exosp-webfilter-logs

Fetch web filter logs for specified date range from Exosphere service.

exosp-webfilter-logs [profile=PROFILE] [duration=NUM{mon|w|d|h|m|s}] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss] [order=ORDER]

profile=PROFILE: Connect profile code of Exosphere
duration=NUM{mon|w|d|h|m|s}: Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example, 10s means data from 10 seconds earlier.
from=yyyyMMddHHmmss: Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
to=yyyyMMddHHmmss: End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
order=ORDER: asc or desc.

Output Fields

Field	Type	Name	Description
_time	Date	Event time
profile	String	Connect profile	Exosphere connect profile code
emp_name	String	Employee name	e.g. Scott
dept_name	String	Department name	e.g. HR
hostname	String	Hostname	e.g. Scott's MacBook pro
os_name	String	OS name	e.g. windows, macos
user	String	User	e.g. scott
category	String	category	e.g. malicious_url, potentially_unwanted_website
title	String	Site title
url	String	URL	Without scheme. e.g. requestcatcher.com
action	String	Action	e.g. DETECT, BLOCK
dept_path	String	Department path	e.g. Logpresso > HR
sha256	String	SHA256	URL hash