Collects the contents of the events databases of host endpoints in the same manner as the stateagentinspector audit, but provides the data in a compact form that can be used to match event properties using indicators of compromise (IOCs).
The input parameters of this audit are the same as for the stateagentinspector audit.
Supported Platforms
Windows, Linux and macOS
Input Parameters
The following input parameters are available for this audit.
intervalStart
Details | Values | Description |
|---|---|---|
Platform | Windows and macOS | Windows and macOS environments |
Format | dateTime | Valid values are a timestamp. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Specify the start time of the data collection interval. |
intervalStop
Details | Values | Description |
|---|---|---|
Platform | Windows and macOS | Windows and macOS environments |
Format | dateTime | Valid values are a timestamp. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Specify the end time of the data collection interval. |
eventTypes
Details | Values | Description |
|---|---|---|
Platform | Windows and macOS | Windows and macOS environments |
Format | String | Valid values are a string of text. |
Required? | no | This parameter is not required. |
Repeatable? | yes | This parameter can be repeated in an audit request. |
Valid Values | Specify the event types to collect. If not specified, all types are returned. |
maxEventsPerType
Details | Values | Description |
|---|---|---|
Platform | Windows and macOS | Windows and macOS environments |
Format | Numeric | Valid values are numeric. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Specify the maximum number of events that should be collected per event type. The same maximum value will be used for all event types collected. |
timeOfInterest
Details | Values | Description |
|---|---|---|
Platform | Windows and macOS | Windows and macOS environments |
Format | dateTime | Valid values are a timestamp. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Specify the time around which the events should be collected. |
maxEventsPerTypeBeforeTimeOfInterest
Details | Values | Description |
|---|---|---|
Platform | Windows and macOS | Windows and macOS environments |
Format | Numeric | Valid values are numeric. |
Required? | no | This parameter is not required. |
Repeatable? | yes | This parameter can be repeated in an audit request. |
Valid Values | Specify the number of events to be collected before the time of interest ( |
maxEventsPerTypeAfterTimeOfInterest
Details | Values | Description |
|---|---|---|
Platform | Windows and macOS | Windows and macOS environments |
Format | Numeric | Valid values are numeric. |
Required? | no | This parameter is not required. |
Repeatable? | yes | This parameter can be repeated in an audit request. |
Valid Values | Specify the number of events to be collected after the time of interest ( |