GET /v1/audit_logs
Description
Provides audit logs based on the filters specified in the query parameters.
Query Parameters
Name | Type | Example Values | Description |
---|---|---|---|
audit_log_type |
String | User | |
limit |
Integer | 5 | |
audit_log_id |
GUID | e773a9eb-296c-40df-98d8-bed46322589d | |
event |
String | login | |
start_time |
String (Time ISO8601) | 2015-10-01T00:00:00+00:00, 2018-10-01T00:00:00+00:00 | |
end_time |
String (Time ISO8601) | 2015-10-01T00:00:00+00:00, 2018-10-01T00:00:00+00:00 | |
audit_log_user |
String | amp@cisco.com |
Name | Type | Description |
---|---|---|
version | String | |
metadata.links.self | String | |
metadata.links.next | String | |
metadata.results.total | Integer | |
metadata.results.current_item_count | Integer | |
metadata.results.index | Integer | |
metadata.results.items_per_page | Integer | |
data | Array | |
data[].event | String | |
data[].audit_log_type | String | |
data[].audit_log_id | GUID | |
data[].audit_log_user | String | |
data[].created_at | String (Time ISO8601) | |
data[].old_attributes.sha | String | |
data[].new_attributes.sha |
Examples
- Fetch list of audit logs
- Fetch list of audit logs filtered by audit_log_type
- Fetch list of audit logs filtered by audit_log_id
- Fetch list of audit logs filtered by event
- Fetch list of audit logs filtered by start_time
- Fetch list of audit logs filtered by end_time
- Fetch list of audit logs filtered by audit_log_user
Fetch list of audit logs
Request
Requires AuthorizationGET /v1/audit_logs
Headers
accept: application/json
content-type: application/json
accept-encoding: identity
authorization: Basic FILTERED
cURL Edit, then copy and paste on your terminal
curl -X GET \
-H 'accept: application/json' \
-H 'content-type: application/json' \
-H 'accept-encoding: identity' \
--compressed -H 'Accept-Encoding: gzip, deflate' \
-u YOUR_API_CLIENT_ID \
'https://api.amp.cisco.com/v1/audit_logs'
Response
cURL Edit, then copy and paste on your terminal
curl -X GET \ -H 'accept: application/json' \ -H 'content-type: application/json' \ -H 'accept-encoding: identity' \ --compressed -H 'Accept-Encoding: gzip, deflate' \ -u YOUR_API_CLIENT_ID \ 'https://api.amp.cisco.com/v1/audit_logs'
Shortened for readability
content-type: application/json transfer-encoding: chunked status: 200 OK x-ratelimit-limit: 3000 x-ratelimit-reset: 906 strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000 referrer-policy: strict-origin-when-cross-origin x-ratelimit-remaining: 2883 x-permitted-cross-domain-policies: none x-download-options: noopen etag: W/"1431200eabf82ef831fab51758ea9b6e" x-frame-options: SAMEORIGIN x-ratelimit-resetdate: 2022-03-18T11:55:11Z
{
"version": "v1.2.0",
"metadata": {
"links": {
"self": "https://api.amp.cisco.com/v1/audit_logs",
"next": "https://api.amp.cisco.com/v1/audit_logs?offset=500"
},
"results": {
"total": 5598,
"current_item_count": 500,
"index": 0,
"items_per_page": 500
}
},
"data": [
{
"event": "create",
"audit_log_type": "Agent",
"audit_log_id": "538738f5-3a14-4449-933b-86142553de06",
"audit_log_user": "16db5cf986eec6f44422",
"created_at": "2022-03-18T11:40:03Z",
"old_attributes": {
"policy_id": null,
"product_version_id": null
},
"new_attributes": {
"policy_id": 915608,
"product_version_id": 19606
}
},
{
"event": "create",
"audit_log_type": "Computer",
"audit_log_id": "16db5cf986eec6f44422",
"audit_log_user": "16db5cf986eec6f44422",
"created_at": "2022-03-18T11:40:03Z",
"old_attributes": {
"name": null,
"desc": null,
"hostname": null,
"ip_external": null,
"group_id": null,
"operating_system_id": null
},
"new_attributes": {
"name": "Demo_Upatre",
"desc": "Computer populated with demo data",
"hostname": "Demo_Upatre",
"ip_external": "167.151.184.100",
"group_id": 431790,
"operating_system_id": 35743
}
}
]
}
Fetch list of audit logs filtered by audit_log_type
Request
Requires AuthorizationGET /v1/audit_logs?audit_log_type=User&limit=5
Headers
accept: application/json
content-type: application/json
accept-encoding: identity
authorization: Basic FILTERED
cURL Edit, then copy and paste on your terminal
curl -X GET \
-H 'accept: application/json' \
-H 'content-type: application/json' \
-H 'accept-encoding: identity' \
--compressed -H 'Accept-Encoding: gzip, deflate' \
-u YOUR_API_CLIENT_ID \
'https://api.amp.cisco.com/v1/audit_logs?audit_log_type=User&limit=5'
Response
cURL Edit, then copy and paste on your terminal
curl -X GET \ -H 'accept: application/json' \ -H 'content-type: application/json' \ -H 'accept-encoding: identity' \ --compressed -H 'Accept-Encoding: gzip, deflate' \ -u YOUR_API_CLIENT_ID \ 'https://api.amp.cisco.com/v1/audit_logs?audit_log_type=User&limit=5'
Shortened for readability
content-type: application/json transfer-encoding: chunked status: 200 OK x-ratelimit-limit: 3000 x-ratelimit-reset: 906 strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000 referrer-policy: strict-origin-when-cross-origin x-ratelimit-remaining: 2882 x-permitted-cross-domain-policies: none x-download-options: noopen etag: W/"697f92f4d2f3908df48ff1a6d8e663b8" x-frame-options: SAMEORIGIN x-ratelimit-resetdate: 2022-03-18T11:55:11Z
{
"version": "v1.2.0",
"metadata": {
"links": {
"self": "https://api.amp.cisco.com/v1/audit_logs?audit_log_type=User&limit=5",
"next": "https://api.amp.cisco.com/v1/audit_logs?audit_log_type=User&limit=5&offset=5"
},
"results": {
"total": 131,
"current_item_count": 5,
"index": 0,
"items_per_page": 5
}
},
"data": [
{
"event": "login",
"audit_log_type": "User",
"audit_log_id": "373031bf-6e67-40e5-9fc2-ffea680a2ebd",
"audit_log_user": "kmarasin+qa1_apidocs@cisco.com",
"created_at": "2022-02-23T20:43:09Z"
},
{
"event": "login",
"audit_log_type": "User",
"audit_log_id": "385501d4-017e-477c-8af6-8d096f95545d",
"audit_log_user": "marlin2+sdc_api_docs@cisco.com",
"created_at": "2021-04-09T19:15:54Z"
}
]
}
Fetch list of audit logs filtered by audit_log_id
Request
Requires AuthorizationGET /v1/audit_logs?audit_log_id=e773a9eb-296c-40df-98d8-bed46322589d&limit=5
Headers
accept: application/json
content-type: application/json
accept-encoding: identity
authorization: Basic FILTERED
cURL Edit, then copy and paste on your terminal
curl -X GET \
-H 'accept: application/json' \
-H 'content-type: application/json' \
-H 'accept-encoding: identity' \
--compressed -H 'Accept-Encoding: gzip, deflate' \
-u YOUR_API_CLIENT_ID \
'https://api.amp.cisco.com/v1/audit_logs?audit_log_id=e773a9eb-296c-40df-98d8-bed46322589d&limit=5'
Response
cURL Edit, then copy and paste on your terminal
curl -X GET \ -H 'accept: application/json' \ -H 'content-type: application/json' \ -H 'accept-encoding: identity' \ --compressed -H 'Accept-Encoding: gzip, deflate' \ -u YOUR_API_CLIENT_ID \ 'https://api.amp.cisco.com/v1/audit_logs?audit_log_id=e773a9eb-296c-40df-98d8-bed46322589d&limit=5'
Shortened for readability
content-type: application/json transfer-encoding: chunked status: 200 OK x-ratelimit-limit: 3000 x-ratelimit-reset: 906 strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000 referrer-policy: strict-origin-when-cross-origin x-ratelimit-remaining: 2881 x-permitted-cross-domain-policies: none x-download-options: noopen etag: W/"c01436d9049462caa8a01e5d8aeba4f4" x-frame-options: SAMEORIGIN x-ratelimit-resetdate: 2022-03-18T11:55:11Z
{
"version": "v1.2.0",
"metadata": {
"links": {
"self": "https://api.amp.cisco.com/v1/audit_logs?audit_log_id=e773a9eb-296c-40df-98d8-bed46322589d&limit=5",
"next": "https://api.amp.cisco.com/v1/audit_logs?audit_log_id=e773a9eb-296c-40df-98d8-bed46322589d&limit=5&offset=5"
},
"results": {
"total": 1170,
"current_item_count": 5,
"index": 0,
"items_per_page": 5
}
},
"data": [
{
"event": "update",
"audit_log_type": "ApplicationBlockingList",
"audit_log_id": "e773a9eb-296c-40df-98d8-bed46322589d",
"audit_log_user": "16db5cf986eec6f44422",
"created_at": "2022-03-18T10:55:36Z",
"old_attributes": {
"sha": "273d33fd0a8b205e4af47bbc8ba2f314e68ca5da5ecd6d41dad8f287d6a305ae"
},
"new_attributes": {
"sha": null
}
},
{
"event": "update",
"audit_log_type": "ApplicationBlockingList",
"audit_log_id": "e773a9eb-296c-40df-98d8-bed46322589d",
"audit_log_user": "16db5cf986eec6f44422",
"created_at": "2022-03-18T10:55:35Z",
"old_attributes": {
"sha": ""
},
"new_attributes": {
"sha": "273d33fd0a8b205e4af47bbc8ba2f314e68ca5da5ecd6d41dad8f287d6a305ae"
}
}
]
}
Fetch list of audit logs filtered by event
Request
Requires AuthorizationGET /v1/audit_logs?event=login&limit=5
Headers
accept: application/json
content-type: application/json
accept-encoding: identity
authorization: Basic FILTERED
cURL Edit, then copy and paste on your terminal
curl -X GET \
-H 'accept: application/json' \
-H 'content-type: application/json' \
-H 'accept-encoding: identity' \
--compressed -H 'Accept-Encoding: gzip, deflate' \
-u YOUR_API_CLIENT_ID \
'https://api.amp.cisco.com/v1/audit_logs?event=login&limit=5'
Response
cURL Edit, then copy and paste on your terminal
curl -X GET \ -H 'accept: application/json' \ -H 'content-type: application/json' \ -H 'accept-encoding: identity' \ --compressed -H 'Accept-Encoding: gzip, deflate' \ -u YOUR_API_CLIENT_ID \ 'https://api.amp.cisco.com/v1/audit_logs?event=login&limit=5'
Shortened for readability
content-type: application/json transfer-encoding: chunked status: 200 OK x-ratelimit-limit: 3000 x-ratelimit-reset: 906 strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000 referrer-policy: strict-origin-when-cross-origin x-ratelimit-remaining: 2880 x-permitted-cross-domain-policies: none x-download-options: noopen etag: W/"c65f65f289df5c7ab531a8e94cfe18c5" x-frame-options: SAMEORIGIN x-ratelimit-resetdate: 2022-03-18T11:55:11Z
{
"version": "v1.2.0",
"metadata": {
"links": {
"self": "https://api.amp.cisco.com/v1/audit_logs?event=login&limit=5",
"next": "https://api.amp.cisco.com/v1/audit_logs?event=login&limit=5&offset=5"
},
"results": {
"total": 62,
"current_item_count": 5,
"index": 0,
"items_per_page": 5
}
},
"data": [
{
"event": "login",
"audit_log_type": "User",
"audit_log_id": "373031bf-6e67-40e5-9fc2-ffea680a2ebd",
"audit_log_user": "kmarasin+qa1_apidocs@cisco.com",
"created_at": "2022-02-23T20:43:09Z"
},
{
"event": "login",
"audit_log_type": "User",
"audit_log_id": "385501d4-017e-477c-8af6-8d096f95545d",
"audit_log_user": "marlin2+sdc_api_docs@cisco.com",
"created_at": "2021-04-09T19:15:54Z"
}
]
}
Fetch list of audit logs filtered by start_time
Request
Requires AuthorizationGET /v1/audit_logs?start_time=2015-10-01T00%3A00%3A00%2B00%3A00&limit=5
Headers
accept: application/json
content-type: application/json
accept-encoding: identity
authorization: Basic FILTERED
cURL Edit, then copy and paste on your terminal
curl -X GET \
-H 'accept: application/json' \
-H 'content-type: application/json' \
-H 'accept-encoding: identity' \
--compressed -H 'Accept-Encoding: gzip, deflate' \
-u YOUR_API_CLIENT_ID \
'https://api.amp.cisco.com/v1/audit_logs?start_time=2015-10-01T00%3A00%3A00%2B00%3A00&limit=5'
Response
cURL Edit, then copy and paste on your terminal
curl -X GET \ -H 'accept: application/json' \ -H 'content-type: application/json' \ -H 'accept-encoding: identity' \ --compressed -H 'Accept-Encoding: gzip, deflate' \ -u YOUR_API_CLIENT_ID \ 'https://api.amp.cisco.com/v1/audit_logs?start_time=2015-10-01T00%3A00%3A00%2B00%3A00&limit=5'
Shortened for readability
content-type: application/json transfer-encoding: chunked status: 200 OK x-ratelimit-limit: 3000 x-ratelimit-reset: 906 strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000 referrer-policy: strict-origin-when-cross-origin x-ratelimit-remaining: 2879 x-permitted-cross-domain-policies: none x-download-options: noopen etag: W/"52ef1d5f0df8ba02340ee6c6a7b240db" x-frame-options: SAMEORIGIN x-ratelimit-resetdate: 2022-03-18T11:55:11Z
{
"version": "v1.2.0",
"metadata": {
"links": {
"self": "https://api.amp.cisco.com/v1/audit_logs?start_time=2015-10-01T00%3A00%3A00%2B00%3A00&limit=5",
"next": "https://api.amp.cisco.com/v1/audit_logs?start_time=2015-10-01T00%3A00%3A00%2B00%3A00&limit=5&offset=5"
},
"results": {
"total": 5598,
"current_item_count": 5,
"index": 0,
"items_per_page": 5
}
},
"data": [
{
"event": "create",
"audit_log_type": "Agent",
"audit_log_id": "538738f5-3a14-4449-933b-86142553de06",
"audit_log_user": "16db5cf986eec6f44422",
"created_at": "2022-03-18T11:40:03Z",
"old_attributes": {
"policy_id": null,
"product_version_id": null
},
"new_attributes": {
"policy_id": 915608,
"product_version_id": 19606
}
},
{
"event": "create",
"audit_log_type": "Computer",
"audit_log_id": "16db5cf986eec6f44422",
"audit_log_user": "16db5cf986eec6f44422",
"created_at": "2022-03-18T11:40:03Z",
"old_attributes": {
"name": null,
"desc": null,
"hostname": null,
"ip_external": null,
"group_id": null,
"operating_system_id": null
},
"new_attributes": {
"name": "Demo_Upatre",
"desc": "Computer populated with demo data",
"hostname": "Demo_Upatre",
"ip_external": "167.151.184.100",
"group_id": 431790,
"operating_system_id": 35743
}
}
]
}
Fetch list of audit logs filtered by end_time
Request
Requires AuthorizationGET /v1/audit_logs?end_time=2018-10-01T00%3A00%3A00%2B00%3A00&limit=5
Headers
accept: application/json
content-type: application/json
accept-encoding: identity
authorization: Basic FILTERED
cURL Edit, then copy and paste on your terminal
curl -X GET \
-H 'accept: application/json' \
-H 'content-type: application/json' \
-H 'accept-encoding: identity' \
--compressed -H 'Accept-Encoding: gzip, deflate' \
-u YOUR_API_CLIENT_ID \
'https://api.amp.cisco.com/v1/audit_logs?end_time=2018-10-01T00%3A00%3A00%2B00%3A00&limit=5'
Response
cURL Edit, then copy and paste on your terminal
curl -X GET \ -H 'accept: application/json' \ -H 'content-type: application/json' \ -H 'accept-encoding: identity' \ --compressed -H 'Accept-Encoding: gzip, deflate' \ -u YOUR_API_CLIENT_ID \ 'https://api.amp.cisco.com/v1/audit_logs?end_time=2018-10-01T00%3A00%3A00%2B00%3A00&limit=5'
Shortened for readability
content-type: application/json transfer-encoding: chunked status: 200 OK x-ratelimit-limit: 3000 x-ratelimit-reset: 906 strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000 referrer-policy: strict-origin-when-cross-origin x-ratelimit-remaining: 2878 x-permitted-cross-domain-policies: none x-download-options: noopen etag: W/"5f330be26072af943a02e676c1dc0311" x-frame-options: SAMEORIGIN x-ratelimit-resetdate: 2022-03-18T11:55:11Z
{
"version": "v1.2.0",
"metadata": {
"links": {
"self": "https://api.amp.cisco.com/v1/audit_logs?end_time=2018-10-01T00%3A00%3A00%2B00%3A00&limit=5",
"next": "https://api.amp.cisco.com/v1/audit_logs?end_time=2018-10-01T00%3A00%3A00%2B00%3A00&limit=5&offset=5"
},
"results": {
"total": 863,
"current_item_count": 5,
"index": 0,
"items_per_page": 5
}
},
"data": [
{
"event": "create",
"audit_log_type": "Group",
"audit_log_id": "eeaaea2b-7bcb-4263-8fb2-84a519c12940",
"audit_log_user": "16db5cf986eec6f44422",
"created_at": "2018-09-18T22:06:25Z",
"old_attributes": {
"name": null
},
"new_attributes": {
"name": "jRwlALSr"
}
},
{
"event": "update",
"audit_log_type": "Group",
"audit_log_id": "7fe7a1d5-f2e5-4348-a0d8-6dcc7b40fe66",
"audit_log_user": "16db5cf986eec6f44422",
"created_at": "2018-09-18T22:06:23Z",
"old_attributes": {
"ancestry": "577010"
},
"new_attributes": {
"ancestry": null
}
}
]
}
Fetch list of audit logs filtered by audit_log_user
Request
Requires AuthorizationGET /v1/audit_logs?audit_log_user=amp%40cisco.com&limit=5
Headers
accept: application/json
content-type: application/json
accept-encoding: identity
authorization: Basic FILTERED
cURL Edit, then copy and paste on your terminal
curl -X GET \
-H 'accept: application/json' \
-H 'content-type: application/json' \
-H 'accept-encoding: identity' \
--compressed -H 'Accept-Encoding: gzip, deflate' \
-u YOUR_API_CLIENT_ID \
'https://api.amp.cisco.com/v1/audit_logs?audit_log_user=amp%40cisco.com&limit=5'
Response
cURL Edit, then copy and paste on your terminal
curl -X GET \ -H 'accept: application/json' \ -H 'content-type: application/json' \ -H 'accept-encoding: identity' \ --compressed -H 'Accept-Encoding: gzip, deflate' \ -u YOUR_API_CLIENT_ID \ 'https://api.amp.cisco.com/v1/audit_logs?audit_log_user=amp%40cisco.com&limit=5'
Shortened for readability
content-type: application/json transfer-encoding: chunked status: 200 OK x-ratelimit-limit: 3000 x-ratelimit-reset: 905 strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000 referrer-policy: strict-origin-when-cross-origin x-ratelimit-remaining: 2877 x-permitted-cross-domain-policies: none x-download-options: noopen etag: W/"62cbfbdab8ae71d55c91819e054cb930" x-frame-options: SAMEORIGIN x-ratelimit-resetdate: 2022-03-18T11:55:11Z
{
"version": "v1.2.0",
"metadata": {
"links": {
"self": "https://api.amp.cisco.com/v1/audit_logs?audit_log_user=amp%40cisco.com&limit=5"
},
"results": {
"total": 0,
"current_item_count": 0,
"index": 0,
"items_per_page": 5
}
},
"data": [
]
}