Skip to content

Audit Log

class _incydr_sdk.audit_log.client.AuditLogV1(parent)

Client for /v1/audit endpoints.

Usage example:

>>> import incydr
>>> client = incydr.Client(**kwargs)
>>> client.audit_log.v1.get_page()
download_events(self, target_folder, actor_ids=None, actor_ip_addresses=None, actor_names=None, start_time=None, end_time=None, event_types=None, resource_ids=None, user_types=None)

Export search results.

Parameters:

  • target_folder: Path, str (required) - A string or pathlib.Path object that represents the folder which the file will be saved to.
  • actor_ids: List[str] | str - Finds events whose actor_id is one of the given ids.
  • actor_ip_addresses: List[str] | str - Finds events whose actor_ip_address is one of the given IP addresses.
  • actor_names: List[str] | str - Finds events whose actor_name is one of the given names.
  • start_time: datetime | str - Search for events within a date range. Start time for this date range.
  • end_time: datetime | str - Search for events within a date range. End time for this date range.
  • event_types: List[str] | str - Finds events whose type is one of the given types.
  • resource_ids: List[str] | str - Filters searchable events that match resource_id.
  • user_types: List[UserTypes] - Filters searchable events that match actor type.

Returns: A pathlib.Path object representing location of the downloaded csv file.

get_event_count(self, page_num=0, page_size=None, actor_ids=None, actor_ip_addresses=None, actor_names=None, start_time=None, end_time=None, event_types=None, resource_ids=None, user_types=None)

Get the total result count of a search.

Parameters:

  • page_num: int - Page number for results, starting at 0.
  • page_size: int - Max number of results to return per page.
  • actor_ids: List[str] | str - Finds events whose actor_id is one of the given ids.
  • actor_ip_addresses: List[str] | str - Finds events whose actor_ip_address is one of the given IP addresses.
  • actor_names: List[str] | str - Finds events whose actor_name is one of the given names.
  • start_time: datetime | str - Search for events within a date range. Start time for this date range.
  • end_time: datetime | str - Search for events within a date range. End time for this date range.
  • event_types: List[str] | str - Finds events whose type is one of the given types.
  • resource_ids: List[str] | str - Filters searchable events that match resource_id.
  • user_types: List[UserTypes] - Filters searchable events that match actor type.

Returns: An int indicating the number of resulting audit log events from search.

get_page(self, page_num=0, page_size=None, actor_ids=None, actor_ip_addresses=None, actor_names=None, start_time=None, end_time=None, event_types=None, resource_ids=None, user_types=None)

Search audit log entries.

Parameters:

  • page_num: int - page_num number for results, starting at 1.
  • page_size: int - Max number of results to return per page. Defaults to client's page_size setting. Maximum page size is 10,000.
  • actor_ids: List[str] | str - Finds events whose actor_id is one of the given ids.
  • actor_ip_addresses: List[str] | str - Finds events whose actor_ip_address is one of the given IP addresses.
  • actor_names: List[str] | str - Finds events whose actor_name is one of the given names.
  • start_time: datetime | str - Search for events within a date range. Start time for this date range.
  • end_time: datetime | str - Search for events within a date range. End time for this date range.
  • event_types: List[str] | str - Finds events whose type is one of the given types.
  • resource_ids: List[str] | str - Filters searchable events that match resource_id.
  • user_types: List[UserTypes] - Filters searchable events that match actor type.

Returns: A AuditEventsPage object representing the search response.

iter_all(self, page_size=None, actor_ids=None, actor_ip_addresses=None, actor_names=None, start_time=None, end_time=None, event_types=None, resource_ids=None, user_types=None)

Iterate over all audit log events.

Accepts the same parameters as .get_page() except page_num.

Returns: A generator yielding individual dict objects representing audit log events.