Skip to main content
McAfee Enterprise MVISION Cloud

Audit Trail

The audit trail report returns a comma separated list of the Audit Log from MVISION Cloud. The Audit Trail keeps track of users who interact with MVISION Cloud and lists out the actions they take within the dashboard.

Endpoint Name

  • queryAuditTrails

Required Headers

  • Authorization: User name and password used to access the MVISION Cloud Cloud Manager.
  • Content-Type: Application/json

Required Parameters

There are no parameters required. However, sending the request without using the optional parameters to filter results may result in a large file.

Optional Parameters

  • Match: A single word search term to filter the results; searches the DESCRIPTION and EVENTINFO fields, but cannot perform multiple searches and cannot not use “AND” or “OR” operators.
  • eventTypes: Filters the results by a specific event action. Each action is mapped to a numeric value. Enter that value in the request:
    • LOGIN (User logged in)
    • LOGOUT (User logged out)
    • SIGNUP (User self-sign on)
    • DASHBOARD (User landed on dashboard page)
    • SERVICE_DETAILS (Show service details)
    • DATA_DETAILS (Show data details)
    • ANOMALIES (Show anomalies)
    • SETTINGS_DATA_FEEDS (Edit settings for data feed)
    • MANAGED_SERVICES (View managed services)
    • MENU_NAVIGATION (Application navigation)
    • LOGIN_FAILED (User logged failed)
    • SETTINGS_DATA_FEEDS_DOWNLOAD_CLICKED (User clicked on download script)
    • MANUAL_UPLOAD_STARTED (Manual upload started)
    • MANUAL_UPLOAD_FINISHED_SUCCESS (Manual upload finished successfully)
    • MANUAL_UPLOAD_FAILED (Manual upload failed)
    • PROXY_CREATION (Proxy Creation)
    • ED_SHOW_LESS (Enterprise Dashboard Show Less view)
    • ED_SHOW_MORE (Enterprise Dashboard Show More view)
    • APP_LOAD_TIMMING (Application load timings)
    • USER_AUDIT_EVENT (User management action)
    • RISK_CUSTOMIZATION_EVENT (Risk scoring model change)
    • PROXY_BUNDLE (Bundle pushed to Proxy)
    • DEFAULT_BUNDLE (Default bundle pushed to Proxy)
  • fromTime/toTime: Used to filter the response to a specific time period. Leave either or both as null to not set an upper or lower time bound. Enter the time and date in milliseconds, calculated from Unix Epoch Time.

Sample Request

{"auditFilter":{"dataSetId":-1,"match":null,"eventTypes":1"fromTime": 1425301837000,"toTime":null}}

Sample Response

TimeStamp,Event Type,Description,Additional Info,User Name
Mon Mar 02 13:10:37 UTC 2015,User logged in,,User name:sample@sample.com,sample_sampleson
  • Was this article helpful?