Get Audit Management Log
Retrieve management logs.
Synopsis
URI | /public_api/v1/audits/management_logs/ |
HTTP Method | POST |
Required License | Cortex XDR Prevent, Cortex XDR Pro per Endpoint,
or Cortex XDR Pro per TB |
Description
Get audit management logs.
- Response is concatenated usingANDcondition (OR is not supported).
- Maximum result set size is 100.
- Offsetis the zero-based number of incidents from the start of the result set.
Request Fields
The body of this request
contains a JSON object with the following fields:
You can
send a request to retrieve either
all
or filtered
results. Field | Description |
---|---|
request_data | ( Required ) A dictionary containing
the API request fields.An empty dictionary returns all results. |
filters | Provides an array of filtered fields. Each
JSON object can contain the following keywords:
|
search_from | An integer representing the starting offset
within the query result set from which you want management logs returned. Management
logs are returned as a zero-based list. Any log indexed less than
this value is not returned in the final result set and defaults
to zero. |
search_to | An integer representing the end offset within
the result set after which you do not want management logs returned. Logs
in the management log list that are indexed higher than this value
are not returned in the final results set. Defaults to 100, which
returns all logs to the end of the list. |
sort | Identifies the sort order for the result set.
By default the sort is defined as creation-time and desc .
|
Request Example
Request all results:
curl -X POST https://api-{fqdn}/public_api/v1/audits/management_logs/ \ -H "x-xdr-auth-id:{API_KEY_ID}" \ -H "Authorization:{API_KEY}" \ -H "Content-Type:application/json" \ -d '{ "request_data":{} }'
Request filtered results:
curl -X POST https://api-{fqdn}/public_api/v1/audits/management_logs/ \ -H "x-xdr-auth-id:{API_KEY_ID}" \ -H "Authorization:{API_KEY}" \ -H "Content-Type:application/json" \ -d '{ "request_data":{ "filters":[ { "field":"timestamp", "operator":"gte", "value":0 } ], "sort":{ "field":"timestamp", "keyword":"asc" }'
Success Response
Upon success,
the HTTP response code is 200. In addition, this API returns a JSON
object containing the query status, as well as an array of JSON
objects, each of which represents a single management log.
Field | Description |
---|---|
reply | JSON object containing the query result. |
total_count | Number of total results of this filter without
paging. |
result_count | Number of returned items (integer). |
endpoints | List of audit items:
|
Success Response Example
{ "reply":{ "total_count":1, "result_count":1, "data":[ { "AUDIT_ID":1, "AUDIT_OWNER_NAME":"User Name", "AUDIT_OWNER_EMAIL":"username@paloaltonetworks.com", "AUDIT_ASSET_JSON":"{}", "AUDIT_ASSET_NAMES":"", "AUDIT_HOSTNAME":null, "AUDIT_RESULT":"SUCCESS", "AUDIT_REASON":null, "AUDIT_DESCRIPTION":null, "AUDIT_ENTITY":"AUTH", "AUDIT_ENTITY_SUBTYPE":"Login", "AUDIT_SESSION_ID":null, "AUDIT_CASE_ID":null, "AUDIT_INSERT_TIME":1565074114053 } ] } }
Error Response
Upon error,
the reply includes an HTTP response code, an error message, and
additional information describing the error. The HTTP response code
is one of the following:
Field | Description |
---|---|
400 | Bad Request. Got an invalid JSON. |
401 | Unauthorized access. An issue occurred during authentication.
This can indicate an incorrect key, id, or other invalid authentication
parameters. |
402 | Unauthorized access. User does not have the
required license type to run this API. |
403 | Forbidden access. The provided API Key does
not have the required RBAC permissions to run this API. |
500 | Internal server error. A unified status for
API communication type errors. |
Error Response Format
{"reply": {"err_code": STATUS_CODE, "err_msg": GENERAL_MESSAGE, "err_extra": EXTRA_DATA}}
Recommended For You
Recommended Videos
Recommended videos not found.