Collects the contents of the event databases of host endpoints. This content can be retrieved in two ways.
It can be retrieved using a time interval between start and stop times and the maximum number of events of each type.
It can be retrieved using a target time and the maximum number of events of each type before and after the target time.
Supported Platforms
Windows, Linux, and macOS
Input Parameters
The following input parameters are available for this audit.
intervalStart
Details | Values | Description |
|---|---|---|
Platform | Windows and macOS | Windows and macOS environments |
Format | dateTime | Valid values are a timestamp. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Specify the start time of the data collection interval. |
intervalStop
Details | Values | Description |
|---|---|---|
Platform | Windows and macOS | Windows and macOS environments |
Format | dateTime | Valid values are a timestamp. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Specify the end time of the data collection interval. |
eventTypes
Details | Values | Description |
|---|---|---|
Platform | Windows and macOS | Windows and macOS environments |
Format | String | Valid values are a string of text. |
Required? | no | This parameter is not required. |
Repeatable? | yes | This parameter can be repeated in an audit request. |
Valid Values | Specify the event types to collect. If not specified, all types are returned. |
maxEventsPerType
Details | Values | Description |
|---|---|---|
Platform | Windows and macOS | Windows and macOS environments |
Format | Numeric | Valid values are numeric. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Specify the maximum number of events that should be collected per event type. The same maximum value will be used for all event types collected. |
timeOfInterest
Details | Values | Description |
|---|---|---|
Platform | Windows and macOS | Windows and macOS environments |
Format | dateTime | Valid values are a timestamp. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Specify the time around which the events should be collected. |
maxEventsPerTypeBeforeTimeOfInterest
Details | Values | Description |
|---|---|---|
Platform | Windows and macOS | Windows and macOS environments |
Format | Numeric | Valid values are numeric. |
Required? | no | This parameter is not required. |
Repeatable? | yes | This parameter can be repeated in an audit request. |
Valid Values | Specify the number of events to be collected before the time of interest ( |
maxEventsPerTypeAfterTimeOfInterest
Details | Values | Description |
|---|---|---|
Platform | Windows and macOS | Windows and macOS environments |
Format | Numeric | Valid values are numeric. |
Required? | no | This parameter is not required. |
Repeatable? | yes | This parameter can be repeated in an audit request. |
Valid Values | Specify the number of events to be collected after the time of interest ( |