Download RSA SecurID Access Cloud Administration audit logs using Cloud Administration REST API CLU

[#1]

Article Number

000064470

Applies To

RSA Product Set:  SecurID Access

Issue

For troubleshooting purposes it can be useful to see a history of administrative actions performed on your Cloud Administration Console (CAC).
This information is not currently captured in the Administration Console itself.
The Cloud Administration APIs are REST-based web service interfaces.  The Cloud Administration Event Log API can be used by third-party SIEM tools that support a REST API to fetch administration audit events.
The Cloud Administration APIs come with a Command Line Utility (CLU) tool that is useful for adhoc retrieval of event logs without a third-party tool.
This article explains how to use the CLU tool to retrieve Administration Event audit logs .   Article Download RSA SecurID Access Cloud User Event audit logs using Cloud Administration REST API CLU  explains how to use the same tool to retrieve User Event audit logs .
 
 

Resolution

Administrative activity can be obtained by using the Cloud Administration REST APIs.  Here are the basic steps to download the last 24 hours of Admin Console actions using the API package's CLU.  Section Specifying Time Period below shows how to download events from other times:

1. Download the RSA SecurID Access Administration REST API package to any Windows or Linux machine that has Java installed and network connectivity to your Cloud Administration Console.
2. Unzip the downloaded package file to a convenient directory location.
3. From the Cloud Administration Console Add an API key and download the key file to the machine where you unzipped the Administration REST API.
4. From the top level directory of the unzipped API package run the CLU shown below (note that the example syntax is for Windows):

.\bin\rsa-securidaccess-rest-client-sdk.bat -f <path to API key file> -o exportAllAdminLog -u https://<CAC FQDN>/AdminInterface/restapi/v1

Where:

<path to API key file> is the downloaded API key file.  If there are spaces in the path, the path must be surrounded in double quotes (see examples in section Specifying Time Period below).
<CAC FQDN> should be substituted with the fully-qualified domain name of your Cloud Administration Console: 

• Americas customers use <company subdomain>.access.securid.com
• EMEA customers use <company subdomain>.access-eu.securid.com.
• APJ customers use: <company subdomain>.access-anz.securid.com.
• India customers use:  <company subdomain>.access-in.securid.com.

The file exportAllAdminLog.csv will be written to the current working directory.
 

Specifying Time Period

By default, the command reports on the last 24-hour period.  Alternatively, a specific time period of interest can be specified with the additional command line switches -s (start time period) and/or -e (end time period). 

Date and time must be specified in ISO 8601 Date Time format:   yyyy-mm-ddThh:mm:ss.tttShh:mm  where ttt is milliseconds and Shh:mm is the UTC offset where S must be - (dash or minus sign) for a negative offset or + (plus sign) for a positive offset.  All components of the date and time must be specified, including seconds, milliseconds and UTC offset.

Negative UTC offset Example

This example uses UTC -0800.

.\bin\rsa-securidaccess-rest-client-sdk.bat -f 5c221bc1-a69e-4a78-8d2f-c0646ba4d91d.key -o exportAllAdminLog -u https://mysubdomain.access.securid.com/AdminInterface/restapi/v1 -s 2021-07-01T11:22:12.828-08:00 -e 2021-07-30T11:22:12.828-08:00​​​​

Positive UTC Offset Example

This example uses UTC +1000.

.\bin\rsa-securidaccess-rest-client-sdk.bat -f "c:\temp\RSA API\5c221bc1-a69e-4a78-8d2f-c0646ba4d91d.key" -o exportAllAdminLog -u https://mysubdomain.access-anz.securid.com/AdminInterface/restapi/v1 -s 2021-09-30T09:15:00.000+10:00 -e 2021-10-31T23:59:59.999+10:00

UTC Example

This example uses UTC.

.\bin\rsa-securidaccess-rest-client-sdk.bat -f "c:\temp\RSA API\ea9e8e60-cde6-425c-8161-af967a157927.key" -o exportAllAdminLog -u https://mysubdomain.access-eu.securid.com/AdminInterface/restapi/v1 -s 2021-09-30T09:15:00.000Z -e 2021-10-31T23:59:59.999Z

Notes

• The rsa-securidaccess-rest-client.sdk CLU requires Java to be installed on the computer where it will be run.
  • JAVA_HOME must be set (JAVA_HOME is an environment variable that indicates where in the file system the JDK or JRE is installed, e.g. C:\Program Files (x86)\Java\jre1.8.0_333).
  • These instructions assume the Windows PATH environment variable has been updated to include the Java bin directory/folder, e.g. on Windows, that would be %JAVA_HOME%\bin.
• Run the rsa-securidaccess-rest-client.sdk CLU with no switches to see all of the available command options:

.\bin\rsa-securidaccess-rest-client-sdk.bat

• Some versions of the rsa-securidaccess-rest-client.sdk CLU, up to and including v2.7.1, do not support Positive UTC time offsets for the -s and -e options.   Upgrade to v2.7.2 or later to fix the issue.  Or, as a workaround, specify times in UTC (see "UTC Example" above).