## GetAuditLog **post** `/gitpod.v1.EventService/GetAuditLog` Gets one audit-log entry, including any typed details stored for it. Use this method to: - Inspect the details of a specific audit-log entry - Retrieve the evidence associated with a Veto Exec audit event ### Examples - Get an audit-log entry: ```yaml auditLogEntryId: "d2c94c27-3b76-4a42-b88c-95a85e392c68" ``` ### Body Parameters - `auditLogEntryId: string` audit_log_entry_id is the ID of the audit-log entry to retrieve. ### Returns - `entry: object { id, action, actorId, 5 more }` entry contains the common audit-log fields also returned by ListAuditLogs. - `id: optional string` - `action: optional string` - `actorId: optional string` - `actorPrincipal: optional Principal` - `"PRINCIPAL_UNSPECIFIED"` - `"PRINCIPAL_ACCOUNT"` - `"PRINCIPAL_USER"` - `"PRINCIPAL_RUNNER"` - `"PRINCIPAL_ENVIRONMENT"` - `"PRINCIPAL_SERVICE_ACCOUNT"` - `"PRINCIPAL_RUNNER_MANAGER"` - `createdAt: optional string` A Timestamp represents a point in time independent of any time zone or local calendar, encoded as a count of seconds and fractions of seconds at nanosecond resolution. The count is relative to an epoch at UTC midnight on January 1, 1970, in the proleptic Gregorian calendar which extends the Gregorian calendar backwards to year one. All minutes are 60 seconds long. Leap seconds are "smeared" so that no leap second table is needed for interpretation, using a [24-hour linear smear](https://developers.google.com/time/smear). The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By restricting to that range, we ensure that we can convert to and from [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) date strings. # Examples Example 1: Compute Timestamp from POSIX `time()`. Timestamp timestamp; timestamp.set_seconds(time(NULL)); timestamp.set_nanos(0); Example 2: Compute Timestamp from POSIX `gettimeofday()`. struct timeval tv; gettimeofday(&tv, NULL); Timestamp timestamp; timestamp.set_seconds(tv.tv_sec); timestamp.set_nanos(tv.tv_usec * 1000); Example 3: Compute Timestamp from Win32 `GetSystemTimeAsFileTime()`. FILETIME ft; GetSystemTimeAsFileTime(&ft); UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime; // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z. Timestamp timestamp; timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL)); timestamp.set_nanos((INT32) ((ticks % 10000000) * 100)); Example 4: Compute Timestamp from Java `System.currentTimeMillis()`. long millis = System.currentTimeMillis(); Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000) .setNanos((int) ((millis % 1000) * 1000000)).build(); Example 5: Compute Timestamp from Java `Instant.now()`. Instant now = Instant.now(); Timestamp timestamp = Timestamp.newBuilder().setSeconds(now.getEpochSecond()) .setNanos(now.getNano()).build(); Example 6: Compute Timestamp from current time in Python. timestamp = Timestamp() timestamp.GetCurrentTime() # JSON Mapping In JSON format, the Timestamp type is encoded as a string in the [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) format. That is, the format is "{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z" where {year} is always expressed using four digits while {month}, {day}, {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution), are optional. The "Z" suffix indicates the timezone ("UTC"); the timezone is required. A proto3 JSON serializer should always use UTC (as indicated by "Z") when printing the Timestamp type and a proto3 JSON parser should be able to accept both UTC and other timezones (as indicated by an offset). For example, "2017-01-15T01:30:15.01Z" encodes 15.01 seconds past 01:30 UTC on January 15, 2017. In JavaScript, one can convert a Date object to this format using the standard [toISOString()](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/toISOString) method. In Python, a standard `datetime.datetime` object can be converted to this format using [`strftime`](https://docs.python.org/2/library/time.html#time.strftime) with the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one can use the Joda Time's [`ISODateTimeFormat.dateTime()`](http://joda-time.sourceforge.net/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime\(\)) to obtain a formatter capable of generating timestamps in this format. - `kind: optional "AUDIT_LOG_ENTRY_KIND_UNSPECIFIED" or "AUDIT_LOG_ENTRY_KIND_AGENT_SECURITY_EXEC_BLOCKED" or "AUDIT_LOG_ENTRY_KIND_AGENT_SECURITY_EXEC_AUDITED"` AuditLogEntryKind identifies the semantic event represented by an audit-log entry. - `"AUDIT_LOG_ENTRY_KIND_UNSPECIFIED"` - `"AUDIT_LOG_ENTRY_KIND_AGENT_SECURITY_EXEC_BLOCKED"` - `"AUDIT_LOG_ENTRY_KIND_AGENT_SECURITY_EXEC_AUDITED"` - `subjectId: optional string` - `subjectType: optional ResourceType` - `"RESOURCE_TYPE_UNSPECIFIED"` - `"RESOURCE_TYPE_ENVIRONMENT"` - `"RESOURCE_TYPE_RUNNER"` - `"RESOURCE_TYPE_PROJECT"` - `"RESOURCE_TYPE_TASK"` - `"RESOURCE_TYPE_TASK_EXECUTION"` - `"RESOURCE_TYPE_SERVICE"` - `"RESOURCE_TYPE_ORGANIZATION"` - `"RESOURCE_TYPE_USER"` - `"RESOURCE_TYPE_ENVIRONMENT_CLASS"` - `"RESOURCE_TYPE_RUNNER_SCM_INTEGRATION"` - `"RESOURCE_TYPE_HOST_AUTHENTICATION_TOKEN"` - `"RESOURCE_TYPE_GROUP"` - `"RESOURCE_TYPE_PERSONAL_ACCESS_TOKEN"` - `"RESOURCE_TYPE_USER_PREFERENCE"` - `"RESOURCE_TYPE_SERVICE_ACCOUNT"` - `"RESOURCE_TYPE_SECRET"` - `"RESOURCE_TYPE_SSO_CONFIG"` - `"RESOURCE_TYPE_DOMAIN_VERIFICATION"` - `"RESOURCE_TYPE_AGENT_EXECUTION"` - `"RESOURCE_TYPE_RUNNER_LLM_INTEGRATION"` - `"RESOURCE_TYPE_AGENT"` - `"RESOURCE_TYPE_ENVIRONMENT_SESSION"` - `"RESOURCE_TYPE_USER_SECRET"` - `"RESOURCE_TYPE_ORGANIZATION_POLICY"` - `"RESOURCE_TYPE_ORGANIZATION_SECRET"` - `"RESOURCE_TYPE_PROJECT_ENVIRONMENT_CLASS"` - `"RESOURCE_TYPE_BILLING"` - `"RESOURCE_TYPE_PROMPT"` - `"RESOURCE_TYPE_COUPON"` - `"RESOURCE_TYPE_COUPON_REDEMPTION"` - `"RESOURCE_TYPE_ACCOUNT"` - `"RESOURCE_TYPE_INTEGRATION"` - `"RESOURCE_TYPE_WORKFLOW"` - `"RESOURCE_TYPE_WORKFLOW_EXECUTION"` - `"RESOURCE_TYPE_WORKFLOW_EXECUTION_ACTION"` - `"RESOURCE_TYPE_SNAPSHOT"` - `"RESOURCE_TYPE_PREBUILD"` - `"RESOURCE_TYPE_ORGANIZATION_LLM_INTEGRATION"` - `"RESOURCE_TYPE_CUSTOM_DOMAIN"` - `"RESOURCE_TYPE_ROLE_ASSIGNMENT_CHANGED"` - `"RESOURCE_TYPE_GROUP_MEMBERSHIP_CHANGED"` - `"RESOURCE_TYPE_WEBHOOK"` - `"RESOURCE_TYPE_SCIM_CONFIGURATION"` - `"RESOURCE_TYPE_SERVICE_ACCOUNT_SECRET"` - `"RESOURCE_TYPE_ANNOUNCEMENT_BANNER"` - `"RESOURCE_TYPE_SERVICE_ACCOUNT_TOKEN"` - `"RESOURCE_TYPE_ROLE_ASSIGNMENT"` - `"RESOURCE_TYPE_WARM_POOL"` - `"RESOURCE_TYPE_NOTIFICATION"` - `"RESOURCE_TYPE_SECURITY_POLICY"` - `"RESOURCE_TYPE_BASE_SNAPSHOT"` - `"RESOURCE_TYPE_BASE_SNAPSHOT_CONFIG"` - `details: optional AuditLogEntryDetails` details contains typed evidence captured with the audit entry. It is absent when the entry has no supported, valid details. - `vetoExec: object { process, timestamp, action, 3 more }` veto_exec contains Veto Exec event details without process.cmdline. - `process: Process` process contains metadata about the process that triggered the event. - `name: optional string` name is the process name (comm). 2x kernel TASK_COMM_LEN=16 - `pgid: optional number` pgid is the process group ID. - `pid: optional number` pid is the userspace process ID (kernel thread group ID, tgid). - `ppid: optional number` ppid is the parent process ID. - `sid: optional number` sid is the session ID. - `startedAt: optional string` started_at is when the process started. - `tid: optional number` tid is the userspace thread ID (kernel pid). - `timestamp: string` timestamp is when the event occurred in the environment. - `action: optional KernelControlsAction` action is the enforcement action taken (block or audit). - `"KERNEL_CONTROLS_ACTION_UNSPECIFIED"` - `"KERNEL_CONTROLS_ACTION_BLOCK"` - `"KERNEL_CONTROLS_ACTION_AUDIT"` - `environmentId: optional string` environment_id is the environment where the event occurred. - `executable: optional string` executable is the digest of the binary content (e.g., "sha256:a1b2c3d4..."). 256 allows for longer hash algorithms or prefixed identifiers. May be empty when the event source cannot compute the hash. - `filename: optional string` filename is the kernel-resolved path of the binary. Kernel PATH_MAX = 4096 (include/uapi/linux/limits.h). May be empty if the event source could not resolve it. ### Example ```http curl https://app.gitpod.io/api/gitpod.v1.EventService/GetAuditLog \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $GITPOD_API_KEY" \ -d '{ "auditLogEntryId": "d2c94c27-3b76-4a42-b88c-95a85e392c68" }' ``` #### Response ```json { "entry": { "id": "id", "action": "action", "actorId": "actorId", "actorPrincipal": "PRINCIPAL_UNSPECIFIED", "createdAt": "2019-12-27T18:11:19.117Z", "kind": "AUDIT_LOG_ENTRY_KIND_UNSPECIFIED", "subjectId": "subjectId", "subjectType": "RESOURCE_TYPE_UNSPECIFIED" }, "details": { "vetoExec": { "process": { "cmdline": "cmdline", "name": "name", "pgid": 0, "pid": 0, "ppid": 0, "sid": 0, "startedAt": "2019-12-27T18:11:19.117Z", "tid": 0 }, "timestamp": "2019-12-27T18:11:19.117Z", "action": "KERNEL_CONTROLS_ACTION_UNSPECIFIED", "environmentId": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "executable": "executable", "filename": "filename" } } } ```