Cisco AMP for Endpoints API

GET /v1/audit_logs

Description

Provides audit logs based on the filters specified in the query parameters.

Query Parameters

Name	Type	Example Values
`audit_log_type`	String	User
`limit`	Integer	5
`audit_log_id`	GUID	e773a9eb-296c-40df-98d8-bed46322589d
`event`	String	login
`start_time`	String (Time ISO8601)	2015-10-01T00:00:00+00:00, 2018-10-01T00:00:00+00:00
`end_time`	String (Time ISO8601)	2015-10-01T00:00:00+00:00, 2018-10-01T00:00:00+00:00
`audit_log_user`	String	amp@cisco.com

Show Response Fields

Name	Type	Description
version	String
metadata.links.self	String
metadata.links.next	String
metadata.results.total	Integer
metadata.results.current_item_count	Integer
metadata.results.index	Integer
metadata.results.items_per_page	Integer
data	Array
data[].event	String
data[].audit_log_type	String
data[].audit_log_id	GUID
data[].audit_log_user	String
data[].created_at	String (Time ISO8601)
data[].old_attributes.sha	String
data[].new_attributes.sha

Write

Preview

Describe this action in markdown

Provides audit logs based on the filters specified in the query parameters.

### Query Parameters

|Name|Type|Example Values|Description|
|----|----|----|----|
|`audit_log_type`|String|User||
|`limit`|Integer|5||
|`audit_log_id`|GUID|e773a9eb-296c-40df-98d8-bed46322589d||
|`event`|String|login||
|`start_time`|String (Time ISO8601)|2015-10-01T00:00:00+00:00, 2018-10-01T00:00:00+00:00||
|`end_time`|String (Time ISO8601)|2015-10-01T00:00:00+00:00, 2018-10-01T00:00:00+00:00||
|`audit_log_user`|String|amp@cisco.com||
[Show Response Fields](response-fields)

|Name|Type|Description|
|---|---|---|
|version|String||
|metadata.links.self|String||
|metadata.links.next|String||
|metadata.results.total|Integer||
|metadata.results.current_item_count|Integer||
|metadata.results.index|Integer||
|metadata.results.items_per_page|Integer||
|data|Array||
|data[].event|String||
|data[].audit_log_type|String||
|data[].audit_log_id|GUID||
|data[].audit_log_user|String||
|data[].created_at|String (Time ISO8601)||
|data[].old_attributes.sha|String||
|data[].new_attributes.sha|||

Auto Generate

Examples

Fetch list of audit logs

Fetch list of audit logs filtered by audit_log_type

Fetch list of audit logs filtered by audit_log_id

Fetch list of audit logs filtered by event

Fetch list of audit logs filtered by start_time

Fetch list of audit logs filtered by end_time

Fetch list of audit logs filtered by audit_log_user

Fetch list of audit logs

Request

Requires Authorization

GET /v1/audit_logs

Headers

accept: application/json
content-type: application/json
accept-encoding: identity
authorization: Basic FILTERED

cURL Edit, then copy and paste on your terminal

curl -X GET \
-H 'accept: application/json' \
-H 'content-type: application/json' \
-H 'accept-encoding: identity' \
--compressed -H 'Accept-Encoding: gzip, deflate' \
-u YOUR_API_CLIENT_ID \
'https://api.amp.cisco.com/v1/audit_logs'

Response

Shortened for readability

content-type: application/json
transfer-encoding: chunked
status: 200 OK
x-ratelimit-limit: 3000
x-ratelimit-reset: 906
strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
x-ratelimit-remaining: 2883
x-permitted-cross-domain-policies: none
x-download-options: noopen
etag: W/"1431200eabf82ef831fab51758ea9b6e"
x-frame-options: SAMEORIGIN
x-ratelimit-resetdate: 2022-03-18T11:55:11Z

{
  "version": "v1.2.0",
  "metadata": {
    "links": {
      "self": "https://api.amp.cisco.com/v1/audit_logs",
      "next": "https://api.amp.cisco.com/v1/audit_logs?offset=500"
    },
    "results": {
      "total": 5598,
      "current_item_count": 500,
      "index": 0,
      "items_per_page": 500
    }
  },
  "data": [
    {
      "event": "create",
      "audit_log_type": "Agent",
      "audit_log_id": "538738f5-3a14-4449-933b-86142553de06",
      "audit_log_user": "16db5cf986eec6f44422",
      "created_at": "2022-03-18T11:40:03Z",
      "old_attributes": {
        "policy_id": null,
        "product_version_id": null
      },
      "new_attributes": {
        "policy_id": 915608,
        "product_version_id": 19606
      }
    },
    {
      "event": "create",
      "audit_log_type": "Computer",
      "audit_log_id": "16db5cf986eec6f44422",
      "audit_log_user": "16db5cf986eec6f44422",
      "created_at": "2022-03-18T11:40:03Z",
      "old_attributes": {
        "name": null,
        "desc": null,
        "hostname": null,
        "ip_external": null,
        "group_id": null,
        "operating_system_id": null
      },
      "new_attributes": {
        "name": "Demo_Upatre",
        "desc": "Computer populated with demo data",
        "hostname": "Demo_Upatre",
        "ip_external": "167.151.184.100",
        "group_id": 431790,
        "operating_system_id": 35743
      }
    }
  ]
}

Fetch list of audit logs filtered by audit_log_type

Request

Requires Authorization

GET /v1/audit_logs?audit_log_type=User&limit=5

Headers

accept: application/json
content-type: application/json
accept-encoding: identity
authorization: Basic FILTERED

cURL Edit, then copy and paste on your terminal

curl -X GET \
-H 'accept: application/json' \
-H 'content-type: application/json' \
-H 'accept-encoding: identity' \
--compressed -H 'Accept-Encoding: gzip, deflate' \
-u YOUR_API_CLIENT_ID \
'https://api.amp.cisco.com/v1/audit_logs?audit_log_type=User&limit=5'

Response

Shortened for readability

content-type: application/json
transfer-encoding: chunked
status: 200 OK
x-ratelimit-limit: 3000
x-ratelimit-reset: 906
strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
x-ratelimit-remaining: 2882
x-permitted-cross-domain-policies: none
x-download-options: noopen
etag: W/"697f92f4d2f3908df48ff1a6d8e663b8"
x-frame-options: SAMEORIGIN
x-ratelimit-resetdate: 2022-03-18T11:55:11Z

{
  "version": "v1.2.0",
  "metadata": {
    "links": {
      "self": "https://api.amp.cisco.com/v1/audit_logs?audit_log_type=User&limit=5",
      "next": "https://api.amp.cisco.com/v1/audit_logs?audit_log_type=User&limit=5&offset=5"
    },
    "results": {
      "total": 131,
      "current_item_count": 5,
      "index": 0,
      "items_per_page": 5
    }
  },
  "data": [
    {
      "event": "login",
      "audit_log_type": "User",
      "audit_log_id": "373031bf-6e67-40e5-9fc2-ffea680a2ebd",
      "audit_log_user": "kmarasin+qa1_apidocs@cisco.com",
      "created_at": "2022-02-23T20:43:09Z"
    },
    {
      "event": "login",
      "audit_log_type": "User",
      "audit_log_id": "385501d4-017e-477c-8af6-8d096f95545d",
      "audit_log_user": "marlin2+sdc_api_docs@cisco.com",
      "created_at": "2021-04-09T19:15:54Z"
    }
  ]
}

Fetch list of audit logs filtered by audit_log_id

Request

Requires Authorization

GET /v1/audit_logs?audit_log_id=e773a9eb-296c-40df-98d8-bed46322589d&limit=5

Headers

accept: application/json
content-type: application/json
accept-encoding: identity
authorization: Basic FILTERED

cURL Edit, then copy and paste on your terminal

curl -X GET \
-H 'accept: application/json' \
-H 'content-type: application/json' \
-H 'accept-encoding: identity' \
--compressed -H 'Accept-Encoding: gzip, deflate' \
-u YOUR_API_CLIENT_ID \
'https://api.amp.cisco.com/v1/audit_logs?audit_log_id=e773a9eb-296c-40df-98d8-bed46322589d&limit=5'

Response

Shortened for readability

content-type: application/json
transfer-encoding: chunked
status: 200 OK
x-ratelimit-limit: 3000
x-ratelimit-reset: 906
strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
x-ratelimit-remaining: 2881
x-permitted-cross-domain-policies: none
x-download-options: noopen
etag: W/"c01436d9049462caa8a01e5d8aeba4f4"
x-frame-options: SAMEORIGIN
x-ratelimit-resetdate: 2022-03-18T11:55:11Z

{
  "version": "v1.2.0",
  "metadata": {
    "links": {
      "self": "https://api.amp.cisco.com/v1/audit_logs?audit_log_id=e773a9eb-296c-40df-98d8-bed46322589d&limit=5",
      "next": "https://api.amp.cisco.com/v1/audit_logs?audit_log_id=e773a9eb-296c-40df-98d8-bed46322589d&limit=5&offset=5"
    },
    "results": {
      "total": 1170,
      "current_item_count": 5,
      "index": 0,
      "items_per_page": 5
    }
  },
  "data": [
    {
      "event": "update",
      "audit_log_type": "ApplicationBlockingList",
      "audit_log_id": "e773a9eb-296c-40df-98d8-bed46322589d",
      "audit_log_user": "16db5cf986eec6f44422",
      "created_at": "2022-03-18T10:55:36Z",
      "old_attributes": {
        "sha": "273d33fd0a8b205e4af47bbc8ba2f314e68ca5da5ecd6d41dad8f287d6a305ae"
      },
      "new_attributes": {
        "sha": null
      }
    },
    {
      "event": "update",
      "audit_log_type": "ApplicationBlockingList",
      "audit_log_id": "e773a9eb-296c-40df-98d8-bed46322589d",
      "audit_log_user": "16db5cf986eec6f44422",
      "created_at": "2022-03-18T10:55:35Z",
      "old_attributes": {
        "sha": ""
      },
      "new_attributes": {
        "sha": "273d33fd0a8b205e4af47bbc8ba2f314e68ca5da5ecd6d41dad8f287d6a305ae"
      }
    }
  ]
}

Fetch list of audit logs filtered by event

Request

Requires Authorization

GET /v1/audit_logs?event=login&limit=5

Headers

accept: application/json
content-type: application/json
accept-encoding: identity
authorization: Basic FILTERED

cURL Edit, then copy and paste on your terminal

curl -X GET \
-H 'accept: application/json' \
-H 'content-type: application/json' \
-H 'accept-encoding: identity' \
--compressed -H 'Accept-Encoding: gzip, deflate' \
-u YOUR_API_CLIENT_ID \
'https://api.amp.cisco.com/v1/audit_logs?event=login&limit=5'

Response

Shortened for readability

content-type: application/json
transfer-encoding: chunked
status: 200 OK
x-ratelimit-limit: 3000
x-ratelimit-reset: 906
strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
x-ratelimit-remaining: 2880
x-permitted-cross-domain-policies: none
x-download-options: noopen
etag: W/"c65f65f289df5c7ab531a8e94cfe18c5"
x-frame-options: SAMEORIGIN
x-ratelimit-resetdate: 2022-03-18T11:55:11Z

{
  "version": "v1.2.0",
  "metadata": {
    "links": {
      "self": "https://api.amp.cisco.com/v1/audit_logs?event=login&limit=5",
      "next": "https://api.amp.cisco.com/v1/audit_logs?event=login&limit=5&offset=5"
    },
    "results": {
      "total": 62,
      "current_item_count": 5,
      "index": 0,
      "items_per_page": 5
    }
  },
  "data": [
    {
      "event": "login",
      "audit_log_type": "User",
      "audit_log_id": "373031bf-6e67-40e5-9fc2-ffea680a2ebd",
      "audit_log_user": "kmarasin+qa1_apidocs@cisco.com",
      "created_at": "2022-02-23T20:43:09Z"
    },
    {
      "event": "login",
      "audit_log_type": "User",
      "audit_log_id": "385501d4-017e-477c-8af6-8d096f95545d",
      "audit_log_user": "marlin2+sdc_api_docs@cisco.com",
      "created_at": "2021-04-09T19:15:54Z"
    }
  ]
}

Fetch list of audit logs filtered by start_time

Request

Requires Authorization

GET /v1/audit_logs?start_time=2015-10-01T00%3A00%3A00%2B00%3A00&limit=5

Headers

accept: application/json
content-type: application/json
accept-encoding: identity
authorization: Basic FILTERED

cURL Edit, then copy and paste on your terminal

curl -X GET \
-H 'accept: application/json' \
-H 'content-type: application/json' \
-H 'accept-encoding: identity' \
--compressed -H 'Accept-Encoding: gzip, deflate' \
-u YOUR_API_CLIENT_ID \
'https://api.amp.cisco.com/v1/audit_logs?start_time=2015-10-01T00%3A00%3A00%2B00%3A00&limit=5'

Response

Shortened for readability

content-type: application/json
transfer-encoding: chunked
status: 200 OK
x-ratelimit-limit: 3000
x-ratelimit-reset: 906
strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
x-ratelimit-remaining: 2879
x-permitted-cross-domain-policies: none
x-download-options: noopen
etag: W/"52ef1d5f0df8ba02340ee6c6a7b240db"
x-frame-options: SAMEORIGIN
x-ratelimit-resetdate: 2022-03-18T11:55:11Z

{
  "version": "v1.2.0",
  "metadata": {
    "links": {
      "self": "https://api.amp.cisco.com/v1/audit_logs?start_time=2015-10-01T00%3A00%3A00%2B00%3A00&limit=5",
      "next": "https://api.amp.cisco.com/v1/audit_logs?start_time=2015-10-01T00%3A00%3A00%2B00%3A00&limit=5&offset=5"
    },
    "results": {
      "total": 5598,
      "current_item_count": 5,
      "index": 0,
      "items_per_page": 5
    }
  },
  "data": [
    {
      "event": "create",
      "audit_log_type": "Agent",
      "audit_log_id": "538738f5-3a14-4449-933b-86142553de06",
      "audit_log_user": "16db5cf986eec6f44422",
      "created_at": "2022-03-18T11:40:03Z",
      "old_attributes": {
        "policy_id": null,
        "product_version_id": null
      },
      "new_attributes": {
        "policy_id": 915608,
        "product_version_id": 19606
      }
    },
    {
      "event": "create",
      "audit_log_type": "Computer",
      "audit_log_id": "16db5cf986eec6f44422",
      "audit_log_user": "16db5cf986eec6f44422",
      "created_at": "2022-03-18T11:40:03Z",
      "old_attributes": {
        "name": null,
        "desc": null,
        "hostname": null,
        "ip_external": null,
        "group_id": null,
        "operating_system_id": null
      },
      "new_attributes": {
        "name": "Demo_Upatre",
        "desc": "Computer populated with demo data",
        "hostname": "Demo_Upatre",
        "ip_external": "167.151.184.100",
        "group_id": 431790,
        "operating_system_id": 35743
      }
    }
  ]
}

Fetch list of audit logs filtered by end_time

Request

Requires Authorization

GET /v1/audit_logs?end_time=2018-10-01T00%3A00%3A00%2B00%3A00&limit=5

Headers

accept: application/json
content-type: application/json
accept-encoding: identity
authorization: Basic FILTERED

cURL Edit, then copy and paste on your terminal

curl -X GET \
-H 'accept: application/json' \
-H 'content-type: application/json' \
-H 'accept-encoding: identity' \
--compressed -H 'Accept-Encoding: gzip, deflate' \
-u YOUR_API_CLIENT_ID \
'https://api.amp.cisco.com/v1/audit_logs?end_time=2018-10-01T00%3A00%3A00%2B00%3A00&limit=5'

Response

Shortened for readability

content-type: application/json
transfer-encoding: chunked
status: 200 OK
x-ratelimit-limit: 3000
x-ratelimit-reset: 906
strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
x-ratelimit-remaining: 2878
x-permitted-cross-domain-policies: none
x-download-options: noopen
etag: W/"5f330be26072af943a02e676c1dc0311"
x-frame-options: SAMEORIGIN
x-ratelimit-resetdate: 2022-03-18T11:55:11Z

{
  "version": "v1.2.0",
  "metadata": {
    "links": {
      "self": "https://api.amp.cisco.com/v1/audit_logs?end_time=2018-10-01T00%3A00%3A00%2B00%3A00&limit=5",
      "next": "https://api.amp.cisco.com/v1/audit_logs?end_time=2018-10-01T00%3A00%3A00%2B00%3A00&limit=5&offset=5"
    },
    "results": {
      "total": 863,
      "current_item_count": 5,
      "index": 0,
      "items_per_page": 5
    }
  },
  "data": [
    {
      "event": "create",
      "audit_log_type": "Group",
      "audit_log_id": "eeaaea2b-7bcb-4263-8fb2-84a519c12940",
      "audit_log_user": "16db5cf986eec6f44422",
      "created_at": "2018-09-18T22:06:25Z",
      "old_attributes": {
        "name": null
      },
      "new_attributes": {
        "name": "jRwlALSr"
      }
    },
    {
      "event": "update",
      "audit_log_type": "Group",
      "audit_log_id": "7fe7a1d5-f2e5-4348-a0d8-6dcc7b40fe66",
      "audit_log_user": "16db5cf986eec6f44422",
      "created_at": "2018-09-18T22:06:23Z",
      "old_attributes": {
        "ancestry": "577010"
      },
      "new_attributes": {
        "ancestry": null
      }
    }
  ]
}

Fetch list of audit logs filtered by audit_log_user

Request

Requires Authorization

GET /v1/audit_logs?audit_log_user=amp%40cisco.com&limit=5

Headers

accept: application/json
content-type: application/json
accept-encoding: identity
authorization: Basic FILTERED

cURL Edit, then copy and paste on your terminal

curl -X GET \
-H 'accept: application/json' \
-H 'content-type: application/json' \
-H 'accept-encoding: identity' \
--compressed -H 'Accept-Encoding: gzip, deflate' \
-u YOUR_API_CLIENT_ID \
'https://api.amp.cisco.com/v1/audit_logs?audit_log_user=amp%40cisco.com&limit=5'

Response

Shortened for readability

content-type: application/json
transfer-encoding: chunked
status: 200 OK
x-ratelimit-limit: 3000
x-ratelimit-reset: 905
strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
x-ratelimit-remaining: 2877
x-permitted-cross-domain-policies: none
x-download-options: noopen
etag: W/"62cbfbdab8ae71d55c91819e054cb930"
x-frame-options: SAMEORIGIN
x-ratelimit-resetdate: 2022-03-18T11:55:11Z

{
  "version": "v1.2.0",
  "metadata": {
    "links": {
      "self": "https://api.amp.cisco.com/v1/audit_logs?audit_log_user=amp%40cisco.com&limit=5"
    },
    "results": {
      "total": 0,
      "current_item_count": 0,
      "index": 0,
      "items_per_page": 5
    }
  },
  "data": [

  ]
}