Get raw events (deprecated)

This method enables the user to retrieve raw events from EPM according to a predefined filter.

This method was deprecated in v22.3 and has been replaced by the following APIs:

For inbox events: Get detailed raw events

For audit events: Get policy audit raw event details

Make sure there are no spaces in the URL.

The following characters are not supported in URL parameter values: + & %

API version

Type: String

Valid value: Version number. Format is x.x.x.x (for example, 11.5.0.1)

Default value: Latest version

Mandatory: No

ID of a set that the user has permission to view, generated in the Get sets list API

Type: String

Valid value: Set ID

Mandatory: Yes

Unique file ID generated in the Get aggregated events (deprecated) API

Type: String

Valid value: Valid file ID

Mandatory: Yes

Token generated in the EPM authentication or SAML authentication API.

Type: String

Valid value: basic <Token>

Mandatory: Yes

Event type. Specify All or a list of event types separated by commas.

For the list of event types, see Event Types .

Type: String

Valid values: All

Mandatory: No

Only show events since the given date

Type: Date

Valid values: ISO-8601 to format dates and UTC time zone - YYYY-MM-DDThh:mm:ssZ

If DateFrom and DateTo are not valued, only events from the last day are returned

Mandatory: No

Only show events until the given date

Type: Date

Valid values: ISO-8601 to format dates and UTC time zone - YYYY-MM-DDThh:mm:ssZ

If DateFrom and DateTo are not valued, only events from the last day are returned

Mandatory: No

Determines if the event has justification details

Not relevant for ThreatDetection

Type: String

Valid values: All/WithJustification

Default values: All

Mandatory: No

Name of the policy that triggers the event. Wildcards are supported.

Not relevant for ApplicationEvents

Type: String

Valid values: The following wildcards:

"xxx xxx" - filters the exact value between the quotes

xxx xxx - filters anything that contains the string

*xxx xxx* - filters anything that contains the string between the *

xxx* - filters all strings that start with the value before the *

*xxx - filters all strings that end with the value after the *

Mandatory: No

"Events": [
{
"EventId": "string",
"Computer": "string",
"User": "string",
"UserIsAdmin": boolean,
"TimeFirst": "date/time",     "TimeLast": "date/time",     "EventType": "string",
"AgentEventCount": number,     "Justification": "string",
"SourceType": "string",
"SourceName": "string",
"AccessTargetName": "string",  ],
"TotalCount": number,
"FilteredCount": number

First time this event was detected by EPM . If AgentEventCount =1, TimeFirst will be identical to TimeLast

ISO-8601 to format dates and UTC time zone - YYYY-MM-DDThh:mm:ssZ

Type: DateTime

Last time this event was detected by EPM . If AgentEventCount =1, TimeFirst will be identical to TimeLast

ISO-8601 to format dates and UTC time zone - YYYY-MM-DDThh:mm:ssZ

Type: DateTime

If the restrict event action is allow or restrict. This is relevant for Restrict events only.

Type: String

Category: All

Build 7.4 [ 26 December 2023 09:07:46 AM ]

EPM SaaS /Product-Doc/OnlineHelp /product-menu.html /Product-Doc/OnlineHelp /Portal/Content/Resources/_TopNav/cc_Portal.htm Endpoint Privilege Manager SaaS 23.12.1

Version 23.12.1

Our Products