cloudflare-audit-logs-v2
Get audit logs from Cloudflare account audit logs v2 API.
Syntax
cloudflare-audit-logs-v2 [profile=PROFILE] [duration=NUM{mon|w|d|h|m|s}] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss] [order=ORDER] [actor-email=ACTOR-EMAIL] [actor-ip=ACTOR-IP] [action-type=ACTION-TYPE] [resource-type=RESOURCE-TYPE]
Options
- profile=PROFILE
- Optional. Connect profile code of Cloudflare
- duration=NUM{mon|w|d|h|m|s}
- Optional. Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example,
10smeans data from 10 seconds earlier. - from=yyyyMMddHHmmss
- Optional. Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
- to=yyyyMMddHHmmss
- Optional. End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
- order=ORDER
- Optional. asc or desc. (default desc)
- actor-email=ACTOR-EMAIL
- Optional. Search logs matching actor's email.
- actor-ip=ACTOR-IP
- Optional. Search logs matching actor's ip.
- action-type=ACTION-TYPE
- Optional. Search logs matching action's type (create/delete/view/update).
- resource-type=RESOURCE-TYPE
- Optional. Search logs matching resource's type.
Output Fields
| Field | Type | Name | Description |
|---|---|---|---|
| profile | String | Connect profile | Cloudflare connect profile code |
| _time | Date | Event Time | Time when the event occurred |
| id | String | ID | Unique identifier for the audit log entry |
| action_type | String | Action Type | Type of action performed |
| action_result | Bool | Action Result | Whether the action succeeded |
| action_info | String | Action Info | Description of the action |
| actor_id | String | Actor ID | Identifier of the actor |
| actor_email | String | Actor Email | Email address of the actor |
| actor_ip | IP address | Actor IP | IP address of the actor |
| actor_type | String | Actor Type | Type of the actor |
| actor_context | String | Actor Context | Authentication context of the actor |
| actor_token_id | String | Actor Token ID | API token identifier used by the actor |
| actor_token_name | String | Actor Token Name | API token name used by the actor |
| resource_id | String | Resource ID | Identifier of the affected resource |
| resource_type | String | Resource Type | Type of the affected resource |
| resource_product | String | Resource Product | Product of the affected resource |
| resource_scope | String | Resource Scope | Scope of the affected resource |
| raw_method | String | HTTP Method | HTTP method of the API request |
| raw_uri | String | URI | URI of the API request |
| raw_status_code | Integer | Status Code | HTTP status code of the API response |
| raw_cf_ray_id | String | CF Ray ID | Cloudflare Ray ID of the request |
| user_agent | String | User Agent | User agent of the request |
| zone_id | String | Zone ID | Identifier of the zone |
| zone_name | String | Zone Name | Name of the zone |
| account_id | String | Account ID | Identifier of the account |
| account_name | String | Account Name | Name of the account |