Configuring Event Reports

See also. Event Reports configuration uses GuardMode Agent's REST API. For a full list of available commands, see REST API documentation.

Configuring Event Reports is available through the Agent’s REST API (accessible from http://localhost:5000/swagger).

Viewing Event Reports configuration

To view the current Event Reports configuration, send a GET request to /settings/reports/file-event-report:

get

/settings/reports/file-event-report

Authorizations

Header parameters

api-versionstringrequired

Responses

text/plainapplication/jsontext/json

cURL

JavaScript

Python

HTTP

cURL

curl -L \
  --url '/settings/reports/file-event-report' \
  --header 'Authorization: Basic username:password' \
  --header 'api-version: text'

200

200

text/plain

application/json

text/json

text/plain

{
  "enabled": true,
  "scheduledHours": [
    "07:01:02"
  ]
}

Success

By default, Event Reports use the following settings:

• enabled: false

• Time zone: UTC

• Reporting time: 08:00 AM

Listing time zones

To get the list of available time zones, send a GET request to /settings/timezones:

Returns current timezone configuration

get

/settings/timezone

Authorizations

Header parameters

api-versionstringrequired

Responses

text/plainapplication/jsontext/json

cURL

JavaScript

Python

HTTP

cURL

curl -L \
  --url '/settings/timezone' \
  --header 'Authorization: Basic username:password' \
  --header 'api-version: text'

200

200

text/plain

application/json

text/json

text/plain

{
  "timeZone": {
    "id": "text",
    "offset": "text"
  }
}

Current timezone configuration

Listed time zones include offset, which accounts for daylight saving time.

Modifying Event Reports configuration

You can enable Event Reports and set the time zone using a PUT request to /settings/reports/file-event-report:

put

/settings/reports/file-event-report

Authorizations

Header parameters

api-versionstringrequired

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

enabledbooleanrequired

Responses

text/plainapplication/jsontext/json

text/plainapplication/jsontext/json

cURL

JavaScript

Python

HTTP

cURL

curl -L \
  --request PUT \
  --url '/settings/reports/file-event-report' \
  --header 'Authorization: Basic username:password' \
  --header 'api-version: text' \
  --header 'Content-Type: application/json-patch+json' \
  --data '{
    "enabled": true
  }'

200

400

200

text/plain

application/json

text/json

text/plain

{
  "enabled": true,
  "scheduledHours": [
    "07:01:02"
  ]
}

Success

Managing Included Paths for Event Reports

Tip. This feature is only available on GuardMode 2024.1 or higher.

To view the current list of included paths for Event Reports, send a GET request to /settings/reports/file-event-report/included-paths:

get

/settings/reports/file-event-report/included-paths

Authorizations

Header parameters

api-versionstringrequired

Responses

text/plainapplication/jsontext/json

cURL

JavaScript

Python

HTTP

cURL

curl -L \
  --url '/settings/reports/file-event-report/included-paths' \
  --header 'Authorization: Basic username:password' \
  --header 'api-version: text'

200

200

text/plain

application/json

text/json

text/plain

[
  {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "path": "text",
    "user": "text"
  }
]

Success

This endpoint returns a list of paths that are currently included in the Event Reports. Each path in this list is checked against the excluded paths to determine if it should be included in the report.

Adding Included Paths

To add a new path to the list of included paths, send a POST request to /settings/reports/file-event-report/included-paths:

post

/settings/reports/file-event-report/included-paths

Authorizations

Header parameters

api-versionstringrequired

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

pathstring · min: 1required

Path to include

userstring | nullable

Username for which the path should be included in file event reports

Responses

text/plainapplication/jsontext/json

text/plainapplication/jsontext/json

text/plainapplication/jsontext/json

cURL

JavaScript

Python

HTTP

cURL

curl -L \
  --request POST \
  --url '/settings/reports/file-event-report/included-paths' \
  --header 'Authorization: Basic username:password' \
  --header 'api-version: text' \
  --header 'Content-Type: application/json-patch+json' \
  --data '{
    "path": "text",
    "user": "text"
  }'

201

400

409

201

text/plain

application/json

text/json

text/plain

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "path": "text",
  "user": "text"
}

Created

Deleting Included Paths

To remove a path from the list of included paths, send a DELETE request to /settings/reports/file-event-report/included-paths/{id}:

delete

/settings/reports/file-event-report/included-paths/{id}

Authorizations

Path parameters

idstring · uuidrequired

Header parameters

api-versionstringrequired

Responses

text/plainapplication/jsontext/json

cURL

JavaScript

Python

HTTP

cURL

curl -L \
  --request DELETE \
  --url '/settings/reports/file-event-report/included-paths/{id}' \
  --header 'Authorization: Basic username:password' \
  --header 'api-version: text'

204

400

204

No body

No Content

Replace {id} with the identifier of the path you want to remove. You can obtain this identifier from the response of the GET request to view included paths.

Attention! Be specific with your paths to avoid unintentional exclusions. For example, including /var/foo and excluding /var/foo/bar will include /var/foo/baz.txt but exclude /var/foo/bar/other1/test.bin.

Adding Event Reports reporting hours

To add new Event Reports reporting time, send a POST request to /settings/reports/file-event-report/hours with the time in HH:MM:SS format.

post

/settings/reports/file-event-report/hours

Authorizations

Header parameters

api-versionstringrequired

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

hourstring · timerequired

Responses

text/plainapplication/jsontext/json

text/plainapplication/jsontext/json

text/plainapplication/jsontext/json

cURL

JavaScript

Python

HTTP

cURL

curl -L \
  --request POST \
  --url '/settings/reports/file-event-report/hours' \
  --header 'Authorization: Basic username:password' \
  --header 'api-version: text' \
  --header 'Content-Type: application/json-patch+json' \
  --data '{
    "hour": "07:01:02"
  }'

200

400

409

200

text/plain

application/json

text/json

text/plain

{
  "enabled": true,
  "scheduledHours": [
    "07:01:02"
  ]
}

Success

Deleting Event Reports reporting hours

You can remove reporting hours using a DELETE request to /settings/reports/file-event-report/hours with the time you want to remove in HH:MM:SS format.

delete

/settings/reports/file-event-report/hours

Authorizations

Query parameters

hourstring · time

Header parameters

api-versionstringrequired

Responses

text/plainapplication/jsontext/json

text/plainapplication/jsontext/json

text/plainapplication/jsontext/json

cURL

JavaScript

Python

HTTP

cURL

curl -L \
  --request DELETE \
  --url '/settings/reports/file-event-report/hours' \
  --header 'Authorization: Basic username:password' \
  --header 'api-version: text'

200

400

422

200

text/plain

application/json

text/json

text/plain

{
  "enabled": true,
  "scheduledHours": [
    "07:01:02"
  ]
}

Success

Tip. Event Reports require at least one reporting hour to work. Trying to remove the only remaining reporting hour will result in an error.