ExBifrost.Api.AuditLogs (ex_bifrost v0.1.0)

Copy Markdown View Source

API calls for all endpoints tagged AuditLogs.

Summary

Functions

export_audit_logs(connection, opts \\ [])

Export audit logs Streams audit log events matching the supplied filters as a downloadable file. Accepts the same filter query parameters as GET /api/audit-logs. The response is returned as an attachment with a generated filename.

get_audit_log_by_id(connection, id, opts \\ [])

Get audit log by ID Retrieves a single audit log event by its unique ID.

get_audit_logs(connection, opts \\ [])

List audit logs Retrieves CADF-compliant audit log events with filtering, search, and pagination via query parameters. Most filter dimensions accept either a single value (singular parameter, e.g. action) or a JSON-encoded array of values (plural parameter, e.g. actions); when both are supplied the plural array takes precedence.

get_audit_logs_filter_data(connection, opts \\ [])

Get audit log filter data Returns the distinct values available for each audit log filter dimension, used to populate filter dropdowns in the dashboard.

verify_audit_log_signature(connection, id, opts \\ [])

Verify audit log signature Recomputes the HMAC-SHA256 signature for a single audit log event and compares it (in constant time) against the stored signature to detect tampering.

Functions

export_audit_logs(connection, opts \\ [])

@spec export_audit_logs(
  Tesla.Env.client(),
  keyword()
) ::
  {:ok, ExBifrost.Model.BifrostError.t()}
  | {:ok, String.t()}
  | {:error, Tesla.Env.t()}

Export audit logs Streams audit log events matching the supplied filters as a downloadable file. Accepts the same filter query parameters as GET /api/audit-logs. The response is returned as an attachment with a generated filename.

Parameters

  • connection (ExBifrost.Connection): Connection to server
  • opts (keyword): Optional parameters
    • :format (String.t): Export format. Defaults to json when omitted or unrecognized. - json: a JSON array of events - jsonl: JSON Lines, one event per line - syslog: RFC 5424 syslog format
    • :search (String.t): Free-text search across audit event fields.
    • :actions (String.t): JSON array of CADF actions to filter by (OR match).
    • :outcomes (String.t): JSON array of outcomes to filter by (OR match).
    • :event_types (String.t): JSON array of event types to filter by (OR match).
    • :start_date (String.t): Filter events at or after this time (RFC3339 or YYYY-MM-DD).
    • :end_date (String.t): Filter events at or before this time (RFC3339 or YYYY-MM-DD).
    • :period (String.t): Relative time window that overrides start_date/end_date when set (e.g. 24h, 7d).

Returns

  • {:ok, String.t} on success
  • {:error, Tesla.Env.t} on failure

get_audit_log_by_id(connection, id, opts \\ [])

@spec get_audit_log_by_id(Tesla.Env.client(), String.t(), keyword()) ::
  {:ok, ExBifrost.Model.AuditLogResponse.t()}
  | {:ok, ExBifrost.Model.BifrostError.t()}
  | {:error, Tesla.Env.t()}

Get audit log by ID Retrieves a single audit log event by its unique ID.

Parameters

  • connection (ExBifrost.Connection): Connection to server
  • id (String.t): The unique identifier of the audit log event.
  • opts (keyword): Optional parameters

Returns

  • {:ok, ExBifrost.Model.AuditLogResponse.t} on success
  • {:error, Tesla.Env.t} on failure

get_audit_logs(connection, opts \\ [])

@spec get_audit_logs(
  Tesla.Env.client(),
  keyword()
) ::
  {:ok, ExBifrost.Model.AuditLogsResult.t()}
  | {:ok, ExBifrost.Model.BifrostError.t()}
  | {:error, Tesla.Env.t()}

List audit logs Retrieves CADF-compliant audit log events with filtering, search, and pagination via query parameters. Most filter dimensions accept either a single value (singular parameter, e.g. action) or a JSON-encoded array of values (plural parameter, e.g. actions); when both are supplied the plural array takes precedence.

Parameters

  • connection (ExBifrost.Connection): Connection to server
  • opts (keyword): Optional parameters
    • :page (integer()): Page number for offset-based pagination (default 1).
    • :limit (integer()): Number of events to return per page (default 100, max 1000).
    • :cursor (String.t): Opaque cursor for cursor-based pagination (from next_cursor).
    • :search (String.t): Free-text search across audit event fields.
    • :action (AuditAction): Filter by a single CADF action.
    • :actions (String.t): JSON array of CADF actions to filter by (OR match).
    • :outcome (AuditOutcome): Filter by a single outcome.
    • :outcomes (String.t): JSON array of outcomes to filter by (OR match).
    • :event_type (AuditEventType): Filter by a single event type.
    • :event_types (String.t): JSON array of event types to filter by (OR match).
    • :initiator_id (String.t): Filter by a single initiator ID.
    • :initiator_ids (String.t): JSON array of initiator IDs to filter by (OR match).
    • :initiator_type (AuditResourceType): Filter by a single initiator resource type.
    • :initiator_types (String.t): JSON array of initiator resource types to filter by (OR match).
    • :target_id (String.t): Filter by a single target ID.
    • :target_ids (String.t): JSON array of target IDs to filter by (OR match).
    • :target_type (AuditResourceType): Filter by a single target resource type.
    • :target_types (String.t): JSON array of target resource types to filter by (OR match).
    • :start_date (String.t): Filter events at or after this time (RFC3339 or YYYY-MM-DD).
    • :end_date (String.t): Filter events at or before this time (RFC3339 or YYYY-MM-DD; a date is treated as end-of-day).
    • :period (String.t): Relative time window that overrides start_date/end_date when set (e.g. 24h, 7d).
    • :request_method (String.t): Filter by a single HTTP request method.
    • :request_methods (String.t): JSON array of HTTP request methods to filter by (OR match).
    • :request_path (String.t): Filter by a single request path prefix.
    • :request_paths (String.t): JSON array of request path prefixes to filter by (OR match).
    • :request_ip (String.t): Filter by a single client IP address.
    • :request_ips (String.t): JSON array of client IP addresses to filter by (OR match).
    • :tags (String.t): JSON array of tags to filter by (any match).
    • :sort_by (String.t): Field to sort by (default event_time).
    • :sort_order (String.t): Sort direction.

Returns

  • {:ok, ExBifrost.Model.AuditLogsResult.t} on success
  • {:error, Tesla.Env.t} on failure

get_audit_logs_filter_data(connection, opts \\ [])

@spec get_audit_logs_filter_data(
  Tesla.Env.client(),
  keyword()
) ::
  {:ok, ExBifrost.Model.AuditFilterDataResponse.t()}
  | {:ok, ExBifrost.Model.BifrostError.t()}
  | {:error, Tesla.Env.t()}

Get audit log filter data Returns the distinct values available for each audit log filter dimension, used to populate filter dropdowns in the dashboard.

Parameters

  • connection (ExBifrost.Connection): Connection to server
  • opts (keyword): Optional parameters
    • :dimensions (String.t): Comma-separated list of dimensions to return. When omitted, all dimensions are returned. Unknown dimensions are ignored.
    • :q (String.t): Optional case-insensitive substring filter applied to dimension values.

Returns

  • {:ok, ExBifrost.Model.AuditFilterDataResponse.t} on success
  • {:error, Tesla.Env.t} on failure

verify_audit_log_signature(connection, id, opts \\ [])

@spec verify_audit_log_signature(Tesla.Env.client(), String.t(), keyword()) ::
  {:ok, ExBifrost.Model.AuditVerifyResult.t()}
  | {:ok, ExBifrost.Model.BifrostError.t()}
  | {:error, Tesla.Env.t()}

Verify audit log signature Recomputes the HMAC-SHA256 signature for a single audit log event and compares it (in constant time) against the stored signature to detect tampering.

Parameters

  • connection (ExBifrost.Connection): Connection to server
  • id (String.t): The unique identifier of the audit log event to verify.
  • opts (keyword): Optional parameters

Returns

  • {:ok, ExBifrost.Model.AuditVerifyResult.t} on success
  • {:error, Tesla.Env.t} on failure