cloudflare-audit-logs
Get audit logs from Cloudflare service.
Syntax
cloudflare-audit-logs [profile=PROFILE] [duration=NUM{mon|w|d|h|m|s}] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss] [order=ORDER] [actor-email=ACTOR-EMAIL] [actor-ip=ACTOR-IP] [action-type=ACTION-TYPE]
Options
- profile=PROFILE
- Optional. Connect profile code of Cloudflare
- duration=NUM{mon|w|d|h|m|s}
- Optional. Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example,
10smeans data from 10 seconds earlier. - from=yyyyMMddHHmmss
- Optional. Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
- to=yyyyMMddHHmmss
- Optional. End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
- order=ORDER
- Optional. asc or desc. (default desc)
- actor-email=ACTOR-EMAIL
- Optional. Search logs matching actor's email.
- actor-ip=ACTOR-IP
- Optional. Search logs matching actor's ip.
- action-type=ACTION-TYPE
- Optional. Search logs matching action's type.
Output Fields
| Field | Type | Name | Description |
|---|---|---|---|
| profile | String | Connect profile | Cloudflare connect profile code |
| id | String | ID | Unique identifier for the audit log entry |
| action_result | Bool | Action Result | Result of the performed action |
| action_type | String | Action Type | Type of action performed |
| action_info | String | Action Info | Additional information about the action |
| actor_id | String | Actor ID | Identifier of the actor who performed the action |
| actor_email | String | Actor Email | Email address of the actor |
| actor_ip | IP address | Actor IP | IP address of the actor |
| actor_type | String | Actor Type | Type of the actor |
| iface | String | Interface | Interface where the action occurred |
| metadata | Map | Metadata | Additional metadata about the event |
| new_value | String | New Value | New value after the change |
| new_value_json | Map | New Value JSON | New value in JSON format |
| old_value | String | Old Value | Previous value before the change |
| old_value_json | Map | Old Value JSON | Previous value in JSON format |
| owner_id | String | Owner ID | Identifier of the resource owner |
| owner_type | String | Owner Type | Type of the resource owner |
| _time | Date | Event Time | Time when the event occurred |
| resource_id | String | Resource ID | Identifier of the affected resource |
| resource_type | String | Resource Type | Type of the affected resource |