Configuring Event Reports

PreviousEvent Reports NextExcluding Paths From Event Reports

Last updated 3 months ago

Configuring Event Reports

See also. Event Reports configuration uses GuardMode Agent’s REST API. For a full list of available commands, see .

Configuring Event Reports is available through the Agent’s REST API (accessible from http://localhost:5000/swagger).

Viewing Event Reports configuration

To view the current Event Reports configuration, send a GET request to /settings/reports/file-event-report:

By default, Event Reports use the following settings:

enabled: false
Time zone: UTC
Reporting time: 08:00 AM

Listing time zones

To get the list of available time zones, send a GET request to /settings/timezones:

Listed time zones include offset, which accounts for daylight saving time.

Modifying Event Reports configuration

You can enable Event Reports and set the time zone using a PUT request to /settings/reports/file-event-report:

Managing Included Paths for Event Reports

To view the current list of included paths for Event Reports, send a GET request to /settings/reports/file-event-report/included-paths:

This endpoint returns a list of paths that are currently included in the Event Reports. Each path in this list is checked against the excluded paths to determine if it should be included in the report.

Adding Included Paths

To add a new path to the list of included paths, send a POST request to /settings/reports/file-event-report/included-paths:

Deleting Included Paths

To remove a path from the list of included paths, send a DELETE request to /settings/reports/file-event-report/included-paths/{id}:

Replace {id} with the identifier of the path you want to remove. You can obtain this identifier from the response of the GET request to view included paths.

Attention! Be specific with your paths to avoid unintentional exclusions. For example, including /var/foo and excluding /var/foo/bar will include /var/foo/baz.txt but exclude /var/foo/bar/other1/test.bin.

Adding Event Reports reporting hours

To add new Event Reports reporting time, send a POST request to /settings/reports/file-event-report/hours with the time in HH:MM:SS format.

Deleting Event Reports reporting hours

You can remove reporting hours using a DELETE request to /settings/reports/file-event-report/hours with the time you want to remove in HH:MM:SS format.

Tip. Event Reports require at least one reporting hour to work. Trying to remove the only remaining reporting hour will result in an error.

PreviousEvent Reports NextExcluding Paths From Event Reports

Last updated 3 months ago

PUT /settings/reports/file-event-report HTTP/1.1 Host: Authorization: Basic username:password api-version: text Content-Type: application/json-patch+json Accept: */* Content-Length: 16 { "enabled": true }

POST /settings/reports/file-event-report/included-paths HTTP/1.1 Host: Authorization: Basic username:password api-version: text Content-Type: application/json-patch+json Accept: */* Content-Length: 29 { "path": "text", "user": "text" }

POST /settings/reports/file-event-report/hours HTTP/1.1 Host: Authorization: Basic username:password api-version: text Content-Type: application/json-patch+json Accept: */* Content-Length: 19 { "hour": "06:39:45" }

Viewing Event Reports configuration

Listing time zones

Modifying Event Reports configuration

Managing Included Paths for Event Reports

Adding Included Paths

Deleting Included Paths

Adding Event Reports reporting hours

Deleting Event Reports reporting hours

Viewing Event Reports configuration

Listing time zones

Modifying Event Reports configuration

Managing Included Paths for Event Reports

Adding Included Paths

Deleting Included Paths

Adding Event Reports reporting hours

Deleting Event Reports reporting hours

Returns current timezone configuration