Events

This endpoint allows you to collect events that you have access to.

IMPORTANT:    Some guidelines about using this endpoint:

1. If accountIds are not provided, events are returned from all accounts you have access to. If you are ADMIN, organisation-level events are also returned.
2. If you provide an accountId to an account you do not have at least ReadOnly access to, you will receive a 403 Forbidden error.
3. You can pull 4 types of events from this endpoint. By default, you will receive all events if you don't provide the any event type.
   • aws=true&azure=false&gcp=false&cc=false or azure=false&gcp=false&cc=false will only return AWS events;
   • aws=false&azure=false&gcp=false&cc=true or aws=false&azure=false&gcp=false will only return Cloud Conformity activity-events;
   • aws=true&azure=true&gcp=true&cc=false or cc=false will return AWS, Azure, and GCP events. For more information, see example below.
4. All events have a name attribute. Some important Cloud Conformity events are listed in the Event Names Table.
   Using the filter[name] as part of your query will get a history of that specific event. filter[name] also supports wildcards.
   • Asterisk at the end: filter[name]=account.bot.update* will get all events where the name starts with account.bot.update.
   • Asterisk in the middle:filter[name]=account.*.update* will match all account updating events like account.bot.update and account.rule.update.
   • Use of question marks: filter[name]=a??.check.create will match api.check.created and not account.check.created. Each ? is a character wildcard.
     

Filtering

The filter query parameter is reserved to be used as the basis for filtering. Any plural filter parameters (e.g. filter[region s]) accepts a comma-separated list. E.g. filter[regions]=us-east-1,us-east-2

The table below give more information about filter options:

For example, the following is a request for static-deployer events within a specified time frame on one account:

curl -g -H "Content-Type: application/vnd.api+json" \
     -H "Authorization: ApiKey S1YnrbQuWagQS0MvbSchNHDO73XHqdAqH52RxEPGAggOYiXTxrwPfmiTNqQkTq3p" \
     https://us-west-2-api.cloudconformity.com/v1/events?accountIds=ryi9NPivK&filter[identities]=static-deployer&filter[since]=1519919272016&filter[until]=1519932055819

Example Response:

Each event can be quite large and the example below is purposefully truncated.

{
    "data": [
        {
            "type": "events",
            "id": "rkTkAsr_GSJlpyCoB_M",
            "attributes": {
                "name": "account.monitoring.activity",
                "time": 1519922649000,
                "service": "cloudfront.amazonaws.com",
                "identity": "static-deployer",
                "region": "us-east-1",
                "description": "cloudfront.amazonaws.com/CreateInvalidation",
                "hasChildren": true
            },
            "relationships": {
                "account": {
                    "data": {
                        "type": "account",
                        "id": "ryi9NPivK"
                    }
                }
            }
        }
    ],
    "meta": {
        "total-pages": 1
    }
}

Event Names