Search events

post

https://{customer}.tenable.ad/api/events/search

Searches the events in the specified directories within a date range for the specified security profile, filtered by a query expression.

Requires one of the following license types: ioa, ioaPreview, or ioe. See License Types.

Requires the Read permission on the Domains entity (read:directory). See Identity Exposure Permissions.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

expression

object

required

Specifies the query expression that filters the events. An expression is an AND or OR operator that holds a list of conditions, each pairing an attribute name with a value, such as {"AND": [{"cn": "admin"}]}. A single condition can also stand alone. A condition matches attribute values that contain the specified text, regardless of case, and an unrecognized operator matches nothing. An empty object applies no filter.

order

object

Specifies how to sort the events.

profileId

integer

required

Specifies the ID of the security profile to search events for.

directoryIds

array of integers

required

length ≥ 1

Specifies the IDs of the directories to search.

directoryIds*

dateStart

date-time

required

Returns events that occurred on or after the specified date and time, as an ISO timestamp.

dateEnd

date-time

required

Returns events that occurred on or before the specified date and time, as an ISO timestamp.

Responses

401

Returned if the API key specified in your request is invalid.

500

Returned if an internal error occurred.

200Returned if the search results were retrieved successfully.

400Returned if your request specified invalid parameters or if your request was improperly formatted.