDITIONAL_PROPERTY": "anything"
  },
  "ANY_ADDITIONAL_PROPERTY": "anything"
}