Actions75
- EndpointAutopilot Actions
- TenantAdministrationAlerts Actions
- EndpointMEM Actions
- TenantGDAP Actions
- TenantAdministrationApplicationApproval Actions
- TenantAdministration Actions
- CIPPSetup Actions
- Security Actions
- IdentityAdministrationDevices Actions
- CIPPExtensions Actions
- EmailExchangeTools Actions
TenantAdministrationAlerts → ExecAuditLogSearch
AI-generatedOverview
This node performs an audit log search within the Tenant Administration Alerts resource of the CIPP API. It is useful for querying audit logs related to tenant activities, enabling administrators to monitor and analyze tenant operations. For example, it can be used to search audit logs for specific actions, time ranges, or search IDs within a tenant or across all tenants.
Use Case Examples
- Search audit logs for a specific tenant domain to track user activities.
- Query audit logs with filters such as action type and time range to investigate security incidents.
Properties
| Name | Meaning |
|---|---|
| Tenant Filter | Target tenant domain or 'AllTenants' for multi-tenant operations. |
| Action | Filter by specific action in the audit log. |
| Search Id | Filter by a specific search ID. |
| End Time | Filter audit logs up to this end time. |
| Start Time | Filter audit logs starting from this start time. |
| PSObject | Additional PowerShell object filter for the search. |
Output
JSON
json- The JSON response from the audit log search API call containing audit log entries and metadata.
Dependencies
- CIPP API with appropriate API key credentials
Troubleshooting
- Ensure the tenant filter is correctly specified as a valid tenant domain or 'AllTenants'.
- Verify that the API credentials are valid and have permissions to access audit logs.
- Check the format of additional fields like Action, Search Id, Start Time, and End Time to match API expectations.
- If the node returns an error, enable debug mode to inspect the actual request and response details for troubleshooting.