EnableExtendedApiAuditLogging

When this parameter is set to True (enabled), Carbon Black EDR logs all REST API requests from either the console or other sources, such as scripts, and stores the data in /var/log/cb/audit/useractivity.log.

Default: False

For example:

2017-12-22 11:30:54:  username='dave' userid='1' ip='::ffff:192.168.56.1' status='200' method='GET' path='/api/v2/sensor'
2017-12-22 11:30:54:  username='dave' userid='1' ip='::ffff:192.168.56.1' status='200' method='GET' path='/api/v1/alert'
2017-12-22 11:30:55:  username='dave' userid='1' ip='::ffff:192.168.56.1' status='200' method='GET' path='/api/v1/detect/report/currentmonitoringstatus'
2017-12-22 11:30:55:  username='dave' userid='1' ip='::ffff:192.168.56.1' status='200' method='GET' path='/api/v3/group'
2017-12-22 11:30:57:  username='dave' userid='1' ip='::ffff:192.168.56.1' status='200' method='GET' path='/api/v1/feed'
2017-12-22 11:30:57:  username='dave' userid='1' ip='::ffff:192.168.56.1' status='200' method='GET' path='/api/v1/process'

The audit information also appears in the User Management section of the console on the Activity Audit tab, and in a CSV file downloaded from that page, as shown in the following example:

username, timestamp, ip_address, request_method, request_path, result, description
"dave","2017-12-22 21:33:29.031897-05:00","::ffff:192.168.56.1","GET","/api/v2/group","200","OK"
"dave","2017-12-22 21:33:28.988702-05:00","::ffff:192.168.56.1","GET","/api/users","200","OK"
"dave","2017-12-22 21:33:28.979345-05:00","::ffff:192.168.56.1","GET","/api/teams","200","OK"

When this parameter is set to False , no REST API requests are logged or stored in useractivity.log , and the Activity Audit tab shows only login and logout events.

Note: New in version 6.2.1.