Security event log from System Monitor

This log records events related to adding, deleting, and otherwise changing user permissions. Security event logging is disabled by default and can be enabled only by the system administrator, directly in a FlexiCapture database. For more information, see Security event log.

Only users with System Administrator permissions can download security event logs from System Monitor. A System Administrator is the Administrator of a default tenant.

To download this log, use a POST request:

POST https://<server address>/FlexiCapture12/Monitoring/Tenant/GetSecurityEventsCSV

Request parameters

All parameters are required. Make sure that they are specified correctly.

The search in Oracle Database is case-sensitive. Take this into account if you use Oracle Database.

Parameter	Type	Description
`filter`	string	Filter conditions for the log. Combine conditions with the `AND` and `OR` operators only, set in the `GeneralOperator` parameter. For more information, see Build the filter parameter.
`columnsOrder`	string	Comma-separated list of columns to include in the report: `ID`, `Date`, `EventType`, `Details`, `RemoteHost`, `Principal`, `TenantName`, `Writer`, `WriterTenantName`.
`sortColumnindex`	int	Index of the column used to sort the records in the log.
`sortOrder`	bool	Sort order: `true` sorts in descending order, `false` sorts in ascending order.
`tenantId`	int	Tenants to include in the log: `-1` for all available tenants, `0` for the default tenant, or a specific tenant ID (`1` or greater).

Build the filter parameter

The filter parameter takes a JSON object. For example:

{
  "GeneralOperator": "AND",
  "FilterItems": [
    {
      "PropertyKey": "Date",
      "PropertyOperator": "BETWEEN",
      "PropertyValues": [
        "2021-08-28",
        "00:00:00",
        "2023-09-28",
        "23:59:59"
      ]
    }
  ]
}

To find the values for the PropertyKey and PropertyOperator parameters, create a filter in the Administration and Monitoring Console:

Open the browser developer tools

In the browser menu, click More tools → Developer tools, and go to the Network tab.

Create a filter in the console

Launch the Administration and Monitoring Console, go to System Monitor → Security event log, and click the

button.

Apply the filter criteria

Specify the filtering criteria and click Apply.

Read the filter parameters

Click the GetFilteredSecurityEvent request. The filtering parameters are listed on the Payload tab.

Example script

The following PowerShell script demonstrates how to use this API to download the security event log.

Replace the parameters in this script with your server address and your own credentials.

# parameters
$server = "https://<server address>"
$user = "<user name>"
$password = "<password>"
#path to folder where the log will be saved
$folder = "C:\Temp\Logs\Stage"
$reportFileName = "Tenant_SecurityEvents-{0:yyMMdd-HHmmss}.csv" -f (Get-Date)
# log parameters
$requestBody = @"
filter={
    "Name": "Filter",
    "GeneralOperator": "AND",
    "FilterItems": [
        {
            "PropertyKey": "Date",
            "PropertyOperator": "BETWEEN",
            "PropertyValues": [
                "2021-08-28",
                "00:00:00",
                "2023-09-28",
                "23:59:59"
            ]
        }
    ]
}
&columnsOrder=Id,Date,EventType,Details,RemoteHost,Principal,TenantName,Writer,WriterTenantName,
&sortColumnindex=1
&sortOrder=true
&tenantId=-1
"@
#------------------------------------------------------------------------------
$tenant = "" # Only default tenant
$methodUri = "/Tenant/GetSecurityEventsCSV"
$authServer = $server
$ServerSitePath = "/FlexiCapture12/Monitoring"

function Write-Line($str, $color = "White")
{
    Write-Host $str -ForegroundColor $color
}

function Join-Uri
{
    param([Parameter(Mandatory, ValueFromPipeline)] [string]$parent, [string]$child)
    if ($parent -eq "") {return $child;}
    if ($child -eq ""){return $parent}
    if ($parent.endswith("/") -or $parent.endswith("\\")) {$parent = $parent.substring(0,$parent.Length-1)}
    if ($child.startswith("/") -or $child.startswith("\\")) {$child = $child.substring(1,$child.Length-1)}
    return "$parent/$child"
}

function Get-AuthTicket($server, $user, $password, $tenant)
{
    $tenantSuffix=""
    if ($tenant -ne ''){ $tenantSuffix = "?tenant=$tenant"}
    $URL = Join-Uri $authServer "/FlexiCapture12/Server/FCAuth/API/Soap$tenantSuffix"
    $SOAPRequest = '<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><soap:Body><FindUser xmlns="urn:http://www.abbyy.com/FlexiCapture"><userLogin>user</userLogin></FindUser></soap:Body></soap:Envelope>'
    $Headers = @{
        'SOAPAction' = '"#FindUser"'
        'Content-Type' = 'text/xml; charset=utf-8'
        'Authorization' = "Basic $([System.Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes("$($user):$($password)")))"
    }
    try
    {
        $response1 = Invoke-WebRequest -Uri $URL -Headers $Headers -Body $SOAPRequest -Method 'POST'
        return $response1.Headers['AuthTicket']
    }
    catch{
        Write-Line -str "Couldn't get 'AuthTicket': $_" -color "Red"
        return ""
    }
}

function Download-CSVReport($server, $tenant, $authTicket, $methodUri, $requestBody, $folder, $reportFileName)
{
    $reportFullFilePath = Join-Path $folder $reportFileName
    #create folder silent (if not exist)
    New-Item -ItemType Directory -Force -Path $folder | Out-Null
    if ($authTicket -eq "" -or $authTicket -eq $null)
    {
        Write-Line -str "Couldn't get 'CSV-Report'" -color "Red"
    }
    else
    {
        $header = @{ "Accept" = "*/*"}
        $session = [Microsoft.PowerShell.Commands.WebRequestSession]::new()
        $session.Cookies.Add($server, [System.NET.Cookie]::new('FlexiCaptureTmpPrn', "Ticket=$authTicket"))
        $tenantInUrl=""
        if ($tenant -ne '') { $tenantInUrl = "/$tenant"}
        $uri = Join-Uri $server $ServerSitePath | Join-Uri -child $tenantInUrl | Join-Uri -child $methodUri
        try{
            $response = Invoke-WebRequest -Uri $uri -Method 'POST' -Headers $header -WebSession $session -Body $requestBody -OutFile $reportFullFilePath -MaximumRedirection 0 -ErrorAction Ignore -PassThru
            if ($response.StatusCode -lt 300)
            {
                Write-Line "CSV-Report done: $reportFullFilePath" "Green"
            }
            else
            {
                Write-Line -str "HttpStatus $($response.StatusCode) in getting CSV-Report." -color "Red"
            }
        }
        catch{
            Write-Line -str "Couldn't get CSV-Report: $_" -color "Red"
            return ""
        }
    }
}

$authTicket = Get-AuthTicket -server $server -user $user -password $password -tenant $tenant
Download-CSVReport -server $server -tenant $tenant -authTicket $authTicket -methodUri $methodUri -requestBody $requestBody -folder $folder -reportFileName $reportFileName

Programmer's Guide

Reporting Service

Security event log from System Monitor

Request parameters

Build the filter parameter

Example script

​Request parameters

​Build the filter parameter

​Example script

Request parameters

Build the filter parameter

Example script