RSA Product Set: SecurID Access
For troubleshooting purposes it can be useful to see a history of administrative actions performed on your Cloud Administration Console (CAC).
This information is not currently captured in the Administration Console itself.
The Cloud Administration APIs
are REST-based web service interfaces. The Cloud Administration Event Log API
can be used by third-party SIEM tools that support a REST API to fetch administration audit events.
The Cloud Administration APIs come with a Command Line Utility (CLU) tool that is useful for adhoc retrieval of event logs without a third-party tool.
This article explains how to use the CLU tool to retrieve Administration Event audit logs
. Article Download RSA SecurID Access Cloud User Event audit logs using Cloud Administration REST API CLU
explains how to use the same tool to retrieve User Event audit logs
Administrative activity can be obtained by using the Cloud Administration REST APIs. Here are the basic steps to download the last 24 hours
of Admin Console actions using the API package's CLU. Section Specifying Time Period
below shows how to download events from other times:
- Download the RSA SecurID Access Administration REST API package to any Windows or Linux machine that has Java installed and network connectivity to your Cloud Administration Console.
- Unzip the downloaded package file to a convenient directory location.
- From the Cloud Administration Console Add an API key and download the key file to the machine where you unzipped the Administration REST API.
- From the top level directory of the unzipped API package run the CLU shown below (note that the example syntax is for Windows):
.\bin\rsa-securidaccess-rest-client-sdk.bat -f <path to API key file> -o exportAllAdminLog -u https://<CAC FQDN>/AdminInterface/restapi/v1
<path to API key file>
is the downloaded API key file. If there are spaces in the path, the path must be surrounded in double quotes (see examples in section Specifying Time Period
should be substituted with the fully-qualified domain name of your Cloud Administration Console:
- Americas customers use <company subdomain>.access.securid.com
- EMEA customers use <company subdomain>.access-eu.securid.com.
- APJ customers use: <company subdomain>.access-anz.securid.com.
- India customers use: <company subdomain>.access-in.securid.com.
The file exportAllAdminLog.csv will be written to the current working directory.
By default, the command reports on the last 24-hour period. Alternatively, a specific time period of interest can be specified with the additional command line switches -s (start time period) and/or -e (end time period).
Date and time must be specified in ISO 8601 Date Time format: yyyy-mm-ddThh:mm:ss.tttShh:mm
is milliseconds and Shh:mm
is the UTC offset where S
must be -
(dash or minus sign) for a negative offset or + (plus sign) for a positive offset. All components of the date and time must be specified, including seconds, milliseconds and UTC offset.
Negative UTC offset Example
This example uses UTC -0800.
.\bin\rsa-securidaccess-rest-client-sdk.bat -f 5c221bc1-a69e-4a78-8d2f-c0646ba4d91d.key -o exportAllAdminLog -u https://mysubdomain.access.securid.com/AdminInterface/restapi/v1 -s 2021-07-01T11:22:12.828-08:00 -e 2021-07-30T11:22:12.828-08:00
Positive UTC Offset Example
This example uses UTC +1000.
.\bin\rsa-securidaccess-rest-client-sdk.bat -f "c:\temp\RSA API\5c221bc1-a69e-4a78-8d2f-c0646ba4d91d.key" -o exportAllAdminLog -u https://mysubdomain.access-anz.securid.com/AdminInterface/restapi/v1 -s 2021-09-30T09:15:00.000+10:00 -e 2021-10-31T23:59:59.999+10:00
This example uses UTC.
.\bin\rsa-securidaccess-rest-client-sdk.bat -f "c:\temp\RSA API\ea9e8e60-cde6-425c-8161-af967a157927.key" -o exportAllAdminLog -u https://mysubdomain.access-eu.securid.com/AdminInterface/restapi/v1 -s 2021-09-30T09:15:00.000Z -e 2021-10-31T23:59:59.999Z
- The rsa-securidaccess-rest-client.sdk CLU requires Java to be installed on the computer where it will be run.
- JAVA_HOME must be set (JAVA_HOME is an environment variable that indicates where in the file system the JDK or JRE is installed, e.g. C:\Program Files (x86)\Java\jre1.8.0_333).
- These instructions assume the Windows PATH environment variable has been updated to include the Java bin directory/folder, e.g. on Windows, that would be %JAVA_HOME%\bin.
- Run the rsa-securidaccess-rest-client.sdk CLU with no switches to see all of the available command options:
- Some versions of the rsa-securidaccess-rest-client.sdk CLU, up to and including v2.7.1, do not support Positive UTC time offsets for the -s and -e options. Upgrade to v2.7.2 or later to fix the issue. Or, as a workaround, specify times in UTC (see "UTC Example" above).