Retrieve logs from SPE 9 without a central console in place?
search cancel

Retrieve logs from SPE 9 without a central console in place?

book

Article ID: 269805

calendar_today

Updated On:

Products

Protection Engine for Cloud Services

Issue/Introduction

How best to get logs from SPE 9 installed in AWS EC2 without a central console in place?

Please provide some steps if documentation does not exist. We are looking to capture at least 

  • date and time file sent for scanning
  • time it took for scanning
  • name and size of the file
  • verdict and related time stamp

Environment

Release : 9.0

Resolution

To populate logs from SPE 9 REST API to another data source

  •   Use the REST API of SPE 9 to schedule a request for the previous day's logs


SPE 9 REST API documentation is available here https://apidocs.securitycloud.symantec.com/#/doc?id=spe_about


For information about downloading a .csv report of log events from SPE 9 REST API

  1.  On the left pane, click SPE
  2. Below SPE, click Scanner
  3. On the keyboard, press <CTRL>+<F>
  4. In the browser Find dialog box, type: Download Event Logs
  5. The right result starts with a green bar which reads "POST /spe/api/v1/download-detailed-report"
  6. To see the details required to request a specific date range, click "Request object details"
  7. On the Object Details dialog box, click Statistics Request.
  8. Note there are no details on the formatting of the date, so you'll have some minimal testing to confirm date format for forming this request.