Configuring Event Reports

See also. Event Reports configuration uses GuardMode Agent's REST API. For a full list of available commands, see REST API documentation.

Configuring Event Reports is available through the Agent’s REST API (accessible from http://localhost:5000/swagger).

Viewing Event Reports configuration

To view the current Event Reports configuration, send a GET request to /settings/reports/file-event-report:

GET/settings/reports/file-event-report

Header parameters

Response

200

Success

Body

text/plainapplication/jsontext/json

enabled*boolean

scheduledHours*array of string (time)

Request

JavaScriptCurlPython

const response = await fetch('/settings/reports/file-event-report', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

{
  "enabled": false,
  "scheduledHours": [
    "text"
  ]
}

By default, Event Reports use the following settings:

• enabled: false

• Time zone: UTC

• Reporting time: 08:00 AM

Listing time zones

To get the list of available time zones, send a GET request to /settings/timezones:

Returns current timezone configuration

GET/settings/timezone

Header parameters

Response

200

Current timezone configuration

Body

text/plainapplication/jsontext/json

timeZone*TimeZoneResponse (object)

Timezone information

Request

JavaScriptCurlPython

const response = await fetch('/settings/timezone', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

{
  "timeZone": {
    "id": "text",
    "offset": "text"
  }
}

Listed time zones include offset, which accounts for daylight saving time.

Modifying Event Reports configuration

You can enable Event Reports and set the time zone using a PUT request to /settings/reports/file-event-report:

PUT/settings/reports/file-event-report

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

enabled*boolean

Response

200400

Success

Body

text/plainapplication/jsontext/json

enabled*boolean

scheduledHours*array of string (time)

Request

JavaScriptCurlPython

const response = await fetch('/settings/reports/file-event-report', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "enabled": false
    }),
});
const data = await response.json();

Response

200400

{
  "enabled": false,
  "scheduledHours": [
    "text"
  ]
}

Managing Included Paths for Event Reports

Tip. This feature is only available on GuardMode 2024.1 or higher.

To view the current list of included paths for Event Reports, send a GET request to /settings/reports/file-event-report/included-paths:

GET/settings/reports/file-event-report/included-paths

Header parameters

Response

200

Success

Body

text/plainapplication/jsontext/json

id*string (uuid)

Included path identifier

path*string

Path to include

usernullable string

Username for which the path should be included in file event reports

Request

JavaScriptCurlPython

const response = await fetch('/settings/reports/file-event-report/included-paths', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

[
  {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "path": "text",
    "user": "text"
  }
]

This endpoint returns a list of paths that are currently included in the Event Reports. Each path in this list is checked against the excluded paths to determine if it should be included in the report.

Adding Included Paths

To add a new path to the list of included paths, send a POST request to /settings/reports/file-event-report/included-paths:

POST/settings/reports/file-event-report/included-paths

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

path*string

Path to include

usernullable string

Username for which the path should be included in file event reports

Response

201400409

Created

Body

text/plainapplication/jsontext/json

id*string (uuid)

Included path identifier

path*string

Path to include

usernullable string

Username for which the path should be included in file event reports

Request

JavaScriptCurlPython

const response = await fetch('/settings/reports/file-event-report/included-paths', {
    method: 'POST',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "path": "text"
    }),
});
const data = await response.json();

Response

201400409

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "path": "text",
  "user": "text"
}

Deleting Included Paths

To remove a path from the list of included paths, send a DELETE request to /settings/reports/file-event-report/included-paths/{id}:

DELETE/settings/reports/file-event-report/included-paths/{id}

Path parameters

id*string (uuid)

Header parameters

Response

204400

No Content

Request

JavaScriptCurlPython

const response = await fetch('/settings/reports/file-event-report/included-paths/{id}', {
    method: 'DELETE',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

400

{
  "type": "text",
  "title": "text",
  "detail": "text",
  "instance": "text"
}

Replace {id} with the identifier of the path you want to remove. You can obtain this identifier from the response of the GET request to view included paths.

Attention! Be specific with your paths to avoid unintentional exclusions. For example, including /var/foo and excluding /var/foo/bar will include /var/foo/baz.txt but exclude /var/foo/bar/other1/test.bin.

Adding Event Reports reporting hours

To add new Event Reports reporting time, send a POST request to /settings/reports/file-event-report/hours with the time in HH:MM:SS format.

POST/settings/reports/file-event-report/hours

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

hour*string (time)

Response

200400409

Success

Body

text/plainapplication/jsontext/json

enabled*boolean

scheduledHours*array of string (time)

Request

JavaScriptCurlPython

const response = await fetch('/settings/reports/file-event-report/hours', {
    method: 'POST',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "hour": "text"
    }),
});
const data = await response.json();

Response

200400409

{
  "enabled": false,
  "scheduledHours": [
    "text"
  ]
}

Deleting Event Reports reporting hours

You can remove reporting hours using a DELETE request to /settings/reports/file-event-report/hours with the time you want to remove in HH:MM:SS format.

DELETE/settings/reports/file-event-report/hours

Query parameters

Header parameters

Response

200400422

Success

Body

text/plainapplication/jsontext/json

enabled*boolean

scheduledHours*array of string (time)

Request

JavaScriptCurlPython

const response = await fetch('/settings/reports/file-event-report/hours', {
    method: 'DELETE',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200400422

{
  "enabled": false,
  "scheduledHours": [
    "text"
  ]
}

Tip. Event Reports require at least one reporting hour to work. Trying to remove the only remaining reporting hour will result in an error.