CaveloInstall

Summary

Search access audit events by filtering on actions, resource types, source types, users, date and time ranges, and quick filters such as suspicious, off-hours, failed, or external access only.

Inputs

• Quick Filters — Boolean filters to restrict results to suspicious activity, off-hours access, failed attempts, or external IP accesses.
• Actions — List of actions to include in results (e.g., read, write, delete, download, copy).
• Resource Types — List of resource types to filter (e.g., file, database, email, OneDrive).
• Source Types — List of source categories to include (e.g., agent, Box Cloud, Office 365).
• Source UUIDs — Comma-separated UUIDs of sources to filter by.
• User Principals — Comma-separated user principals (user identifiers) to filter audit events.
• Date Range — Preset date ranges or custom date ranges for event time filtering.
• Custom Date Range — Custom start and end date/time to restrict events by their event time.
• Time Range — Start and end hour (0-23) to limit events within specific daily time windows.
• Sort By — Sorting order of results, e.g., by event time, user principal, resource name, or action, either ascending or descending.
• Limit — Maximum number of audit events to return; set to 0 for no limit.

Output shape

a list of access audit event objects

Each returned event may include additional computed properties such as whether the event occurred during business hours and a calculated risk score. Results respect the specified sorting, filtering, and limit parameters.