User Audit

To generate activity reports in CSV or JSON format for users in your organization. Reports include login history, Threat Model, investigation, and import activity.

There are two types of user activity reports: UI activity reports (including actions taken from the ThreatStream user interface) and API activity reports (including API requests made by users).

Returning user activity reports is a three part process. It involves generating a user activity report, checking the status of the report, and returning the report after completion. See Examples for more information on this multi-step process.

Request

Generate a user UI activity report	GET `/api/v1/useraction/`
Generate a user API activity report	GET `/api/v1/apiuseraction/`
Check the status of the report	GET `/api/v1/generic_async_result/<id>/`
Return results of the report.	GET `/generic_async_result/<id>/get_result/`

Attributes: See table below.

Attributes

Attribute	Type	Description
async_result	Boolean	Whether results are fetched asynchronously. Anomali recommends setting `async_result` to `true` when returning results for more than five users or a week of data.
created_ts__gte	Date	Beginning of the time range for which you want to generate the report. Date must be specified in this format: YYYYMMDDThhmmss where T denotes the start of the value for time, in UTC time. For example, `2014-10-02T20:44:35`
created_ts__lte	Date	End of the time range for which you want to generate the report Date must be specified in this format: YYYYMMDDThhmmss where T denotes the start of the value for time, in UTC time. For example, `2014-10-02T20:44:35`
format	String	File format of the generated report. Specify `csv` or `json`
limit	Numeric	Maximum number of records included in report. Default: 20
user_id__in	Numeric	IDs of the users which you want to include in the report. If you do not specify a user ID, results are returned for all organization users.

Response

Format: CSV, JSON

Examples

Request:

To generate a user UI activity report for a single user, whose user ID is 56:
1. curl 'https://optic.threatstream.com/api/v1/useraction/?async_result=true&created_ts__gte=2019-10-09T00:00:00.000Z&created_ts__lte=2019-10-10T23:59:59.999Z&format=csv&limit=1000&order_by=-created_ts&user_id__in=56' -H 'Authorization: apikey <username>:<api_key>'
  
  Results are returned similar to the following:
```
created_ts: "2020-08-07T21:05:11.501490",
id: <id>,
modified_ts: "2020-08-07T21:05:11.501505",
path: "/api/v1/useraction/",
resource_uri: "/api/v1/generic_async_result/<id>/",
response_status: null,
status: "inprogress"
```
  where <id> is the unique ID of the export. You will use this value to check the status of the export job and return the results after completion.
2. To check the status of the export using the command listed for resource_uri:
  
  curl 'https://optic.threatstream.com/api/v1/generic_async_result/<id>/' -H 'Authorization: apikey <username>:<api_key>'
  
  where <id> is the unique ID of the export.
  
  Results are returned similar to the following when the export job is in progress:
```
created_ts: "2020-08-07T22:31:21.358172"
id: <id>
modified_ts: "2020-08-07T22:31:21.597286"
path: "/api/v1/useraction/"
resource_uri: "/api/v1/generic_async_result/<id>/"
response_status: null
status: "inprogress"
```
  Repeat this call until you see the following values:
```
response_status: 200
status: "done"
```
  This indicates that the export job is complete and ready to return.
3. Return the completed export job:
  
  curl 'https://optic.threatstream.com/api/v1/generic_async_result/<id>/get_result/' -H 'Authorization: apikey <username>:<api_key>'
To generate a user API activity report for a single user, whose user ID is 56:
1. curl 'https://optic.threatstream.com/api/v1/apiuseraction/?async_result=true&created_ts__gte=2019-10-09T00:00:00.000Z&created_ts__lte=2019-10-10T23:59:59.999Z&format=csv&limit=1000&order_by=-created_ts&user_id__in=56' -H 'Authorization: apikey <username>:<api_key>'
  
  Results are returned similar to the following:
```
created_ts: "2020-08-07T21:05:11.501490",
id: <id>,
modified_ts: "2020-08-07T21:05:11.501505",
path: "/api/v1/apiuseraction/",
resource_uri: "/api/v1/generic_async_result/<id>/",
response_status: null,
status: "inprogress"
```
  where <id> is the unique ID of the export. You will use this value to check the status of the export job and return the results after completion.
2. Check the status of the export using the command listed for resource_uri:
  
  curl 'https://optic.threatstream.com/api/v1/generic_async_result/<id>/' -H 'Authorization: apikey <username>:<api_key>'
  
  where <id> is the unique ID of the export.
  
  Results are returned similar to the following when the export job is in progress:
```
created_ts: "2020-08-07T22:31:21.358172"
id: <id>
modified_ts: "2020-08-07T22:31:21.597286"
path: "/api/v1/apiuseraction/"
resource_uri: "/api/v1/generic_async_result/<id>/"
response_status: null
status: "inprogress"
```
  Repeat this call until you see the following values:
```
response_status: 200
status: "done"
```
  This indicates that the export job is complete and ready to return.
3. Return the completed export job:
  
  curl 'https://optic.threatstream.com/api/v1/generic_async_result/<id>/get_result/' -H 'Authorization: apikey <username>:<api_key>'
To generate an activity report that includes all organization users:
1. curl 'https://optic.threatstream.com/api/v1/useraction/?async_result=true&created_ts__gte=2019-10-09T00:00:00.000Z&created_ts__lte=2019-10-10T23:59:59.999Z&format=csv&limit=1000&order_by=-created_ts' -H 'Authorization: apikey <username>:<api_key>'
  
  Results are returned similar to the following:
```
created_ts: "2020-08-07T21:05:11.501490",
id: <id>,
modified_ts: "2020-08-07T21:05:11.501505",
path: "/api/v1/apiuseraction/",
resource_uri: "/api/v1/generic_async_result/<id>/",
response_status: null,
status: "inprogress"
```
  where <id> is the unique ID of the export. You will use this value to check the status of the export job and return the results after completion.
2. Check the status of the export using the command listed for resource_uri:
  
  curl 'https://optic.threatstream.com/api/v1/generic_async_result/<id>/' -H 'Authorization: apikey <username>:<api_key>'
  
  where <id> is the unique ID of the export.
  
  Results are returned similar to the following when the export job is in progress:
```
created_ts: "2020-08-07T22:31:21.358172"
id: <id>
modified_ts: "2020-08-07T22:31:21.597286"
path: "/api/v1/useraction/"
resource_uri: "/api/v1/generic_async_result/<id>/"
response_status: null
status: "inprogress"
```
  Repeat this call until you see the following values:
```
response_status: 200
status: "done"
```
  This indicates that the export job is complete and ready to return.
3. Return the completed export job:
  
  curl 'https://optic.threatstream.com/api/v1/generic_async_result/<id>/get_result/' -H 'Authorization: apikey <username>:<api_key>'