< Back
Get-AMAuditEvent
Post
NAME Get-AMAuditEvent
SYNOPSIS
Gets AutoMate Enterprise audit events.
SYNTAX
Get-AMAuditEvent [-StartDate <DateTime>] [-EndDate <DateTime>] [-EventType {ConnectionOpened | ConnectionClosed |
UserLoggedOn | UserLogonDenied | UserLoggedOff | AgentConnected | AgentDisconnected | AgentDisconnectedByServer |
TaskAgentUpgrading | TaskAgentConnected | ProcessAgentConnected | UserConnectedSMC | UserConnectedWFD |
TaskAgentDisconnected | ProcessAgentDisconnected | UserDisconnectedSMC | UserDisconnectedWFD | UserConnectedWebSMC
| UserDisconnectedWebSMC | SkybotConnected | SkybotDisconnected | AMExecuteConnected | AMExecuteDisconnected |
InterMapperConnected | InterMapperDisconnected | ScheduleEnterpriseConnected | ScheduleEnterpriseDisconnected |
LicenseAdded | LicenseRemoved | WorkflowCreated | WorkflowRemoved | WorkflowEdited | WorkflowEnabled |
WorkflowDisabled | WorkflowRenamed | WorkflowMoved | WorkflowPropertiesModified | WorkflowExported |
WorkflowImported | WorkflowPermissionsModified | TaskCreated | TaskRemoved | TaskEdited | TaskEnabled |
TaskDisabled | TaskRenamed | TaskMoved | TaskPropertiesModified | TaskExported | TaskImported |
TaskPermissionsModified | ConditionCreated | ConditionRemoved | ConditionEdited | ConditionEnabled |
ConditionDisabled | ConditionRenamed | ConditionMoved | ConditionPropertiesModified | ConditionExported |
ConditionImported | ConditionPermissionsModified | UserCreated | UserRemoved | UserEdited | UserEnabled |
UserDisabled | UserMoved | UserPropertiesModified | UserPermissionsModified | AgentRegistered | AgentRemoved |
AgentEnabled | AgentDisabled | AgentMoved | AgentPropertiesModified | AgentRenamed | AgentPermissionsModified |
ServerPropertiesModified | ServerPermissionsModifed | ApiPermissionsModified |
RevisionManagementPropertiesModified | FolderCreated | FolderRemoved | FolderRenamed | FolderMoved |
FolderPropertiesModified | FolderPermissionsModified | FolderExported | FolderImported | AgentGroupCreated |
AgentGroupRemoved | AgentGroupEdited | AgentGroupEnabled | AgentGroupDisabled | AgentGroupRenamed |
AgentGroupMoved | AgentGroupPropertiesModified | AgentGroupPermissionsModified | UserGroupCreated |
UserGroupRemoved | UserGroupEdited | UserGroupEnabled | UserGroupDisabled | UserGroupRenamed | UserGroupMoved |
UserGroupPropertiesModified | UserGroupPermissionsModified | ProcessCreated | ProcessRemoved | ProcessEdited |
ProcessEnabled | ProcessDisabled | ProcessRenamed | ProcessMoved | ProcessPropertiesModified | ProcessExported |
ProcessImported | ProcessPermissionsModified | RevisionUpdated | RevisionDeleted | RevisionRestored |
RevisionDeletedRecycleBin | RevisionRestoredRecycleBin | All}] [-FilterSet <Hashtable[]>] [-FilterSetMode
<String>] [-SortProperty <String[]>] [-SortDescending] [-Connection <Object>] [<CommonParameters>]
Get-AMAuditEvent [[-InputObject] <Object>] [-StartDate <DateTime>] [-EndDate <DateTime>] [-EventType
{ConnectionOpened | ConnectionClosed | UserLoggedOn | UserLogonDenied | UserLoggedOff | AgentConnected |
AgentDisconnected | AgentDisconnectedByServer | TaskAgentUpgrading | TaskAgentConnected | ProcessAgentConnected |
UserConnectedSMC | UserConnectedWFD | TaskAgentDisconnected | ProcessAgentDisconnected | UserDisconnectedSMC |
UserDisconnectedWFD | UserConnectedWebSMC | UserDisconnectedWebSMC | SkybotConnected | SkybotDisconnected |
AMExecuteConnected | AMExecuteDisconnected | InterMapperConnected | InterMapperDisconnected |
ScheduleEnterpriseConnected | ScheduleEnterpriseDisconnected | LicenseAdded | LicenseRemoved | WorkflowCreated |
WorkflowRemoved | WorkflowEdited | WorkflowEnabled | WorkflowDisabled | WorkflowRenamed | WorkflowMoved |
WorkflowPropertiesModified | WorkflowExported | WorkflowImported | WorkflowPermissionsModified | TaskCreated |
TaskRemoved | TaskEdited | TaskEnabled | TaskDisabled | TaskRenamed | TaskMoved | TaskPropertiesModified |
TaskExported | TaskImported | TaskPermissionsModified | ConditionCreated | ConditionRemoved | ConditionEdited |
ConditionEnabled | ConditionDisabled | ConditionRenamed | ConditionMoved | ConditionPropertiesModified |
ConditionExported | ConditionImported | ConditionPermissionsModified | UserCreated | UserRemoved | UserEdited |
UserEnabled | UserDisabled | UserMoved | UserPropertiesModified | UserPermissionsModified | AgentRegistered |
AgentRemoved | AgentEnabled | AgentDisabled | AgentMoved | AgentPropertiesModified | AgentRenamed |
AgentPermissionsModified | ServerPropertiesModified | ServerPermissionsModifed | ApiPermissionsModified |
RevisionManagementPropertiesModified | FolderCreated | FolderRemoved | FolderRenamed | FolderMoved |
FolderPropertiesModified | FolderPermissionsModified | FolderExported | FolderImported | AgentGroupCreated |
AgentGroupRemoved | AgentGroupEdited | AgentGroupEnabled | AgentGroupDisabled | AgentGroupRenamed |
AgentGroupMoved | AgentGroupPropertiesModified | AgentGroupPermissionsModified | UserGroupCreated |
UserGroupRemoved | UserGroupEdited | UserGroupEnabled | UserGroupDisabled | UserGroupRenamed | UserGroupMoved |
UserGroupPropertiesModified | UserGroupPermissionsModified | ProcessCreated | ProcessRemoved | ProcessEdited |
ProcessEnabled | ProcessDisabled | ProcessRenamed | ProcessMoved | ProcessPropertiesModified | ProcessExported |
ProcessImported | ProcessPermissionsModified | RevisionUpdated | RevisionDeleted | RevisionRestored |
RevisionDeletedRecycleBin | RevisionRestoredRecycleBin | All}] [-FilterSet <Hashtable[]>] [-FilterSetMode
<String>] [-SortProperty <String[]>] [-SortDescending] [-AuditUserActivity] [-Connection <Object>]
[<CommonParameters>]
DESCRIPTION
Get-AMAuditEvent gets audit events for AutoMate Enterprise objects.
PARAMETERS
-InputObject <Object>
The object(s) to retrieve audit events for.
Required? false
Position? 1
Default value
Accept pipeline input? true (ByValue)
Accept wildcard characters? false
-StartDate <DateTime>
The first date of events to retrieve (Default: 1 day ago).
Required? false
Position? named
Default value (Get-Date).AddDays(-1)
Accept pipeline input? false
Accept wildcard characters? false
-EndDate <DateTime>
The last date of events to retrieve (Default: now).
Required? false
Position? named
Default value (Get-Date)
Accept pipeline input? false
Accept wildcard characters? false
-EventType
The type of event(s) to be retrieved. Use auto-complete or see types.ps1 for a full list.
Required? false
Position? named
Default value All
Accept pipeline input? false
Accept wildcard characters? false
-FilterSet <Hashtable[]>
The parameters to filter the search on. Supply hashtable(s) with the following properties: Property,
Operator, Value.
Valid values for the Operator are: =, !=, <, >, contains (default - no need to supply Operator when using
'contains')
Required? false
Position? named
Default value @()
Accept pipeline input? false
Accept wildcard characters? false
-FilterSetMode <String>
If multiple filter sets are provided, FilterSetMode determines if the filter sets should be evaluated with an
AND or an OR
Required? false
Position? named
Default value And
Accept pipeline input? false
Accept wildcard characters? false
-SortProperty <String[]>
The object property to sort results on. Do not use ConnectionAlias, since it is a custom property added by
this module, and not exposed in the API.
Required? false
Position? named
Default value EventDateTime
Accept pipeline input? false
Accept wildcard characters? false
-SortDescending [<SwitchParameter>]
If specified, this will sort the output on the specified SortProperty in descending order. Otherwise,
ascending order is assumed.
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false
-AuditUserActivity [<SwitchParameter>]
If this switch is supplied, then this function returns any audited events that were performed by the piped in
user. Otherwise,
audit events related to the user object are returned.
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false
-Connection <Object>
The AutoMate Enterprise management server.
Required? false
Position? named
Default value
Accept pipeline input? false
Accept wildcard characters? false
<CommonParameters>
This cmdlet supports the common parameters: Verbose, Debug,
ErrorAction, ErrorVariable, WarningAction, WarningVariable,
OutBuffer, PipelineVariable, and OutVariable. For more information, see
about_CommonParameters (https:/go.microsoft.com/fwlink/?LinkID=113216).
INPUTS
Audit events for the following objects can be retrieved by this function:
Workflow
Task
Condition
Process
TaskAgent
ProcessAgent
AgentGroup
User
UserGroup
Folder
OUTPUTS
AuditEvent
-------------------------- EXAMPLE 1 --------------------------
PS C:\\># Get events for workflow "My Workflow"
Get-AMWorkflow "My Workflow" | Get-AMAuditEvent
-------------------------- EXAMPLE 2 --------------------------
PS C:\\># Get audit events using filter sets
Get-AMAuditEvent -FilterSet @{Property = 'EventText'; Operator = 'contains'; Value = 'connection from IP
10.1.1.10'}
RELATED LINKS
https://github.com/AutomatePS/AutomatePS
SYNOPSIS
Gets AutoMate Enterprise audit events.
SYNTAX
Get-AMAuditEvent [-StartDate <DateTime>] [-EndDate <DateTime>] [-EventType {ConnectionOpened | ConnectionClosed |
UserLoggedOn | UserLogonDenied | UserLoggedOff | AgentConnected | AgentDisconnected | AgentDisconnectedByServer |
TaskAgentUpgrading | TaskAgentConnected | ProcessAgentConnected | UserConnectedSMC | UserConnectedWFD |
TaskAgentDisconnected | ProcessAgentDisconnected | UserDisconnectedSMC | UserDisconnectedWFD | UserConnectedWebSMC
| UserDisconnectedWebSMC | SkybotConnected | SkybotDisconnected | AMExecuteConnected | AMExecuteDisconnected |
InterMapperConnected | InterMapperDisconnected | ScheduleEnterpriseConnected | ScheduleEnterpriseDisconnected |
LicenseAdded | LicenseRemoved | WorkflowCreated | WorkflowRemoved | WorkflowEdited | WorkflowEnabled |
WorkflowDisabled | WorkflowRenamed | WorkflowMoved | WorkflowPropertiesModified | WorkflowExported |
WorkflowImported | WorkflowPermissionsModified | TaskCreated | TaskRemoved | TaskEdited | TaskEnabled |
TaskDisabled | TaskRenamed | TaskMoved | TaskPropertiesModified | TaskExported | TaskImported |
TaskPermissionsModified | ConditionCreated | ConditionRemoved | ConditionEdited | ConditionEnabled |
ConditionDisabled | ConditionRenamed | ConditionMoved | ConditionPropertiesModified | ConditionExported |
ConditionImported | ConditionPermissionsModified | UserCreated | UserRemoved | UserEdited | UserEnabled |
UserDisabled | UserMoved | UserPropertiesModified | UserPermissionsModified | AgentRegistered | AgentRemoved |
AgentEnabled | AgentDisabled | AgentMoved | AgentPropertiesModified | AgentRenamed | AgentPermissionsModified |
ServerPropertiesModified | ServerPermissionsModifed | ApiPermissionsModified |
RevisionManagementPropertiesModified | FolderCreated | FolderRemoved | FolderRenamed | FolderMoved |
FolderPropertiesModified | FolderPermissionsModified | FolderExported | FolderImported | AgentGroupCreated |
AgentGroupRemoved | AgentGroupEdited | AgentGroupEnabled | AgentGroupDisabled | AgentGroupRenamed |
AgentGroupMoved | AgentGroupPropertiesModified | AgentGroupPermissionsModified | UserGroupCreated |
UserGroupRemoved | UserGroupEdited | UserGroupEnabled | UserGroupDisabled | UserGroupRenamed | UserGroupMoved |
UserGroupPropertiesModified | UserGroupPermissionsModified | ProcessCreated | ProcessRemoved | ProcessEdited |
ProcessEnabled | ProcessDisabled | ProcessRenamed | ProcessMoved | ProcessPropertiesModified | ProcessExported |
ProcessImported | ProcessPermissionsModified | RevisionUpdated | RevisionDeleted | RevisionRestored |
RevisionDeletedRecycleBin | RevisionRestoredRecycleBin | All}] [-FilterSet <Hashtable[]>] [-FilterSetMode
<String>] [-SortProperty <String[]>] [-SortDescending] [-Connection <Object>] [<CommonParameters>]
Get-AMAuditEvent [[-InputObject] <Object>] [-StartDate <DateTime>] [-EndDate <DateTime>] [-EventType
{ConnectionOpened | ConnectionClosed | UserLoggedOn | UserLogonDenied | UserLoggedOff | AgentConnected |
AgentDisconnected | AgentDisconnectedByServer | TaskAgentUpgrading | TaskAgentConnected | ProcessAgentConnected |
UserConnectedSMC | UserConnectedWFD | TaskAgentDisconnected | ProcessAgentDisconnected | UserDisconnectedSMC |
UserDisconnectedWFD | UserConnectedWebSMC | UserDisconnectedWebSMC | SkybotConnected | SkybotDisconnected |
AMExecuteConnected | AMExecuteDisconnected | InterMapperConnected | InterMapperDisconnected |
ScheduleEnterpriseConnected | ScheduleEnterpriseDisconnected | LicenseAdded | LicenseRemoved | WorkflowCreated |
WorkflowRemoved | WorkflowEdited | WorkflowEnabled | WorkflowDisabled | WorkflowRenamed | WorkflowMoved |
WorkflowPropertiesModified | WorkflowExported | WorkflowImported | WorkflowPermissionsModified | TaskCreated |
TaskRemoved | TaskEdited | TaskEnabled | TaskDisabled | TaskRenamed | TaskMoved | TaskPropertiesModified |
TaskExported | TaskImported | TaskPermissionsModified | ConditionCreated | ConditionRemoved | ConditionEdited |
ConditionEnabled | ConditionDisabled | ConditionRenamed | ConditionMoved | ConditionPropertiesModified |
ConditionExported | ConditionImported | ConditionPermissionsModified | UserCreated | UserRemoved | UserEdited |
UserEnabled | UserDisabled | UserMoved | UserPropertiesModified | UserPermissionsModified | AgentRegistered |
AgentRemoved | AgentEnabled | AgentDisabled | AgentMoved | AgentPropertiesModified | AgentRenamed |
AgentPermissionsModified | ServerPropertiesModified | ServerPermissionsModifed | ApiPermissionsModified |
RevisionManagementPropertiesModified | FolderCreated | FolderRemoved | FolderRenamed | FolderMoved |
FolderPropertiesModified | FolderPermissionsModified | FolderExported | FolderImported | AgentGroupCreated |
AgentGroupRemoved | AgentGroupEdited | AgentGroupEnabled | AgentGroupDisabled | AgentGroupRenamed |
AgentGroupMoved | AgentGroupPropertiesModified | AgentGroupPermissionsModified | UserGroupCreated |
UserGroupRemoved | UserGroupEdited | UserGroupEnabled | UserGroupDisabled | UserGroupRenamed | UserGroupMoved |
UserGroupPropertiesModified | UserGroupPermissionsModified | ProcessCreated | ProcessRemoved | ProcessEdited |
ProcessEnabled | ProcessDisabled | ProcessRenamed | ProcessMoved | ProcessPropertiesModified | ProcessExported |
ProcessImported | ProcessPermissionsModified | RevisionUpdated | RevisionDeleted | RevisionRestored |
RevisionDeletedRecycleBin | RevisionRestoredRecycleBin | All}] [-FilterSet <Hashtable[]>] [-FilterSetMode
<String>] [-SortProperty <String[]>] [-SortDescending] [-AuditUserActivity] [-Connection <Object>]
[<CommonParameters>]
DESCRIPTION
Get-AMAuditEvent gets audit events for AutoMate Enterprise objects.
PARAMETERS
-InputObject <Object>
The object(s) to retrieve audit events for.
Required? false
Position? 1
Default value
Accept pipeline input? true (ByValue)
Accept wildcard characters? false
-StartDate <DateTime>
The first date of events to retrieve (Default: 1 day ago).
Required? false
Position? named
Default value (Get-Date).AddDays(-1)
Accept pipeline input? false
Accept wildcard characters? false
-EndDate <DateTime>
The last date of events to retrieve (Default: now).
Required? false
Position? named
Default value (Get-Date)
Accept pipeline input? false
Accept wildcard characters? false
-EventType
The type of event(s) to be retrieved. Use auto-complete or see types.ps1 for a full list.
Required? false
Position? named
Default value All
Accept pipeline input? false
Accept wildcard characters? false
-FilterSet <Hashtable[]>
The parameters to filter the search on. Supply hashtable(s) with the following properties: Property,
Operator, Value.
Valid values for the Operator are: =, !=, <, >, contains (default - no need to supply Operator when using
'contains')
Required? false
Position? named
Default value @()
Accept pipeline input? false
Accept wildcard characters? false
-FilterSetMode <String>
If multiple filter sets are provided, FilterSetMode determines if the filter sets should be evaluated with an
AND or an OR
Required? false
Position? named
Default value And
Accept pipeline input? false
Accept wildcard characters? false
-SortProperty <String[]>
The object property to sort results on. Do not use ConnectionAlias, since it is a custom property added by
this module, and not exposed in the API.
Required? false
Position? named
Default value EventDateTime
Accept pipeline input? false
Accept wildcard characters? false
-SortDescending [<SwitchParameter>]
If specified, this will sort the output on the specified SortProperty in descending order. Otherwise,
ascending order is assumed.
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false
-AuditUserActivity [<SwitchParameter>]
If this switch is supplied, then this function returns any audited events that were performed by the piped in
user. Otherwise,
audit events related to the user object are returned.
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false
-Connection <Object>
The AutoMate Enterprise management server.
Required? false
Position? named
Default value
Accept pipeline input? false
Accept wildcard characters? false
<CommonParameters>
This cmdlet supports the common parameters: Verbose, Debug,
ErrorAction, ErrorVariable, WarningAction, WarningVariable,
OutBuffer, PipelineVariable, and OutVariable. For more information, see
about_CommonParameters (https:/go.microsoft.com/fwlink/?LinkID=113216).
INPUTS
Audit events for the following objects can be retrieved by this function:
Workflow
Task
Condition
Process
TaskAgent
ProcessAgent
AgentGroup
User
UserGroup
Folder
OUTPUTS
AuditEvent
-------------------------- EXAMPLE 1 --------------------------
PS C:\\># Get events for workflow "My Workflow"
Get-AMWorkflow "My Workflow" | Get-AMAuditEvent
-------------------------- EXAMPLE 2 --------------------------
PS C:\\># Get audit events using filter sets
Get-AMAuditEvent -FilterSet @{Property = 'EventText'; Operator = 'contains'; Value = 'connection from IP
10.1.1.10'}
RELATED LINKS
https://github.com/AutomatePS/AutomatePS