List activity log events

get

https://cloud.tenable.com/audit-log/v1/events

Returns a list of activity log events for all users in your organization's Tenable Vulnerability Management account.

Each event includes details such as the timestamp, action taken, actor, and other relevant metadata. You can apply filters to narrow the results and specify the number of events to return. By default, the response includes up to 50 events.

For more information, see Activity Logs in the developer documentation.

Note: Tenable retains activity log data for three years, after which it is permanently deleted from the database.

Requires the Administrator [64] user role. See Roles.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Query Params

array of strings

Specifies a filter condition in the field.operator:value format. Filter conditions can include:

date.gt:<ISO Date/Time> — Returns events only if the timestamp when the events occurred is after the date or time you specify. For example: f=date.gt:2017-12-31, f=date.gt:2017-12-31T13:14:15.678Z
date.gte:<ISO Date/Time> — Returns events only if the timestamp when the events occurred is at or after the date or time you specify. For example: f=date.gte:2017-12-31, f=date.gte:2017-12-31T13:14:15.678Z
date.lt:<ISO Date/Time> — Returns events only if the timestamp when the events occurred is before the date or time you specify. For example: f=date.lt:2017-12-31, f=date.lt:2023-03-04T14:15:16.123-05:30
date.lte:<ISO Date/Time> — Returns events only if the timestamp when the events occurred is at or before the date or time you specify. For example: f=date.lte:2017-12-31, f=date.lte:2023-03-04T14:15:16.123-05:30
actor_id.eq:<UUID> — Returns only the events with a matching actor UUID. For example: f=actor_id.eq:ee512c41-282e-489c-a2cf-8bda1151e630
target_id.eq:<UUID> — Returns only the events with a matching target UUID. For example: f=target_id.eq:ee512c41-282e-489c-a2cf-8bda1151e630
action.eq:<String> — Returns only the events with a matching action. For example: f=action.eq:audit.log.view

You can specify multiple f parameters, separated by ampersand (&) characters. For example: ?f=date.gte:2019-12-30&f=date.lt:2019-12-31&f=actor_id.eq:f54eeec5-84e0-44bb-9ebe-64898bea0e59&limit=5000

string

enum

Defaults to and

Specifies whether an and or or condition is applied when multiple f parameters are present. If omitted, the system uses the default value of and.

Allowed:

limit

int32

≤ 10000

Defaults to 50

Specifies the maximum number of records to retrieve per request. If omitted, the system uses the default value of 50. The maximum value is 10000.

offset

int32

Defaults to 0

Specifies the starting record to retrieve. If omitted, the system uses the default value of 0.

sort

string

Specifies the field and order used to sort the results, in the format field:order. The order must be asc (ascending) or desc (descending). For example, received:desc sorts results by the received field in descending order.

Note: Currently, the only supported sort field is received.

Headers

string

enum

Defaults to application/json

Generated from available response content types

Allowed:

Responses

403

Returned if you do not have permission to view the activity log.

200Returned if the activity log was successfully retrieved.

429Returned if you attempt to send too many requests in a specific period of time. For more information, see Rate Limiting.