Cloud Administration User Event Log API

The Cloud Administration User Event Log API is a REST-based web services interface that allows user events to be retrieved from Cloud Access Service (CAS). Customers can use this REST API to import the user event logs into their security information and event management (SIEM) solution, such as NetWitness or write your own custom Administration Event Log API client software, or use RSA's Java rsa-securidaccess-rest-client-sdk or Python admin_api_cli command line utility to download events to a file. The utilities are part of the RSA SecurID Access Administration REST API which can be downloaded from the RSA ID Plus Downloads page (RSA Community login is required). Event logs are retrieved in chronological order in batches, and do not contain duplicates. Events are retained for 40 days in CAS and then purged, so events from the last 40 days are available for download using this API.

The API client, uses a JSON Web Token (JWT) with HTTP Bearer Authentication when calling the User Event Log API. The Super Admin creates a key in the Cloud Administration Console, then the key plus any other information required is used to generate the JWT, as described in Authentication for the Cloud Administration APIs .

For information on audit log messages that describe user activities, see User Event Monitor Messages in the Cloud Administration Console. For information on downloading audit log messages that describe Helpdesk Administrator and Super Administrator activities, see Cloud Administration Event Log API .

For information about managing access to this API, see Accessing the Cloud Administration APIs

Authentication

Clients calling this API must authenticate themselves by including a JSON Web Token in a request. For instructions on using this token, see Authentication for the Cloud Administration APIs.

Software Developer Kit

You can download the API Software Developer Kit (SDK) as the RSA SecurID Access Administration REST API. It is available from the RSA ID Plus Downloads page (RSA Community login is required).

Request Requirements

Use the following information in requests to retrieve user events from CAS and deliver them to your API client.

Request Parameters

The User Event Log REST API allows the following parameters.

Note:  The request query parameter values may contain reserve characters that need to be URL encoded. Otherwise, the server may send a 400 Bad Request error. For example, the ISO 8601 Date and Time format may contain the + character if the specific time zone has an offset from UTC, such as+05:30. The + character needs to be encoded as %2B.

Example Request with No Parameters

The following example returns log data for the previous 24 hours.

GET /AdminInterface/restapi/v1/usereventlog/exportlogs

Accept: application/json

Authorization: Bearer <bearer token>

Example Request with Start Time Specified

The following example shows an API request with a specified start time.

GET /AdminInterface/restapi/v1/usereventlog/exportlogs?startTimeAfter=2018-05-01T11:22:12.828-05:30

Accept: application/json

Authorization: Bearer <bearer token>

Response Body

The following table shows the name, description, and type used for API response metadata.

The following sample response metadata displays 684 results with a page size of 100.

{

"totalPages":7,

"totalElements":684,

"pageSize":100,

"currentPage":0,

"userEventLogExportEntries":

userEventLogExportEntries

The following table shows the elements of entries in the userEventLogExportEntries array.