MImisp
Logs

Get instance logs

Changed on
post/admin/logs

Request

  • Base URL
    https://misp.local
  • URL
    https://misp.local/admin/logs
  • Auth
    API key in header Authorization

Request body

pageinteger nullable
limitinteger nullable

Maximum number of results to be returned. Can't be greater than the one set for your role. 0 means maximum.

idstring
titlestring
model'AdminSetting' | 'Allowedlist' | 'AttachmentScan' | 'Attribute' | 'AttributeTag' | 'AuditLog' | 'AuthKey' | 'Bruteforce' | 'Cerebrate' | 'Community' | 'CorrelationExclusion' | 'Correlation' | 'Dashboard' | 'DecayingModelMapping' | 'DecayingModel' | 'EventBlocklist' | 'EventDelegation' | 'EventGraph' | 'EventLock' | 'Event' | 'EventReport' | 'EventTag' | 'FavouriteTag' | 'Feed' | 'FuzzyCorrelateSsdeep' | 'GalaxyClusterBlocklist' | 'GalaxyCluster' | 'GalaxyClusterRelation' | 'GalaxyClusterRelationTag' | 'GalaxyElement' | 'Galaxy' | 'Inbox' | 'Job' | 'Log' | 'MispObject' | 'Module' | 'News' | 'NoticelistEntry' | 'Noticelist' | 'NotificationLog' | 'ObjectReference' | 'ObjectRelationship' | 'ObjectTemplateElement' | 'ObjectTemplate' | 'Organisation' | 'OrgBlocklist' | 'Post' | 'Regexp' | 'RestClientHistory' | 'Role' | 'Server' | 'ShadowAttribute' | 'SharingGroupOrg' | 'SharingGroup' | 'SharingGroupServer' | 'SightingdbOrg' | 'Sightingdb' | 'Sighting' | 'TagCollection' | 'TagCollectionTag' | 'Tag' | 'Task' | 'TaxonomyEntry' | 'Taxonomy' | 'TaxonomyPredicate' | 'TemplateElementAttribute' | 'TemplateElementFile' | 'TemplateElement' | 'TemplateElementText' | 'Template' | 'TemplateTag' | 'Thread' | 'ThreatLevel' | 'User' | 'UserSetting' | 'WarninglistEntry' | 'Warninglist' | 'WarninglistType'
model_idstring
action'accept' | 'accept_delegation' | 'acceptRegistrations' | 'add' | 'admin_email' | 'attachTags' | 'auth' | 'auth_fail' | 'blocklisted' | 'captureRelations' | 'change_pw' | 'delete' | 'disable' | 'discard' | 'discardRegistrations' | 'edit' | 'email' | 'enable' | 'enrichment' | 'error' | 'export' | 'fetchEvent' | 'file_upload' | 'galaxy' | 'include_formula' | 'login' | 'login_fail' | 'logout' | 'merge' | 'pruneUpdateLogs' | 'publish' | 'publish_sightings' | 'publish alert' | 'pull' | 'purge_events' | 'push' | 'registration' | 'registration_error' | 'remove_dead_workers' | 'request' | 'request_delegation' | 'reset_auth_key' | 'send_mail' | 'security' | 'serverSettingsEdit' | 'tag' | 'undelete' | 'update' | 'update_database' | 'update_db_worker' | 'upgrade_24' | 'upload_sample' | 'version_warning' | 'warning' | 'wipe_default'
user_idstring
changestring

Text search for log change property

emailstring email
orgstring

Text search for log organisation name property

descriptionstring

Text search for log change property

ipstring

Text search for log ip property

Example request

{
  "id": "12345",
  "title": "Attribute (448272) from Event (1): Other/text foo",
  "model_id": "12345",
  "user_id": "12345",
  "change": "%name () => (ORGNAME)%",
  "org": "ORG_%",
  "description": "%updated by User%"
}

Response

Get logs response

Example response

[
  {
    "Log": {
      "id": "12345",
      "title": "Attribute (448272) from Event (1): Other/text foo",
      "model_id": "12345",
      "user_id": "12345",
      "change": "name () => (ORGNAME)",
      "org": "ORGNAME",
      "description": "Organisation \"ORGNAME\" (1) added by User \"SYSTEM\" (0).",
      "ip": "10.0.0.10"
    }
  }
]

Changes

  • 787ec8b667aaRevision changes
    • breaking

      the //// request property's minItems was increased to 2

    • breaking

      the // response's property format changed from datetime to date-time for status

  • 070eab1318ebRevision changes
    • breaking

      the request property's min was increased to 1.00

    • info

      the request property's min was decreased from 1.00 to 0.00