Management API Syntax for Audit/Services Query

Products

• CASB Security Premium
• CASB Audit
• CASB Audit
• CASB Security Advanced
• CASB Security Standard

Issue/Introduction

Client would like guidance for a CloudSOC Management API query to match results from Audit Services GUI export.

Resolution

API Management "Getting Audit Services" section of Tech Doc 

https://techdocs.broadcom.com/us/en/symantec-security-software/information-security/symantec-cloudsoc/cloud/api-home/audit-api/getting-audit-services.html

Important points to get matching data in Audit Services API query:

• Epoch earliest & latest date/time in API query must match times selected in GUI
• Resolution is needed and explained in Tech doc
• Classification selected in the Audit Services Configure tab is called "service_type" in the API query and must match 
  
  
  
  
  
• API Key and Key_Secret need to be included in API query

Sample Audit API query syntax - (Basic Authentication needs to be added for the specific tenant)

https://api-vip.elastica.net/<casbtenantID>/audit/v2/data/?resource=service&earliest_date=1668556800&latest_date=1668643199&service_type=enterprise&resolution=86400