> ## Documentation Index
> Fetch the complete documentation index at: https://docs.abbyy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security event log from System Monitor

> Download the ABBYY FlexiCapture System Monitor security event log of permission changes as CSV via the GetSecurityEventsCSV POST request, with a script.

This log records events related to adding, deleting, and otherwise changing user permissions. Security event logging is disabled by default and can be enabled only by the system administrator, directly in a FlexiCapture database. For more information, see [Security event log](/flexi-capture/web-stations/monitoring-console/mmc-security-event-log).

<Warning>
  Only users with System Administrator permissions can download security event logs from System Monitor. A System Administrator is the Administrator of a default tenant.
</Warning>

To download this log, use a POST request:

```http theme={null}
POST https://<server address>/FlexiCapture12/Monitoring/Tenant/GetSecurityEventsCSV
```

## Request parameters

All parameters are required. Make sure that they are specified correctly.

<Info>
  The search in Oracle Database is case-sensitive. Take this into account if you use Oracle Database.
</Info>

| Parameter         | Type   | Description                                                                                                                                                                                                            |
| ----------------- | ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `filter`          | string | Filter conditions for the log. Combine conditions with the `AND` and `OR` operators only, set in the `GeneralOperator` parameter. For more information, see [Build the filter parameter](#build-the-filter-parameter). |
| `columnsOrder`    | string | Comma-separated list of columns to include in the report: `ID`, `Date`, `EventType`, `Details`, `RemoteHost`, `Principal`, `TenantName`, `Writer`, `WriterTenantName`.                                                 |
| `sortColumnindex` | int    | Index of the column used to sort the records in the log.                                                                                                                                                               |
| `sortOrder`       | bool   | Sort order: `true` sorts in descending order, `false` sorts in ascending order.                                                                                                                                        |
| `tenantId`        | int    | Tenants to include in the log: `-1` for all available tenants, `0` for the default tenant, or a specific tenant ID (`1` or greater).                                                                                   |

### Build the filter parameter

The `filter` parameter takes a JSON object. For example:

```json theme={null}
{
  "GeneralOperator": "AND",
  "FilterItems": [
    {
      "PropertyKey": "Date",
      "PropertyOperator": "BETWEEN",
      "PropertyValues": [
        "2021-08-28",
        "00:00:00",
        "2023-09-28",
        "23:59:59"
      ]
    }
  ]
}
```

To find the values for the `PropertyKey` and `PropertyOperator` parameters, create a filter in the Administration and Monitoring Console:

<Steps>
  <Step title="Open the browser developer tools">
    In the browser menu, click **More tools → Developer tools**, and go to the **Network** tab.
  </Step>

  <Step title="Create a filter in the console">
    Launch the Administration and Monitoring Console, go to **System Monitor → Security event log**, and click the <img src="https://mintcdn.com/abbyy/39LtOHLEp1q7pm1x/images/flexi-capture/Add_filter.png?fit=max&auto=format&n=39LtOHLEp1q7pm1x&q=85&s=7fca1d511f8470021946ae439989fb68" alt="Add filter button" style={{display:"inline-block",verticalAlign:"middle",margin:0}} width="22" height="22" data-path="images/flexi-capture/Add_filter.png" /> button.
  </Step>

  <Step title="Apply the filter criteria">
    Specify the filtering criteria and click **Apply**.
  </Step>

  <Step title="Read the filter parameters">
    Click the `GetFilteredSecurityEvent` request. The filtering parameters are listed on the **Payload** tab.
  </Step>
</Steps>

## Example script

The following PowerShell script demonstrates how to use this API to download the security event log.

<Note>
  Replace the parameters in this script with your server address and your own credentials.
</Note>

```powershell theme={null}
# parameters
$server = "https://<server address>"
$user = "<user name>"
$password = "<password>"
#path to folder where the log will be saved
$folder = "C:\Temp\Logs\Stage"
$reportFileName = "Tenant_SecurityEvents-{0:yyMMdd-HHmmss}.csv" -f (Get-Date)
# log parameters
$requestBody = @"
filter={
    "Name": "Filter",
    "GeneralOperator": "AND",
    "FilterItems": [
        {
            "PropertyKey": "Date",
            "PropertyOperator": "BETWEEN",
            "PropertyValues": [
                "2021-08-28",
                "00:00:00",
                "2023-09-28",
                "23:59:59"
            ]
        }
    ]
}
&columnsOrder=Id,Date,EventType,Details,RemoteHost,Principal,TenantName,Writer,WriterTenantName,
&sortColumnindex=1
&sortOrder=true
&tenantId=-1
"@
#------------------------------------------------------------------------------
$tenant = "" # Only default tenant
$methodUri = "/Tenant/GetSecurityEventsCSV"
$authServer = $server
$ServerSitePath = "/FlexiCapture12/Monitoring"

function Write-Line($str, $color = "White")
{
    Write-Host $str -ForegroundColor $color
}

function Join-Uri
{
    param([Parameter(Mandatory, ValueFromPipeline)] [string]$parent, [string]$child)
    if ($parent -eq "") {return $child;}
    if ($child -eq ""){return $parent}
    if ($parent.endswith("/") -or $parent.endswith("\\")) {$parent = $parent.substring(0,$parent.Length-1)}
    if ($child.startswith("/") -or $child.startswith("\\")) {$child = $child.substring(1,$child.Length-1)}
    return "$parent/$child"
}

function Get-AuthTicket($server, $user, $password, $tenant)
{
    $tenantSuffix=""
    if ($tenant -ne ''){ $tenantSuffix = "?tenant=$tenant"}
    $URL = Join-Uri $authServer "/FlexiCapture12/Server/FCAuth/API/Soap$tenantSuffix"
    $SOAPRequest = '<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><soap:Body><FindUser xmlns="urn:http://www.abbyy.com/FlexiCapture"><userLogin>user</userLogin></FindUser></soap:Body></soap:Envelope>'
    $Headers = @{
        'SOAPAction' = '"#FindUser"'
        'Content-Type' = 'text/xml; charset=utf-8'
        'Authorization' = "Basic $([System.Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes("$($user):$($password)")))"
    }
    try
    {
        $response1 = Invoke-WebRequest -Uri $URL -Headers $Headers -Body $SOAPRequest -Method 'POST'
        return $response1.Headers['AuthTicket']
    }
    catch{
        Write-Line -str "Couldn't get 'AuthTicket': $_" -color "Red"
        return ""
    }
}

function Download-CSVReport($server, $tenant, $authTicket, $methodUri, $requestBody, $folder, $reportFileName)
{
    $reportFullFilePath = Join-Path $folder $reportFileName
    #create folder silent (if not exist)
    New-Item -ItemType Directory -Force -Path $folder | Out-Null
    if ($authTicket -eq "" -or $authTicket -eq $null)
    {
        Write-Line -str "Couldn't get 'CSV-Report'" -color "Red"
    }
    else
    {
        $header = @{ "Accept" = "*/*"}
        $session = [Microsoft.PowerShell.Commands.WebRequestSession]::new()
        $session.Cookies.Add($server, [System.NET.Cookie]::new('FlexiCaptureTmpPrn', "Ticket=$authTicket"))
        $tenantInUrl=""
        if ($tenant -ne '') { $tenantInUrl = "/$tenant"}
        $uri = Join-Uri $server $ServerSitePath | Join-Uri -child $tenantInUrl | Join-Uri -child $methodUri
        try{
            $response = Invoke-WebRequest -Uri $uri -Method 'POST' -Headers $header -WebSession $session -Body $requestBody -OutFile $reportFullFilePath -MaximumRedirection 0 -ErrorAction Ignore -PassThru
            if ($response.StatusCode -lt 300)
            {
                Write-Line "CSV-Report done: $reportFullFilePath" "Green"
            }
            else
            {
                Write-Line -str "HttpStatus $($response.StatusCode) in getting CSV-Report." -color "Red"
            }
        }
        catch{
            Write-Line -str "Couldn't get CSV-Report: $_" -color "Red"
            return ""
        }
    }
}

$authTicket = Get-AuthTicket -server $server -user $user -password $password -tenant $tenant
Download-CSVReport -server $server -tenant $tenant -authTicket $authTicket -methodUri $methodUri -requestBody $requestBody -folder $folder -reportFileName $reportFileName
```