audits_agents_reports
Retrieve agent event reports and audit logs from Cortex XSIAM with filtering, sorting, and pagination to investigate endpoint activities.
Instructions
Get Audit Agent Report
Get agent event reports.
Response is concatenated using AND condition (OR is not supported).
Maximum result set size is 100.
Offset is the zero-based number of incidents from the start of the result set.
Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus
[POST /public_api/v1/audits/agents_reports] · Audit log
Example request body:
{
"request_data": {
"filters": [
{
"field": "trapsversion",
"operator": "in",
"value": [
"<version value>",
"<version value>"
]
},
{
"field": "timestamp",
"operator": "gte",
"value": 0
},
{
"field": "domain",
"operator": "in",
"value": [
"WORKGROUP"
]
}
],
"sort": {
"field": "timestamp",
"keyword": "asc"
}
}
}Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| request_data | No | A dictionary containing the API request fields. An empty dictionary returns all results. |