List policy event logs

HTTP Request

GET https://<serviceURL>/api/v1/log/policyeventlog?[&domain=<domain>][&event=<event>][&start=<start>][&end=<end>][&limit=<limit>][&token=<token>]

Request Parameters

Parameter	Required	Description
domain	No	Domain from which you want to retrieve policy event logs. If this parameter is not specified, the request retrieves the logs from all domains.
direction	No	Direction of the logs that you want to retrieve. Options include: in out
event	No	General type of security event from which you want to retrieve policy event logs. Options include: anti_spoof threat spam content_filter dlp phishing anomaly Each general event type in the request is mapped to one or more specific event types returned in the response. For more information about the mapping relationships, see Mapping between event types in the request and response. If this parameter is not specified, the request retrieves the logs of all events. Important If you use this parameter in the request, specify one event type at a time.
start end	No	Start and end time period to retrieve logs. Format: ISO 8601 timestamp to the second or millisecond in UTC, yyyy-mm-ddThh:mm:ss[.mmm]Z Example: 2016-07-22T01:51:31Z or 2016-07-22T01:51:31.001Z The request retrieves logs generated within a maximum of 72 hours before the request is sent according to the start and end settings: If neither start nor end is specified, the request retrieves logs generated within five minutes of when the request is sent. If both start and end are specified, the request retrieves logs generated within the configured duration. Make sure the end time is no earlier than the start time. If only start is specified, the request retrieves logs generated within five minutes after the configured start time. If only end is specified, the request retrieves logs generated within five minutes before the configured end time.
limit	No	Maximum number of log items to return in each response. The default value is 500. If the total log items requested exceed the specified limit, a token is provided in the nextToken parameter in the response. Use this token to form a second request to retrieve the next set of log items. Repeat this until the nextToken parameter is not returned in a response.
token	No	Use the value of nextToken returned in the previous response to retrieve the next set of log items.

HTTP Request Example

GET https://<serviceURL>/api/v1/log/policyeventlog?domain=example.com&type=threat&start=2020-11-25T00:00:00Z&end=2020-11-25T23:59:59Z&limit=1&token=DKxIuQeL7Nq3aNgQtaaH2w== HTTP/1.1
Authorization: Basic c2FtcGxlOmZqZmo0OTBpNGpnaDAzM2dsajQzYXB3ZW1hMzEwdjEwamIxZ2lrM2oz
Accept-Encoding: gzip

Response

Response Example

HTTP/1.1 200
Content-Type: application/json;charset=UTF-8

{
    "nextToken":"Lu2XNNHim8CZpKoJEJKREAjmXh/VoNgdN+uQAm++Re58FzwrlUuCI6lb5iDncJua9jq3yQdyvMPOTYfsF9Pi/hYnZNb+hsiDE0BZm9wYYhUk87xgZrbcYMnC1tedtNk+G4TBWDX4LxpOvZ8aabecUQ==",
    "logs": [
        {
            "timestamp": "2020-11-25T01:14:32.872Z",
            "genTime": "2020-11-25T08:02:03Z",
            "eventType": "Suspicious Objects",
            "eventSubtype": "Suspicious URLs", 
            "domainName": "example.com",  
            "sender": "sender@example.com",
            "headerFrom": "header_sender@example.com",
            "recipients": [
                "rcpt1@example.com",
				"rcpt2@example.com"
            ],
            "headerTo": [
                "header_rcpt1@example.com",
				"header_rcpt2@example.com"
            ],
            "direction": "in",
            "messageID": "<20200725033505.DC75B100860D8@example.com>",
            "subject": "response sample",
            "size": 6564,
            "policyName": "test_policy: example.com: Virus",
            "policyAction": "Bypass",
			"details": "{\"urlInfo\":[{\"url\":\"https://mcusercontent.com/87564ad664ceeac44909ec631/images/a8730208-6096-404c-9dd6-1c61c47a2861.png);background-repeat:\",\"extractType\":\"body\"}]}"
        }
    ]
}

Response Parameters