API for Audit Logs?

[ritraina (Ritika Raina)]

Do we have API to get audit log?

[LukeHagar]

Hey @ritraina,

Welcome to the forums!

I’m going to assume that we are talking about auditing IdentityNow, in which case your best sources of audit style logs are listed below.

You can run search operations on the events search index detailed here

or

You can subscribe to the AWS EventBridge trigger detailed here

I hope that helps answer your question, and thanks again for posting in the community!

[mcheek (Mark Cheek)]

To build on what @LukeHagar mentioned, here is a list of available audit events that include their technical names so you can refine your search more.

For me, I’m interested in SOURCE_MANAGEMENT audit events, but not anything related to aggregations, which are included in that topic. In my example, if I only wanted to search for event related to sources being updated, my search would look like

{
    "indices": [
        "events"
    ],
    "query": {
        "query": "type:\"SOURCE_MANAGEMENT\" AND operation:UPDATE"
    },
    "sort":[
        "-created"
    ]
}