Search Cloud Activities

Search cloud activities by invoking the following endpoint:

POST https://YourAccount.lacework.net/api/v2/CloudActivities/search

Optionally specify filters in the request body. For more information about using filters, see the Simple & Advanced Search section.

For the timeFilter filter, these are the supported time formats:

• yyyy-MM-dd for example, 2021-12-18

• yyyy-MM-ddTHH for example, 2021-12-18T08

• yyyy-MM-ddTHH:mm:ssZ for example, 2021-12-18T08:00:00Z

• yyyy-MM-ddTHH:mm:ss.SSSZ for example, 2021-12-18T08:00:00.000Z

The rlike and not_rlike operators are useful for filtering results. For example, the following expression limits results to the CreateTags API:

"filters": [ { "expression": "rlike", "field": "entityMap.API", "value": ".CreateTags." } ]

Here is another example that shows how to limit results to those with the numeric pattern specified as the resource ID:

"filters": [ { "expression": "rlike", "field": "entityMap.Resource", "value": ".3\.0\.529\.0." } ]

Here are some additional example body payloads:

• { "timeFilter": { "startTime": "2021-12-11T00:00:00Z", "endTime": "2021-12-12T00:00:00Z"}, "filters": [ { "field": "eventType", "expression": "eq", "value": "NewUser" } ] }
• { "timeFilter": { "startTime": "2021-12-11T00:00:00Z", "endTime": "2021-12-12T00:00:00Z"}, "filters": [ { "field": "eventType", "expression": "eq", "value": "NewUser" },
  { "field": "eventModel", "expression": "eq", "value": "AwsApiTracker" } ],
  "returns":[ "startTime", "endTime", "eventType", "eventActor", "eventModel" ] }

To use the current time as the end time, exclude the endTime field.