Manage Audit Operations

Article Summary

Share feedback

Thanks for sharing your feedback!

You can use the following methods in the Britive Audit API for managing various operations related to audits.

1. List of Fields

The GET method returns the list of fields used in the audit query.

GET	{{url}}/api/logs/fields

Request Example

An example GET request for retrieving the list of fields used in an audit query is shown here.

curl --location --request GET '{{url}}/api/logs/fields' \
--header 'Authorization: TOKEN {{previewApiToken}}'

Response Example

An example response of the GET request for retrieving the list of fields used in an audit query is shown here.

Status: 200 OK

{
    "actor.displayName": "Actor's display name.",
    "actor.role": "Actor's role.",
    "actor.type": "Actor's type.",
    "actor.userId": "Actor's user ID.",
    "actor.username": "Actor's username.",
    "client.device": "Actor's user environment device.",
    "client.displayName": "Actor's user environment display name.",
    "client.ipAddress": "Actor's user environment IP address.",
    "client.userAgent": "Actor's user environment user agent.",
    "event.displayName": "Display name of action taken.",
    "event.eventType": "Type of action taken.",
    "result.success": "Result of the action.",
    "target.applicationName": "Application name receiving the action.",
    "target.applicationSessionId": "Application session ID.",
    "target.displayName": "Target display name.",
    "target.environmentGroupName": "Environment group receiving the action.",
    "target.environmentName": "Environment name receiving the action.",
    "target.targetId": "Target ID receiving the action."
}

2. List of Operators

The GET method returns the list of operators used in the audit query.

GET	{{url}}/api/logs/operators

Request Example

An example GET request for retrieving the list of operators used in an audit query is shown here.

curl --location --request GET '{{url}}/api/logs/operators' \
--header 'Authorization: TOKEN {{previewApiToken}}'

Response Example

An example response of the GET request for retrieving the list of operators used in an audit query is shown here.

Status: 200 OK

{
    "sw": "Starts with",
    "co": "Contains",
    "eq": "Equals"
}

3. Query Audit Logs

The GET method queries the audit log using filters.

GET	{{url}}/api/logs?to=2020-10-02T07:58:16.474Z&from=2020-09-25T07:58:16.474Z&size=20&filter=actor.displayName+co+%22smith%22

Request Example

An example GET request for querying the audit log is shown here.

Status: 200 OK

curl --location --request GET '{{url}}/api/logs?to=2020-10-02T07:58:16.474Z&from=2020-09-25T07:58:16.474Z&size=20&filter=actor.displayName+co+%22smith%22' \
--header 'Authorization: TOKEN {{previewApiToken}}'

Response Example

An example response of the GET request for querying the audit log is shown here.

[
    {
        "timestamp": "2020-10-02T07:09:21.122+0000",
        "id": "",
        "actor": {
            "userId": "rqwGTCCh8f7YFsC0zeYf",
            "displayName": "Bob Smith",
            "type": "User",
            "role": "TenantAdmin",
            "username": "bob.smith@company.com",
            "credential": {
                "name": "rqwGTCCh8f7YFsC0zeYf",
                "type": "Bearer"
            }
        },
        "client": {
            "device": "Desktop",
            "ipAddress": "130.105.200.153",
            "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36",
            "displayName": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36 - 130.105.200.153",
            "browser": "Chrome",
            "platform": "Win10",
            "additionalInfo": {}
        },
        "event": {
            "eventType": "api.token.create",
            "displayName": "Created API Token",
            "additionalInfo": {}
        },
        "target": {
            "targetId": "js2cir9gffrutt6ro8cb",
            "applicationName": null,
            "environmentName": null,
            "environmentGroupName": null,
            "parentEnvironmentGroupName": null,
            "displayName": "bob",
            "applicationSessionId": null,
            "additionalInfo": {
                "type": "DEFAULT"
            }
        },
        "result": {
            "success": true,
            "message": null
        },
        "tenantId": "qa1"
    },
    {
        "timestamp": "2020-10-02T06:57:27.179+0000",
        "id": "",
        "actor": {
            "userId": "rqwGTCCh8f7YFsC0zeYf",
            "displayName": "Bob Smith",
            "type": "User",
            "role": "TenantAdmin",
            "username": "bob.smith@company.com",
            "credential": {
                "name": "rqwGTCCh8f7YFsC0zeYf",
                "type": "Bearer"
            }
        },
        "client": {
            "device": "Desktop",
            "ipAddress": "130.105.200.153",
            "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36",
            "displayName": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36 - 130.105.200.153",
            "browser": "Chrome",
            "platform": "Win10",
            "additionalInfo": {}
        },
        "event": {
            "eventType": "authentication.login",
            "displayName": "Authentication - Login",
            "additionalInfo": {}
        },
        "target": null,
        "result": {
            "success": true,
            "message": null
        },
        "tenantId": "qa1"
    },
    {
        "timestamp": "2020-10-02T06:57:09.992+0000",
        "id": "",
        "actor": {
            "userId": "rqwGTCCh8f7YFsC0zeYf",
            "displayName": "Bob Smith",
            "type": "User",
            "role": "TenantAdmin",
            "username": "bob.smith@company.com",
            "credential": {
                "name": "rqwGTCCh8f7YFsC0zeYf",
                "type": "Bearer"
            }
        },
        "client": {
            "device": "Desktop",
            "ipAddress": "130.105.200.153",
            "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36",
            "displayName": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36 - 130.105.200.153",
            "browser": "Chrome",
            "platform": "Win10",
            "additionalInfo": {}
        },
        "event": {
            "eventType": "authentication.login",
            "displayName": "Authentication - Login",
            "additionalInfo": {}
        },
        "target": null,
        "result": {
            "success": false,
            "message": "Your username and/or password was not recognized. Please try again."
        },
        "tenantId": "qa1"
    }
]

4. Download Query Results

The GET method downloads the audit-log query result in the CSV format.

GET	{{url}}/api/logs/csv?to=2020-10-02T07:58:16.474Z&from=2020-09-25T07:58:16.474Z&filter=actor.displayName+co+%22bob%22+and+event.displayName+eq+%22application%22

Request Parameters

The following table shows the parameters in this method:

Parameters	Description including Examples or Possible Values	Required/Optional
to	The end timestamp of the query. Example: 2020-10-02T07:58:16.474Z	Optional
from	The start timestamp of the query. Example: 2020-09-25T07:58:16.474Z	Optional
filter	The filter used in the method. Example: actor.displayName+co+%22bob%22+and+event.displayName+ eq+%22application%22	Optional

Request Example

An example GET request for downloading the audit log query result is shown here.

curl --location --request GET '{{url}}/api/logs/csv?to=2020-10-02T07:58:16.474Z&from=2020-09-25T07:58:16.474Z&filter=actor.displayName+co+%22raghu%22+and+event.displayName+eq+%22application%22' \
--header 'Authorization: TOKEN {{previewApiToken}}'

Response Example

An example response of the GET request for downloading the audit log query result is shown here.

Response in the CSV format

"timestamp","actor.display_name","actor.type","actor.role","actor.username","client.device","client.ipAddress","client.browser","client.platform","client.userAgent","client.displayName","client.additionalInfo","event.eventType","event.displayName","event.additionalInfo","target.applicationName","target.environmentName","target.environmentGroupName","target.parentEnvironmentGroupName","target.displayName","target.applicationSessionId","target.additionalInfo","result.success","result.message"

"Fri Oct 02 07:48:14 UTC 2020","Bob Smith","User","TenantAdmin","bobsmith","Unknown","49.37.202.70","python-requests","Unknown","python-requests/2.23.0","python-requests/2.23.0 - 49.37.202.70"," ","application.delete","Delete Application"," ","GCP-ElizabethWestautotestMFaJfzjma",,,,"GCP-ElizabethWestautotestMFaJfzjma",," ","true",

"Fri Oct 02 07:43:47 UTC 2020","Bob Smith","User","TenantAdmin","bobsmith","Desktop","49.37.202.70","Chrome","macOS","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 - 49.37.202.70"," ","application.update.properties","Update Application Properties"," ","GCP-ElizabethWestautotestMFaJfzjma",,,,"GCP-ElizabethWestautotestMFaJfzjma",,"description:GCP app description", "false", "Error in setting app properties for: z1h18o78wrri9ebo9nqu"

Query Audit Logs Advanced Example

A more advanced query example that uses paging is shown here. If the result has more than one page, the response header contains Next-Page and Previous-Page headers.

GET	{{previewUrl}}/api/logs?sort=desc&page=2&to=2020-10-02T07:58:16.474Z& from=2020-09 25T07:58:16.474Z&size=20&filter=actor.displayName+co+ %22bob%22+and+ event.displayName+eq+%22application%22

To know more about the request parameters, see Common Parameters in a Query

Request Example

The GET request for the advanced query audit logs example is shown here.

curl --location --request GET '{{previewUrl}}/api/logs?page=2&to=2020-10-02T07:58:16.474Z&from=2020-09-25T07:58:16.474Z&size=20&filter=actor.displayName+co+%22raghu%22+and+event.displayName+eq+%22application%22' \
--header 'Authorization: TOKEN {{previewApiToken}}'

Response Example

An example response of the GET request is shown here.

Status: 200 OK

[
    {
        "timestamp": "2020-10-02T06:52:46.103+0000",
        "id": "",
        "actor": {
            "userId": "VMFakVdMKOlO4c9YH6mb",
            "displayName": "Bob Smith",
            "type": "User",
            "role": "TenantAdmin",
            "username": "bobsmith",
            "credential": {
                "name": "VMFakVdMKOlO4c9YH6mb",
                "type": "Bearer"
            }
        },
        "client": {
            "device": "Desktop",
            "ipAddress": "49.37.202.70",
            "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36",
            "displayName": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 - 49.37.202.70",
            "browser": "Chrome",
            "platform": "macOS",
            "additionalInfo": {}
        },
        "event": {
            "eventType": "application.update.properties",
            "displayName": "Update Application Properties",
            "additionalInfo": {}
        },
        "target": {
            "targetId": "d7zwgpk0hk3z3m2z2415",
            "applicationName": "AWS-ElizabethHopkinsautotestYRdXuprlm",
            "environmentName": null,
            "environmentGroupName": null,
            "parentEnvironmentGroupName": null,
            "displayName": "AWS-ElizabethHopkinsautotestYRdXuprlm",
            "applicationSessionId": null,
            "additionalInfo": {
                "appAccessMethod": "samlMethod",
                "description": "AWS app description"
            }
        },
        "result": {
            "success": true,
            "message": null
        },
        "tenantId": "qa1"
    },
    {
        "timestamp": "2020-10-02T06:52:44.698+0000",
        "id": "",
        "actor": {
            "userId": "VMFakVdMKOlO4c9YH6mb",
            "displayName": "Bob Smith",
            "type": "User",
            "role": "TenantAdmin",
            "username": "bobsmith",
            "credential": {
                "name": "VMFakVdMKOlO4c9YH6mb",
                "type": "Bearer"
            }
        },
        "client": {
            "device": "Desktop",
            "ipAddress": "49.37.202.70",
            "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36",
            "displayName": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 - 49.37.202.70",
            "browser": "Chrome",
            "platform": "macOS",
            "additionalInfo": {}
        },
        "event": {
            "eventType": "application.add",
            "displayName": "Add Application",
            "additionalInfo": {}
        },
        "target": {
            "targetId": "d7zwgpk0hk3z3m2z2415",
            "applicationName": "AWS-ElizabethHopkinsautotestYRdXuprlm",
            "environmentName": null,
            "environmentGroupName": null,
            "parentEnvironmentGroupName": null,
            "displayName": "AWS-ElizabethHopkinsautotestYRdXuprlm",
            "applicationSessionId": null,
            "additionalInfo": {}
        },
        "result": {
            "success": true,
            "message": null
        },
        "tenantId": "qa1"
    },
    {
        "timestamp": "2020-10-02T05:47:00.222+0000",
        "id": "",
        "actor": {
            "userId": "VMFakVdMKOlO4c9YH6mb",
            "displayName": "Bob Smith",
            "type": "User",
            "role": "TenantAdmin",
            "username": "bobsmith",
            "credential": {
                "name": "qa1automation",
                "type": "ApiToken"
            }
        },
        "client": {
            "device": "Unknown",
            "ipAddress": "49.37.202.70",
            "userAgent": "python-requests/2.23.0",
            "displayName": "python-requests/2.23.0 - 49.37.202.70",
            "browser": "python-requests",
            "platform": "Unknown",
            "additionalInfo": {}
        },
        "event": {
            "eventType": "application.delete",
            "displayName": "Delete Application",
            "additionalInfo": {}
        },
        "target": {
            "targetId": "habx7m08n6snhqi0jaon",
            "applicationName": "AWS-FernandoHallautotestIGeOxxyzm",
            "environmentName": null,
            "environmentGroupName": null,
            "parentEnvironmentGroupName": null,
            "displayName": "AWS-FernandoHallautotestIGeOxxyzm",
            "applicationSessionId": null,
            "additionalInfo": {}
        },
        "result": {
            "success": true,
            "message": null
        },
        "tenantId": "qa1"
    },
    {
        "timestamp": "2020-10-02T05:46:39.772+0000",
        "id": "",
        "actor": {
            "userId": "VMFakVdMKOlO4c9YH6mb",
            "displayName": "Bob Smith",
            "type": "User",
            "role": "TenantAdmin",
            "username": "bobsmith",
            "credential": {
                "name": "VMFakVdMKOlO4c9YH6mb",
                "type": "Bearer"
            }
        },
        "client": {
            "device": "Desktop",
            "ipAddress": "49.37.202.70",
            "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36",
            "displayName": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 - 49.37.202.70",
            "browser": "Chrome",
            "platform": "macOS",
            "additionalInfo": {}
        },
        "event": {
            "eventType": "application.update.enable",
            "displayName": "Enable Application",
            "additionalInfo": {}
        },
        "target": {
            "targetId": "habx7m08n6snhqi0jaon",
            "applicationName": "AWS-FernandoHallautotestIGeOxxyzm",
            "environmentName": null,
            "environmentGroupName": null,
            "parentEnvironmentGroupName": null,
            "displayName": "AWS-FernandoHallautotestIGeOxxyzm",
            "applicationSessionId": null,
            "additionalInfo": {}
        },
        "result": {
            "success": true,
            "message": null
        },
        "tenantId": "qa1"
    },
    {
        "timestamp": "2020-10-02T05:46:20.473+0000",
        "id": "",
        "actor": {
            "userId": "VMFakVdMKOlO4c9YH6mb",
            "displayName": "Bob Smith",
            "type": "User",
            "role": "TenantAdmin",
            "username": "bobsmith",
            "credential": {
                "name": "VMFakVdMKOlO4c9YH6mb",
                "type": "Bearer"
            }
        },
        "client": {
            "device": "Desktop",
            "ipAddress": "49.37.202.70",
            "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36",
            "displayName": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 - 49.37.202.70",
            "browser": "Chrome",
            "platform": "macOS",
            "additionalInfo": {}
        },
        "event": {
            "eventType": "application.update.disable",
            "displayName": "Disable Application",
            "additionalInfo": {}
        },
        "target": {
            "targetId": "habx7m08n6snhqi0jaon",
            "applicationName": "AWS-FernandoHallautotestIGeOxxyzm",
            "environmentName": null,
            "environmentGroupName": null,
            "parentEnvironmentGroupName": null,
            "displayName": "AWS-FernandoHallautotestIGeOxxyzm",
            "applicationSessionId": null,
            "additionalInfo": {}
        },
        "result": {
            "success": true,
            "message": null
        },
        "tenantId": "qa1"
    },
    {
        "timestamp": "2020-10-02T05:45:45.632+0000",
        "id": "",
        "actor": {
            "userId": "VMFakVdMKOlO4c9YH6mb",
            "displayName": "Bob Smith",
            "type": "User",
            "role": "TenantAdmin",
            "username": "bobsmith",
            "credential": {
                "name": "VMFakVdMKOlO4c9YH6mb",
                "type": "Bearer"
            }
        },
        "client": {
            "device": "Desktop",
            "ipAddress": "49.37.202.70",
            "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36",
            "displayName": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 - 49.37.202.70",
            "browser": "Chrome",
            "platform": "macOS",
            "additionalInfo": {}
        },
        "event": {
            "eventType": "application.scan",
            "displayName": "Scan Application",
            "additionalInfo": {}
        },
        "target": {
            "targetId": "habx7m08n6snhqi0jaon",
            "applicationName": "AWS-FernandoHallautotestIGeOxxyzm",
            "environmentName": null,
            "environmentGroupName": null,
            "parentEnvironmentGroupName": null,
            "displayName": "AWS-FernandoHallautotestIGeOxxyzm",
            "applicationSessionId": null,
            "additionalInfo": {}
        },
        "result": {
            "success": true,
            "message": null
        },
        "tenantId": "qa1"
    },
    {
        "timestamp": "2020-10-02T05:45:32.210+0000",
        "id": "",
        "actor": {
            "userId": "VMFakVdMKOlO4c9YH6mb",
            "displayName": "Bob Smith",
            "type": "User",
            "role": "TenantAdmin",
            "username": "bobsmith",
            "credential": {
                "name": "VMFakVdMKOlO4c9YH6mb",
                "type": "Bearer"
            }
        },
        "client": {
            "device": "Desktop",
            "ipAddress": "49.37.202.70",
            "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36",
            "displayName": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 - 49.37.202.70",
            "browser": "Chrome",
            "platform": "macOS",
            "additionalInfo": {}
        },
        "event": {
            "eventType": "application.update.properties",
            "displayName": "Update Application Properties",
            "additionalInfo": {}
        },
        "target": {
            "targetId": "habx7m08n6snhqi0jaon",
            "applicationName": "AWS-FernandoHallautotestIGeOxxyzm",
            "environmentName": null,
            "environmentGroupName": null,
            "parentEnvironmentGroupName": null,
            "displayName": "AWS-FernandoHallautotestIGeOxxyzm",
            "applicationSessionId": null,
            "additionalInfo": {
                "accountId": "378563640942",
                "appAccessMethod": "samlMethod"
            }
        },
        "result": {
            "success": true,
            "message": null
        },
        "tenantId": "qa1"
    },
    {
        "timestamp": "2020-10-02T05:45:15.128+0000",
        "id": "",
        "actor": {
            "userId": "VMFakVdMKOlO4c9YH6mb",
            "displayName": "Bob Smith",
            "type": "User",
            "role": "TenantAdmin",
            "username": "bobsmith",
            "credential": {
                "name": "VMFakVdMKOlO4c9YH6mb",
                "type": "Bearer"
            }
        },
        "client": {
            "device": "Desktop",
            "ipAddress": "49.37.202.70",
            "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36",
            "displayName": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 - 49.37.202.70",
            "browser": "Chrome",
            "platform": "macOS",
            "additionalInfo": {}
        },
        "event": {
            "eventType": "application.update.properties",
            "displayName": "Update Application Properties",
            "additionalInfo": {}
        },
        "target": {
            "targetId": "habx7m08n6snhqi0jaon",
            "applicationName": "AWS-FernandoHallautotestIGeOxxyzm",
            "environmentName": null,
            "environmentGroupName": null,
            "parentEnvironmentGroupName": null,
            "displayName": "AWS-FernandoHallautotestIGeOxxyzm",
            "applicationSessionId": null,
            "additionalInfo": {
                "accountId": "378563640942",
                "appAccessMethod": "samlMethod"
            }
        },
        "result": {
            "success": true,
            "message": null
        },
        "tenantId": "qa1"
    },
    {
        "timestamp": "2020-10-02T05:45:09.793+0000",
        "id": "",
        "actor": {
            "userId": "VMFakVdMKOlO4c9YH6mb",
            "displayName": "Bob Smith",
            "type": "User",
            "role": "TenantAdmin",
            "username": "bobsmith",
            "credential": {
                "name": "VMFakVdMKOlO4c9YH6mb",
                "type": "Bearer"
            }
        },
        "client": {
            "device": "Desktop",
            "ipAddress": "49.37.202.70",
            "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36",
            "displayName": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 - 49.37.202.70",
            "browser": "Chrome",
            "platform": "macOS",
            "additionalInfo": {}
        },
        "event": {
            "eventType": "application.update.properties",
            "displayName": "Update Application Properties",
            "additionalInfo": {}
        },
        "target": {
            "targetId": "habx7m08n6snhqi0jaon",
            "applicationName": "AWS-FernandoHallautotestIGeOxxyzm",
            "environmentName": null,
            "environmentGroupName": null,
            "parentEnvironmentGroupName": null,
            "displayName": "AWS-FernandoHallautotestIGeOxxyzm",
            "applicationSessionId": null,
            "additionalInfo": {
                "appAccessMethod": "samlMethod"
            }
        },
        "result": {
            "success": true,
            "message": null
        },
        "tenantId": "qa1"
    },
    {
        "timestamp": "2020-10-02T05:44:19.981+0000",
        "id": "",
        "actor": {
            "userId": "VMFakVdMKOlO4c9YH6mb",
            "displayName": "Bob Smith",
            "type": "User",
            "role": "TenantAdmin",
            "username": "bobsmith",
            "credential": {
                "name": "VMFakVdMKOlO4c9YH6mb",
                "type": "Bearer"
            }
        },
        "client": {
            "device": "Desktop",
            "ipAddress": "49.37.202.70",
            "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36",
            "displayName": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 - 49.37.202.70",
            "browser": "Chrome",
            "platform": "macOS",
            "additionalInfo": {}
        },
        "event": {
            "eventType": "application.update.properties",
            "displayName": "Update Application Properties",
            "additionalInfo": {}
        },
        "target": {
            "targetId": "habx7m08n6snhqi0jaon",
            "applicationName": "AWS-FernandoHallautotestIGeOxxyzm",
            "environmentName": null,
            "environmentGroupName": null,
            "parentEnvironmentGroupName": null,
            "displayName": "AWS-FernandoHallautotestIGeOxxyzm",
            "applicationSessionId": null,
            "additionalInfo": {
                "appAccessMethod": "samlMethod",
                "description": "AWS app description"
            }
        },
        "result": {
            "success": true,
            "message": null
        },
        "tenantId": "qa1"
    },
    {
        "timestamp": "2020-10-02T05:44:18.515+0000",
        "id": "",
        "actor": {
            "userId": "VMFakVdMKOlO4c9YH6mb",
            "displayName": "Bob Smith",
            "type": "User",
            "role": "TenantAdmin",
            "username": "bobsmith",
            "credential": {
                "name": "VMFakVdMKOlO4c9YH6mb",
                "type": "Bearer"
            }
        },
        "client": {
            "device": "Desktop",
            "ipAddress": "49.37.202.70",
            "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36",
            "displayName": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 - 49.37.202.70",
            "browser": "Chrome",
            "platform": "macOS",
            "additionalInfo": {}
        },
        "event": {
            "eventType": "application.add",
            "displayName": "Add Application",
            "additionalInfo": {}
        },
        "target": {
            "targetId": "habx7m08n6snhqi0jaon",
            "applicationName": "AWS-FernandoHallautotestIGeOxxyzm",
            "environmentName": null,
            "environmentGroupName": null,
            "parentEnvironmentGroupName": null,
            "displayName": "AWS-FernandoHallautotestIGeOxxyzm",
            "applicationSessionId": null,
            "additionalInfo": {}
        },
        "result": {
            "success": true,
            "message": null
        },
        "tenantId": "qa1"
    },
    {
        "timestamp": "2020-10-02T05:37:35.663+0000",
        "id": "",
        "actor": {
            "userId": "VMFakVdMKOlO4c9YH6mb",
            "displayName": "Bob Smith",
            "type": "User",
            "role": "TenantAdmin",
            "username": "bobsmith",
            "credential": {
                "name": "qa1automation",
                "type": "ApiToken"
            }
        },
        "client": {
            "device": "Unknown",
            "ipAddress": "49.37.202.70",
            "userAgent": "python-requests/2.23.0",
            "displayName": "python-requests/2.23.0 - 49.37.202.70",
            "browser": "python-requests",
            "platform": "Unknown",
            "additionalInfo": {}
        },
        "event": {
            "eventType": "application.delete",
            "displayName": "Delete Application",
            "additionalInfo": {}
        },
        "target": {
            "targetId": "9db01lu57rh8a9qw1la7",
            "applicationName": "AWS-MarcoValdezautotestWYqTmnsfi",
            "environmentName": null,
            "environmentGroupName": null,
            "parentEnvironmentGroupName": null,
            "displayName": "AWS-MarcoValdezautotestWYqTmnsfi",
            "applicationSessionId": null,
            "additionalInfo": {}
        },
        "result": {
            "success": true,
            "message": null
        },
        "tenantId": "qa1"
    },
    {
        "timestamp": "2020-10-02T05:37:14.976+0000",
        "id": "",
        "actor": {
            "userId": "VMFakVdMKOlO4c9YH6mb",
            "displayName": "Bob Smith",
            "type": "User",
            "role": "TenantAdmin",
            "username": "bobsmith",
            "credential": {
                "name": "VMFakVdMKOlO4c9YH6mb",
                "type": "Bearer"
            }
        },
        "client": {
            "device": "Desktop",
            "ipAddress": "49.37.202.70",
            "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36",
            "displayName": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 - 49.37.202.70",
            "browser": "Chrome",
            "platform": "macOS",
            "additionalInfo": {}
        },
        "event": {
            "eventType": "application.update.enable",
            "displayName": "Enable Application",
            "additionalInfo": {}
        },
        "target": {
            "targetId": "9db01lu57rh8a9qw1la7",
            "applicationName": "AWS-MarcoValdezautotestWYqTmnsfi",
            "environmentName": null,
            "environmentGroupName": null,
            "parentEnvironmentGroupName": null,
            "displayName": "AWS-MarcoValdezautotestWYqTmnsfi",
            "applicationSessionId": null,
            "additionalInfo": {}
        },
        "result": {
            "success": true,
            "message": null
        },
        "tenantId": "qa1"
    },
    {
        "timestamp": "2020-10-02T05:36:55.447+0000",
        "id": "",
        "actor": {
            "userId": "VMFakVdMKOlO4c9YH6mb",
            "displayName": "Bob Smith",
            "type": "User",
            "role": "TenantAdmin",
            "username": "bobsmith",
            "credential": {
                "name": "VMFakVdMKOlO4c9YH6mb",
                "type": "Bearer"
            }
        },
        "client": {
            "device": "Desktop",
            "ipAddress": "49.37.202.70",
            "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36",
            "displayName": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 - 49.37.202.70",
            "browser": "Chrome",
            "platform": "macOS",
            "additionalInfo": {}
        },
        "event": {
            "eventType": "application.update.disable",
            "displayName": "Disable Application",
            "additionalInfo": {}
        },
        "target": {
            "targetId": "9db01lu57rh8a9qw1la7",
            "applicationName": "AWS-MarcoValdezautotestWYqTmnsfi",
            "environmentName": null,
            "environmentGroupName": null,
            "parentEnvironmentGroupName": null,
            "displayName": "AWS-MarcoValdezautotestWYqTmnsfi",
            "applicationSessionId": null,
            "additionalInfo": {}
        },
        "result": {
            "success": true,
            "message": null
        },
        "tenantId": "qa1"
    },
    {
        "timestamp": "2020-10-02T05:36:19.897+0000",
        "id": "",
        "actor": {
            "userId": "VMFakVdMKOlO4c9YH6mb",
            "displayName": "Bob Smith",
            "type": "User",
            "role": "TenantAdmin",
            "username": "bobsmith",
            "credential": {
                "name": "VMFakVdMKOlO4c9YH6mb",
                "type": "Bearer"
            }
        },
        "client": {
            "device": "Desktop",
            "ipAddress": "49.37.202.70",
            "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36",
            "displayName": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 - 49.37.202.70",
            "browser": "Chrome",
            "platform": "macOS",
            "additionalInfo": {}
        },
        "event": {
            "eventType": "application.scan",
            "displayName": "Scan Application",
            "additionalInfo": {}
        },
        "target": {
            "targetId": "9db01lu57rh8a9qw1la7",
            "applicationName": "AWS-MarcoValdezautotestWYqTmnsfi",
            "environmentName": null,
            "environmentGroupName": null,
            "parentEnvironmentGroupName": null,
            "displayName": "AWS-MarcoValdezautotestWYqTmnsfi",
            "applicationSessionId": null,
            "additionalInfo": {}
        },
        "result": {
            "success": true,
            "message": null
        },
        "tenantId": "qa1"
    },
    {
        "timestamp": "2020-10-02T05:36:04.983+0000",
        "id": "",
        "actor": {
            "userId": "VMFakVdMKOlO4c9YH6mb",
            "displayName": "Bob Smith",
            "type": "User",
            "role": "TenantAdmin",
            "username": "bobsmith",
            "credential": {
                "name": "VMFakVdMKOlO4c9YH6mb",
                "type": "Bearer"
            }
        },
        "client": {
            "device": "Desktop",
            "ipAddress": "49.37.202.70",
            "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36",
            "displayName": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 - 49.37.202.70",
            "browser": "Chrome",
            "platform": "macOS",
            "additionalInfo": {}
        },
        "event": {
            "eventType": "application.update.properties",
            "displayName": "Update Application Properties",
            "additionalInfo": {}
        },
        "target": {
            "targetId": "9db01lu57rh8a9qw1la7",
            "applicationName": "AWS-MarcoValdezautotestWYqTmnsfi",
            "environmentName": null,
            "environmentGroupName": null,
            "parentEnvironmentGroupName": null,
            "displayName": "AWS-MarcoValdezautotestWYqTmnsfi",
            "applicationSessionId": null,
            "additionalInfo": {
                "accountId": "378563640942",
                "appAccessMethod": "samlMethod"
            }
        },
        "result": {
            "success": true,
            "message": null
        },
        "tenantId": "qa1"
    },
    {
        "timestamp": "2020-10-02T05:35:47.802+0000",
        "id": "",
        "actor": {
            "userId": "VMFakVdMKOlO4c9YH6mb",
            "displayName": "Bob Smith",
            "type": "User",
            "role": "TenantAdmin",
            "username": "bobsmith",
            "credential": {
                "name": "VMFakVdMKOlO4c9YH6mb",
                "type": "Bearer"
            }
        },
        "client": {
            "device": "Desktop",
            "ipAddress": "49.37.202.70",
            "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36",
            "displayName": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 - 49.37.202.70",
            "browser": "Chrome",
            "platform": "macOS",
            "additionalInfo": {}
        },
        "event": {
            "eventType": "application.update.properties",
            "displayName": "Update Application Properties",
            "additionalInfo": {}
        },
        "target": {
            "targetId": "9db01lu57rh8a9qw1la7",
            "applicationName": "AWS-MarcoValdezautotestWYqTmnsfi",
            "environmentName": null,
            "environmentGroupName": null,
            "parentEnvironmentGroupName": null,
            "displayName": "AWS-MarcoValdezautotestWYqTmnsfi",
            "applicationSessionId": null,
            "additionalInfo": {
                "accountId": "378563640942",
                "appAccessMethod": "samlMethod"
            }
        },
        "result": {
            "success": true,
            "message": null
        },
        "tenantId": "qa1"
    },
    {
        "timestamp": "2020-10-02T05:35:42.504+0000",
        "id": "",
        "actor": {
            "userId": "VMFakVdMKOlO4c9YH6mb",
            "displayName": "Bob Smith",
            "type": "User",
            "role": "TenantAdmin",
            "username": "bobsmith",
            "credential": {
                "name": "VMFakVdMKOlO4c9YH6mb",
                "type": "Bearer"
            }
        },
        "client": {
            "device": "Desktop",
            "ipAddress": "49.37.202.70",
            "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36",
            "displayName": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 - 49.37.202.70",
            "browser": "Chrome",
            "platform": "macOS",
            "additionalInfo": {}
        },
        "event": {
            "eventType": "application.update.properties",
            "displayName": "Update Application Properties",
            "additionalInfo": {}
        },
        "target": {
            "targetId": "9db01lu57rh8a9qw1la7",
            "applicationName": "AWS-MarcoValdezautotestWYqTmnsfi",
            "environmentName": null,
            "environmentGroupName": null,
            "parentEnvironmentGroupName": null,
            "displayName": "AWS-MarcoValdezautotestWYqTmnsfi",
            "applicationSessionId": null,
            "additionalInfo": {
                "appAccessMethod": "samlMethod"
            }
        },
        "result": {
            "success": true,
            "message": null
        },
        "tenantId": "qa1"
    },
    {
        "timestamp": "2020-10-02T05:34:50.037+0000",
        "id": "",
        "actor": {
            "userId": "VMFakVdMKOlO4c9YH6mb",
            "displayName": "Bob Smith",
            "type": "User",
            "role": "TenantAdmin",
            "username": "bobsmith",
            "credential": {
                "name": "VMFakVdMKOlO4c9YH6mb",
                "type": "Bearer"
            }
        },
        "client": {
            "device": "Desktop",
            "ipAddress": "49.37.202.70",
            "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36",
            "displayName": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 - 49.37.202.70",
            "browser": "Chrome",
            "platform": "macOS",
            "additionalInfo": {}
        },
        "event": {
            "eventType": "application.update.properties",
            "displayName": "Update Application Properties",
            "additionalInfo": {}
        },
        "target": {
            "targetId": "9db01lu57rh8a9qw1la7",
            "applicationName": "AWS-MarcoValdezautotestWYqTmnsfi",
            "environmentName": null,
            "environmentGroupName": null,
            "parentEnvironmentGroupName": null,
            "displayName": "AWS-MarcoValdezautotestWYqTmnsfi",
            "applicationSessionId": null,
            "additionalInfo": {
                "appAccessMethod": "samlMethod",
                "description": "AWS app description"
            }
        },
        "result": {
            "success": true,
            "message": null
        },
        "tenantId": "qa1"
    },
    {
        "timestamp": "2020-10-02T05:34:48.415+0000",
        "id": "",
        "actor": {
            "userId": "VMFakVdMKOlO4c9YH6mb",
            "displayName": "Bob Smith",
            "type": "User",
            "role": "TenantAdmin",
            "username": "bobsmith",
            "credential": {
                "name": "VMFakVdMKOlO4c9YH6mb",
                "type": "Bearer"
            }
        },
        "client": {
            "device": "Desktop",
            "ipAddress": "49.37.202.70",
            "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36",
            "displayName": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 - 49.37.202.70",
            "browser": "Chrome",
            "platform": "macOS",
            "additionalInfo": {}
        },
        "event": {
            "eventType": "application.add",
            "displayName": "Add Application",
            "additionalInfo": {}
        },
        "target": {
            "targetId": "9db01lu57rh8a9qw1la7",
            "applicationName": "AWS-MarcoValdezautotestWYqTmnsfi",
            "environmentName": null,
            "environmentGroupName": null,
            "parentEnvironmentGroupName": null,
            "displayName": "AWS-MarcoValdezautotestWYqTmnsfi",
            "applicationSessionId": null,
            "additionalInfo": {}
        },
        "result": {
            "success": true,
            "message": null
        },
        "tenantId": "qa1"
    }
]

Was this article helpful?

What's Next

Manage Reports

Table of contents

1. List of Fields
2. List of Operators
3. Query Audit Logs
4. Download Query Results
Query Audit Logs Advanced Example