exosp-device-file-transfer-logs
Fetch device file transfer logs for specified date range from Exosphere service.
exosp-device-file-transfer-logs [profile=PROFILE] [duration=NUM{mon|w|d|h|m|s}] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss] [order=ORDER]
- profile=PROFILE
- Connect profile code of Exosphere
- duration=NUM{mon|w|d|h|m|s}
- Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example,
10smeans data from 10 seconds earlier. - from=yyyyMMddHHmmss
- Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
- to=yyyyMMddHHmmss
- End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
- order=ORDER
- asc or desc.
Output Fields
| Field | Type | Name | Description |
|---|---|---|---|
| _time | Date | Timestamp | Event occurrence time |
| profile | String | Connect profile | Exosphere connect profile code |
| emp_name | String | Name | e.g. Scott |
| dept_name | String | Department name | e.g. Sales |
| hostname | String | Hostname | e.g. DESKTOP-XXXXXXX |
| os_name | String | OS name | e.g. windows, macos |
| user | String | User | OS account name |
| category | String | Device category | e.g. Mobile Devices, Removable Disk, USB Tethering |
| device_description | String | Device description | e.g. VendorCo ProductCode USB Device |
| file_name | String | File name | Name of the exported file from the device |
| file_size | Long | File size | Size of the exported file from the device |
| action | String | Action | e.g. PERMIT, BLOCK |
| file_path | String | File path | Path of the exported file from the device |
| device_serial | String | Device serial | Unique serial number of the device |
| device_class_name | String | Device class Name | e.g. DiskDrive |
| device_class_guid | String | Device class GUID | e.g. {4d36e967-e325-11ce-bfc1-08002be10318} |
| device_hardware_id | String | Device hardware ID | e.g. USBSTOR\DiskVendorCoProductCode_____2.00 |
| device_instance_id | String | Device instance ID | e.g. USBSTOR\DISK&VEN_VENDORCO&PROD_PRODUCTCODE&REV_2.00\1111111111111111111&0 |
| volume_name | String | Volume name | Volume name (macOS) |
| volume_size | String | Volume size | Volume capacity (macOS) |
| volume_uuid | String | Volume UUID | Volume UUID (macOS) |
| dept_path | String | Department path | e.g. Logpresso > Sales |