Описание: Список данных аудита, отсортированных по дате и времени зарегистрированного действия пользователя.
Метод: GET
Ресурс: audit
Параметры:
filter - список фильтрации:CHANGE_DATE[>] – дата и время начала зарегистрированного действия пользователя в формате UNIX-timestamp и через точку microtime, например filter[CHANGE_DATE][>]=1591368000.123456CHANGE_DATE[<] – дата и время окончания зарегистрированного действия пользователя в формате UNIX-timestamp и через точку microtime, например filter[CHANGE_DATE][<]=1591368000.123456CHANGE_DATE[>=] – дата и время начала зарегистрированного действия пользователя в формате UNIX-timestamp и через точку microtime, например filter[CHANGE_DATE][>=]=1591368000.123456 CHANGE_DATE[<=] – дата и время окончания зарегистрированного действия пользователя в формате UNIX-timestamp и через точку microtime, например filter[CHANGE_DATE][<=]=1591368000.123456ENTITY_TYPE[] – тип сущности, над которой было выполнено действие (возможно несколько значений);without[] – sort[] – параметр для сортировки:change_date — сортировать по дате изменения asc.start – с какой позиции начать отдавать данные аудита (по умолчанию 0)limit – сколько комплектов данных аудита отдавать (по умолчанию 100, не может быть больше 1000)schemas:
auditCommon:
type: object
additionalProperties: false
required: [AUDIT_LOG_ID, USER_ID, CHANGE_DATE, OPERATION, ENTITY_TYPE, ENTITY_ID, ENTITY_DISPLAY_NAME]
properties: &common
AUDIT_LOG_ID:
type: integer
description: Audit log id
USER_ID:
type: integer
nullable: true
description: |
User id who performed the action (See /xapi/user).
USER_ID may be null on login or if changes make by plugin.
CHANGER_NAME:
type: string
nullable: true
description: |
User name or Plugin name who performed the action.
May be null on login.
CHANGE_DATE:
type: string
description: Date and time of the registered user action with format "Y-m-d H:i:s.u" in UTC
example: "2020-05-14 13:53:52.926560"
OPERATION:
type: string
description: Operation type over which the action was performed. There may be values not from the enum.
enum:
- run
- canceled
- start
- stop
- restart
- view
- create
- update
- change
- delete
- delete_ref
- delete_hash
- copy
- move
- login_failure
- login
- logout
- change_password
- commit
- rollback
- draft
- add
- import
- export
- export_object
- download
- sync
- decision_update
- add_tag
- remove_tag
- add_role
- remove_role
- add_visibility_area
- remove_visibility_area
- logging
- apply_inbound
- xapi_decision_update
- start_scan_job
- apply_result_scan_job
- update_job_schedule
- create_log
- plugin_register
- plugin_update
- privileges_update
- privileges_create
- notification
- notification_template
- notification_test
ENTITY_TYPE:
type: string
description: Entity type over which the action was performed. There may be values not from the enum.
enum: *entryTypes
ENTITY_ID:
type: string
nullable: true
description: |
ID of the entity which the action was performed. May be GUID or integer as string
May by null for:
| OPERATION | ENTITY_TYPE |
| :--- | :--- |
| commit | Config |
| run | QueryReportRun |
| sync | Adlibitum |
| login | User |
| rollback | Config |
example: "DBAF4F834F7647CBB297BC9DD17B77B100000000"
ENTITY_DISPLAY_NAME:
type: string
nullable: true
description: The name of the entity over which the action was carried out
example: "Some name"
PROPERTY_CHANGES:
type: object
nullable: true
description: Null in default Audit log events
userLoginLogout:
type: object
description: For ENTITY_TYPE User and OPERATION login or logout
properties:
<<: *common
OPERATION:
type: string
enum: [login, logout]
ENTITY_TYPE:
type: string
enum: [User]
PROPERTY_CHANGES:
type: object
required: [request]
properties:
request:
required:
- hostname
- ip
- result
- login
properties:
hostname:
type: string
title: Hostname
description: Hostname from which authorization passed
ip:
type: string
title: Ip address
description: Ip address from which authorization passed
result:
type: string
title: Result
description: Result
enum:
- login_failure
- login
- logout
login:
type: string
title: User login
description: Entered user login in input
policyPropertyChanges:
type: object
description: For ENTITY_TYPE Policy
nullable: true
properties:
<<: *common
ENTITY_TYPE:
type: string
enum: [Policy]
PROPERTY_CHANGES:
type: object
|
Пример:
curl -X GET "https://qa-2944.infowatch.ru/xapi/audit?sort[CHANGE_DATE]=asc&filter[ENTITY_TYPE][]=Adlibitum&filter[ENTITY_TYPE][]=Audit&filter[ENTITY_TYPE][]=Config&filter[ENTITY_TYPE][]=Perimeter&filter[ENTITY_TYPE][]=Policy&start=0&limit=5" -H "accept: application/json" -H "X-Enable-OpenAPI: 1" |
{
"data": [
{
"AUDIT_LOG_ID": 0,
"USER_ID": 0,
"CHANGER_NAME": "string",
"CHANGE_DATE": "2020-05-14 13:53:52.926560",
"OPERATION": "run",
"ENTITY_TYPE": "Adlibitum",
"ENTITY_ID": "DBAF4F834F7647CBB297BC9DD17B77B100000000",
"ENTITY_DISPLAY_NAME": "Some name",
"PROPERTY_CHANGES": {}
},
{
"AUDIT_LOG_ID": 0,
"USER_ID": 0,
"CHANGER_NAME": "string",
"CHANGE_DATE": "2020-05-14 13:53:52.926560",
"OPERATION": "login",
"ENTITY_TYPE": "User",
"ENTITY_ID": "DBAF4F834F7647CBB297BC9DD17B77B100000000",
"ENTITY_DISPLAY_NAME": "Some name",
"PROPERTY_CHANGES": {
"request": {
"hostname": "string",
"ip": "string",
"result": "login_failure",
"login": "string"
}
}
},
{
"AUDIT_LOG_ID": 0,
"USER_ID": 0,
"CHANGER_NAME": "string",
"CHANGE_DATE": "2020-05-14 13:53:52.926560",
"OPERATION": "run",
"ENTITY_TYPE": "Policy",
"ENTITY_ID": "DBAF4F834F7647CBB297BC9DD17B77B100000000",
"ENTITY_DISPLAY_NAME": "Some name",
"PROPERTY_CHANGES": {
"old": {
"DISPLAY_NAME": "string",
"NOTE": "string",
"STATUS": 0,
"START_DATE": "string",
"END_DATE": "string",
"DATA": {
"ITEMS": [
{
"TYPE": "catalog",
"ID": "string",
"NAME": "string"
},
{
"TYPE": "fileformat",
"ID": "string",
"NAME": "string",
"MIME_TYPE": "string",
"ENCRYPTED": 0,
"MERGED": 0,
"MAX": 0,
"MIN": 0,
"MAX_TYPE": 0,
"MIN_TYPE": 0
}
]
}
},
"new": {
"DISPLAY_NAME": "string",
"NOTE": "string",
"STATUS": 0,
"START_DATE": "string",
"END_DATE": "string",
"DATA": {
"ITEMS": [
{
"TYPE": "catalog",
"ID": "string",
"NAME": "string"
},
{
"TYPE": "fileformat",
"ID": "string",
"NAME": "string",
"MIME_TYPE": "string",
"ENCRYPTED": 0,
"MERGED": 0,
"MAX": 0,
"MIN": 0,
"MAX_TYPE": 0,
"MIN_TYPE": 0
}
]
}
},
"rule": {
"ENTITY_TYPE": "PolicyRule",
"ENTITY_ID": "string",
"ENTITY_DISPLAY_NAME": "string"
}
}
}
],
"meta": {
"totalCount": 0,
"start": 0,
"limit": 0
}
} |