getLogs
Retrieve audit logs based on specified filters and criteria.
Examples
query GetLogs($input: GetLogsInput) {
getLogs(input: $input) {
id
date
logType
logName
userId
userEmail
actorApiKeyName
actorApiKeyOwnershipType
name
appId
appName
registry
dockerfile
connector
credentialsType
credentialName
resourceCount
resources
branches {
branch
reason
}
repoName
reposCount
hostUrl
monitorAllResources
scanId
enabledConnectors
loginType
domain
memberEmail
disclaimerType
memberRoles
memberScopes
appNames
isDastOnlyScan
dastTargetIds
dastTargetNames
scanStartDate
scanFinishDate
scanStatus
scanFailureReason
businessPriority
owners
ownersWithRoles {
owner
email
roles
}
roles
generatedForOrg
downloadFormat
generatedFrom
comment
commentId
excluded
removed
issueName
issueId
profileId
profileName
activeProfile
settingsType
disabled
configured
textArr
policies {
policyId
policyName
categoryName
enabled
severity
oldIssues
newIssues
args
}
slackUser
channel
key
ticketId
ticketingVendor
targetStatus
currentStatus
availableTransitions
failureReason
failureKind
hopsUsed
statusesTraversed
previousPriority
newPriority
issueChangeType
messagingVendor
recipients
user
link
categoryName
categoryId
expiredAt
prId
prURL
sourceControlType
aggItems
excludedIssues {
appNames
issueId
issueName
categoryName
comment
expiredAt
}
issues {
issueId
issueName
}
fixTitle
severity
oldSeverity
newOwnerName
newOwnerEmail
oldOwnerName
oldOwnerEmail
tagsAdded
tagsRemoved
workflowType
workflowName
nodeName
nodeType
workflowId
description
enabled
monitorAllNewlyCreatedRepositories
monitoredApps
secretName
filterName
viewName
pageName
apiKeyName
apiKeyOwnershipType
apiKeyType
createdBy
apiKeyCreatedAt
apiKeyExpiredAt
orgUnitName
orgUnitId
tags
pipelineSettingsV2 {
isDefaultSettings
isGithubConnected
isBitbucketConnected
isGitlabConnected
apps
settings
branchSettings
}
children
updateSlaSettings
irrelevantComment
sla
emailType
emailSubject
triageStatus
actionType
changes
fileName
universalParserName
fileType
title
domainType
targetUrl
env
authMethod
previousValues {
title
domainType
targetUrl
env
authMethod
}
branch
customRoleLogData {
name
displayName
assignablePermissions {
name
isHidden
}
previousDisplayName
previousAssignablePermissions {
name
isHidden
}
}
tableRowsChanges {
deleted {
name
regex
}
added {
name
regex
}
}
notificationSettings {
type
enabled
channels {
email {
enabled
recipients {
users {
user_id
name
email
}
roles
}
defaultEmailRoleNames
channels
channelList {
id
name
profile {
image_192
}
is_private
display
description
isAdded
}
unsubscribed {
user_id
name
email
}
suppressedExposureStates
}
slack {
enabled
recipients {
users {
user_id
name
email
}
roles
}
defaultEmailRoleNames
channels
channelList {
id
name
profile {
image_192
}
is_private
display
description
isAdded
}
unsubscribed {
user_id
name
email
}
suppressedExposureStates
}
banner {
enabled
recipients {
users {
user_id
name
email
}
roles
}
defaultEmailRoleNames
channels
channelList {
id
name
profile {
image_192
}
is_private
display
description
isAdded
}
unsubscribed {
user_id
name
email
}
suppressedExposureStates
}
}
}
incidentCaseId
incidentName
incidentSource
incidentStatusFrom
incidentStatusTo
}
}Variables
This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.
Arguments
You can use the following argument(s) to customize your getLogs query.
input GetLogsInput
Filter and pagination parameters for retrieving audit logs
logTypes [LogType!]
logNames [LogName!]
userEmails [String!]
appNames [String!]
triggeredBy [AuditLogTriggeredBy!]
apiKeyNames [String!]
limit Float
skip Float
orderBy LogOrderBy
dateRange LogDateRange
Fields
Return type: [AuditLog!]!
You can use the following field(s) to specify what information your getLogs query will return. Please note that some fields may have their own subfields.
id String!
Unique identifier of the audit log entry
date DateTime!
Timestamp when the event occurred. Records are automatically expired after 365 days
userId String!
Unique identifier of the user who performed the action
userEmail String!
Email address of the user who performed the action
actorApiKeyName String
Name of the API key that performed the action, when an API key was the actor
actorApiKeyOwnershipType String
Ownership type (Personal or Organization) of the API key that performed the action
name String
Name of the container or organization involved in the event
appId String
Unique identifier of the application associated with the container
appName String
Name of the application associated with the container
registry String
Container registry information
dockerfile String
Path or content of the Dockerfile used
connector String
Name or identifier of the external service connector
credentialsType String
Type of credentials used for authentication
credentialName String
Name of the credential used for the connector
resourceCount Float
Number of resources affected or monitored
resources [String!]
List of resource identifiers being monitored
branches [MultipliedBranchWithReason!]
List of branches selected for scanning with their selection reasons
branch String!
reason String!
repoName String
Name of the repository being scanned
reposCount Float
Total number of repositories affected
hostUrl String
URL of the external service or repository host
monitorAllResources Boolean
Whether all available resources are being monitored
scanId String
Unique identifier of the security scan
enabledConnectors [String!]
List of connectors enabled for the scan
loginType String
Authentication method used for login
domain String
Domain associated with the authentication or login event
memberEmail String
Email address of the member involved in the event
disclaimerType String
Type of disclaimer that was accepted
memberRoles [String!]
Roles assigned to the member
memberScopes String
Permission scopes granted to the member
appNames [String]
Names of applications involved in the event
isDastOnlyScan Boolean
Indicates whether the scan was an Agentic Pentester scan
dastTargetIds [String!]
IDs of Agentic Pentester targets included in the scan. Empty when the scan covers all targets.
dastTargetNames [String!]
Human-readable names of Agentic Pentester targets included in the scan. Empty when the scan covers all targets.
scanStartDate DateTime
Timestamp when the scan started (ScanFinished entries)
scanFinishDate DateTime
Timestamp when the scan finished (ScanFinished entries)
scanStatus String
Final scan status: Succeeded, Failed, or Timed Out (ScanFinished entries)
scanFailureReason String
Customer-facing failure reason on failed ScanFinished entries
businessPriority Float
Business priority level assigned to the application
owners [String!]
List of application owner identifiers
ownersWithRoles [Owner!]
Detailed information about application owners including their roles
owner String
email String
roles [String!]
roles [String!]
List of roles associated with the event
generatedForOrg Boolean
Indicates if the file was generated for the entire organization
downloadFormat String
Format of the downloaded file (e.g., JSON, CSV)
generatedFrom String
Source or context from which the file was generated
comment String
User-provided comment or explanation for the action
commentId String
Unique identifier of a specific comment on an issue
excluded Boolean
Indicates if an issue was marked as a false positive
removed Boolean
Indicates if a resolved issue was marked as incorrectly resolved
issueName String
Name or title of the security issue
issueId String
Unique identifier of the security issue
profileId String
Identifier of the security policy profile
profileName String
Name of the security policy profile
activeProfile Boolean
Indicates if this is the active security policy profile
settingsType String
Type of system settings being modified
disabled Boolean
Indicates if the feature or setting is disabled
configured Float
Configuration value or count
textArr [String!]
Array of text values in string format
policies [LogPolicy!]
List of security policies affected by the event
policyId String
policyName String
categoryName String
enabled Boolean
severity String
oldIssues String
newIssues String
args String
slackUser String
Slack username associated with the event
channel String
Slack channel where the notification was sent
key String
Unique key or identifier in the external system
ticketId String
Ticket identifier in the external ticketing system
ticketingVendor String
Name of the ticketing system vendor (e.g., Jira, ServiceNow)
targetStatus String
Status the ticket was being moved to
currentStatus String
Status the ticket was in when the transition failed
availableTransitions [String!]
Transitions the ticketing system offered from the current status
failureReason String
Reason the ticketing system gave for rejecting the transition
failureKind String
Machine-readable transition failure category
hopsUsed Float
Number of intermediate status hops performed before failing
statusesTraversed [String!]
Statuses the ticket was actually moved through before the failure
previousPriority String
Priority the ticket carried before OX changed it
newPriority String
Priority OX wrote to the ticket
issueChangeType String
Issue change that drove the ticket update (e.g. changeSeverity, changeSeverityAutomatic)
messagingVendor String
Name of the messaging system vendor
recipients [String!]
Recipients (channels or users) the notification was delivered to
user String
Username in the external system
link String
URL or link to the external resource
categoryName String
Category name of the security issue or code fix
categoryId Float
Numeric identifier of the issue category
expiredAt DateTime
Expiration date of the exclusion
prId String
Pull request identifier
prURL String
URL of the pull request
sourceControlType String
Type of source control system (e.g., GitHub, GitLab)
aggItems String
Aggregated items in string format
excludedIssues [ExcludedIssue!]
List of issues excluded from security scanning
appNames [String!]
issueId String!
issueName String!
categoryName String!
comment String
expiredAt String
issues [JiraIssueDetailType!]
List of issues for multi-issue Jira tickets
issueId String!
issueName String
fixTitle String
Title of the applied fix
severity String
Current severity level of the issue
oldSeverity String
Previous severity level of the issue
newOwnerName String
Name of the new issue owner
newOwnerEmail String
Email of the new issue owner
oldOwnerName String
Name of the previous issue owner
oldOwnerEmail String
Email of the previous issue owner
tagsAdded [String!]
Tags added to the application
tagsRemoved [String!]
Tags removed from the application
workflowType String
Type of the policy workflow
workflowName String
Name of the workflow the event relates to: the policy workflow for policy-workflow logs, or the ticketing system workflow governing the ticket for ticketing logs
nodeName String
Name of the workflow node
nodeType String
Type of the workflow node
workflowId String
Unique identifier of the workflow
description String
Description of the workflow
enabled Boolean
Indicates if the workflow is enabled
monitorAllNewlyCreatedRepositories Float
Number of newly created repositories to monitor
monitoredApps [String!]
List of applications being monitored by the workflow
secretName String
Name of the secret
filterName String
Name of the saved filter
viewName String
Name of the saved view
pageName String
Page where the filter is applied
apiKeyName String
Name of the API key
apiKeyOwnershipType String
Ownership type (Personal or Organization) of the API key
apiKeyType String
Type of the API key
createdBy String
User who created the API key
apiKeyCreatedAt DateTime
Creation date of the API key
apiKeyExpiredAt DateTime
Expiration date of the API key
orgUnitName String
Name of the organization unit
orgUnitId ID
Unique identifier of the organization unit
tags [String!]
Tags associated with the organization unit
pipelineSettingsV2 PipelineSettingsV2
Enhanced CI/CD pipeline configuration settings
isDefaultSettings Boolean!
isGithubConnected Boolean
isBitbucketConnected Boolean
isGitlabConnected Boolean
apps JSONObject
settings JSONObject
branchSettings JSONObject
children [ID!]
Child organization unit identifiers
updateSlaSettings String
Changes made to SLA settings
irrelevantComment String
Reason for marking an application as irrelevant
sla Float
SLA time value in hours
emailType String
Type of email notification sent
emailSubject String
Subject line of the email notification
triageStatus String
Triage status of the issue
actionType String
Action type of the audit logs export
changes [String!]
Changes made to the audit logs export
fileName String
Imported File Name
universalParserName String
Universal Parser connector name
fileType String
Imported File Type
title String
Title or name of the Agentic Pentest scanning target
domainType String
Type or classification of the domain being scanned
targetUrl String
URL of the target being scanned by Agentic Pentest
env String
Environment classification of the target (e.g., production, staging, development)
authMethod String
Authentication method used to access the Agentic Pentest target
previousValues PreviousTargetValues
Previous values of the target configuration before modification (used in Edit operations)
title String
domainType String
targetUrl String
env String
authMethod String
branch String
Name of the branch being scanned
customRoleLogData customRoleLogData
Custom Role details
name String!
displayName String!
assignablePermissions [AssignablePermission!]
previousDisplayName String
previousAssignablePermissions [AssignablePermission!]
tableRowsChanges TableRowsChangeSet
Table rows changes
deleted [TableRowChangeItem!]
added [TableRowChangeItem!]
notificationSettings [NotificationSettingItem!]
Notification settings configuration
type NotificationSettingsType!
enabled Boolean!
channels NotificationChannelSetting
incidentCaseId String
Response Center incident case id (e.g. RC-1018)
incidentName String
Response Center incident name
incidentSource String
Response Center incident creation origin: manual, ox-declared or auto-rule
incidentStatusFrom String
Response Center incident status before the change
incidentStatusTo String
Response Center incident status after the change
Last updated