Get D3 Log‎‎ | docs.d3security

POST /Command/getD3Log

Get the audit log and monitor log

Request

Authentication: API keys or JSON web tokens (JWT)

Body Parameters

Parameter Name	Type	Required/Optional	Description
Username	`string`	Required	The username of your D3 SOAR account.
Site	`string`	Required	The D3 SOAR site to run the remote command.
Start Time	`string`	Required	The start of the date range for logs
End Time	`string`	Required	The end of the date range for logs
Top Number	`Number`	Optional	Show the top number of logs
Search Condition	`JSON Array`	Optional	Use the searchable parameters to search for the desired log info.

READER NOTE
For Date/Time parameters Start Time, End Time:

All times and timestamps are in this format: yyyy-MM-dd HH:mm:ss.

For example, May 15, 2024, 2:32 PM should be 2024-05-15 14:32:00.

Body Sample Data

application/json

JSON

{
  "Username": "Admin",
  "Site": "Security Operations",
  "CommandParams": {
    "Start Time": "2021-03-26 00:00:00",
    "End Time": "2023-03-26 00:00:00",
    "Top Number": 100,
    "Search Condition": [
      {
        "Type": "User",
        "Action": "Add"
      },
      {
        "Type": "User",
        "Action": "Edit"
      }
    ]
  }
}

Response

200 OK

application/json

Response Fields

Field Name	Type	Description
error	`string`	The error message if the command execution failed.
returnData	`JSON Object`	The return data from the API request.

Sample Data

JSON

{
    "error": "",
    "returnData": "Successful",
    "returnData": {
      "AuditLogs": [
          {
              "_id": "64dec7c5c6488f2d542cde14",
              "ModifiedTime": "2023-08-18 01:22:13.757000",
              "ModifiedUtcTime": "2023-08-18 01:22:13.757000",
              "Type": "Web Service",
              "Action": "Application Start",
              "MachineName": "VDVPC-1"
          },
          {
              "_id": "64dec7a7a3185ce16ad3f205",
              "ModifiedTime": "2023-08-18 01:21:43.776000",
              "ModifiedUtcTime": "2023-08-18 01:21:43.776000",
              "Type": "Web Service",
              "Action": "Application End",
              "MachineName": "VDVPC-1"
          }
      ],
      "MonitorLogs": [
          {
              "_id": "64dfa912640633851577ecaa",
              "ModifiedTime": "2023-08-18 17:23:30.659000",
              "ModifiedUtcTime": "2023-08-18 17:23:30.659000",
              "Type": "Monitor",
              "Action": "Storage",
              "Data": {
                  "Storage": {
                      "TotalSize": 1152.01678466392,
                      "SqlServer": {
                          "StorageSize": 10.29022216392,
                          "StorageUsage": 9.23755644512
                      },
                      "MongoDb": 1141.7265625
                  }
              }
          }
      ]
  }
}

400 BadRequest

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

JSON

{"Error": "The body of the request must be a valid JSON object"}

401 Unauthorized

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

JSON

{"Error": "Invalid authentication key."}

429 TooManyRequests

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

JSON

{"Error": "The request exceeds rate limits or is otherwise blocked by rate limiting policies."}

500 InternalServerError

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

JSON

{"Error": "Unexpected Error."}