Download Reports with Team
The Team query returns information about activity within a team. You may use any of the following sets of parameters to generate reports:
- start_date and duration
- start_time and duration
- end_date and duration
- end_time and duration
Parameters for Team
|start_date=[YYYY-MM-DD]||Specifies that the report should return team activity that began on or after this date and that is within the duration specified below.|
|start_time=[timestamp]||Specifies that the report should return team activity that began at or after this time and that is within the duration specified below. The time must be a UNIX timestamp (UTC).|
|end_date=[YYYY-MM-DD]||Specifies that the report should return team activity that ended on or after this date and that is within the duration specified below.|
|end_time=[timestamp]||Specifies that the report should return team activity that ended at or after this time and that is within the duration specified below. The time must be a UNIX timestamp (UTC).|
|duration=[integer]||Length of time from the specified date or time for which you wish to pull reports, or 0 to pull from the specified date to present. If start_date or end_date is specified, duration will represent days; if start_time or end_time is specified, duration will represent seconds.|
Optional Parameter for Team
|team_id=[integer]||The numeric ID of the team by which to filter results. Only the activity within the specified team will be returned. If this parameter is not specified, results from all teams will be returned.|
XML Response for Team Query
Contains a <team_activity> element for each team with any activity within the given parameters. If no teams are returned, this element will contain no <team_activity> elements. If an error occurs during the search, it will contain an <error> element describing the problem.
Also contains <start_time> and <end_time> elements displaying the time parameters in the system time and with a timestamp attribute in UTC.
Element Names and Attributes
|id (attribute)||Integer representing the team's unique ID.|
|name (attribute)||The display name of the team. Note that this field contains the team name as it currently appears, which may not match the value at the time of the conference if the team name has been subsequently changed.|
|<logged_in_privileged users>||Contains a <representative> element for each user in that team who was logged into the access console before the first event in the report occurred. If no users were logged in at the start time, this element will be empty.|
Contains an <event> element for each event that occurred within this team.
Uniquely identifies the user in regards to their current connection to the BeyondTrust Appliance. A gsnumber is assigned on a per-connection basis, so if a user leaves a session and then rejoins without logging out of the BeyondTrust Appliance, their gsnumber will remain the same.
However, if the user's connection is terminated for any reason, when that user logs back into the BeyondTrust Appliance, they will be assigned a new gsnumber.
A gsnumber may be recycled, so while two people connected at the same time will never have the same gsnumber, one person may have a gsnumber that was assigned to another person in the past. Can be used to correlate a <representative> element with an event's <performed_by> or <destination> element.
|id (attribute)||Unique ID assigned to the user.|
|<display_name>||The display name assigned to the user. Note that this field contains the display name's value at the time of the conference, which may not match the current value if the display_name has subsequently been changed.|
|<public_ip>||The user's public IP address.|
|<private_ip>||The user's private IP address.|
|timestamp (attribute)||The system time at which the event occurred.|
The type of event which occurred. Event types include the following:
|<performed_by>||The entity that performed the action. Indicates the entity's gsnumber and also its type, indicating whether this entity was the system or a user.|
|<destinations>||If this event was targeted to one or more specific users, it will contain one or more <destination> elements as described below.|
|<files>||If this event involved the transfer of files, then this element will contain a <file> element for every file transferred.|
Contains an arbitrary number of <value name="_" value=" _" /> elements. The name and number of these elements varies based on the event_type. For example, when a user logs into the access console, a Conference Member State Changed event would contain <value> elements for the hostname, os, private_ip, public_ip, and state.
|<body>||The text of the chat message as displayed in the chat log area.|
|<encoded_body>||Can be shown in place of the <body> element above. Contains the base64 (RFC 2045 section 6.8) encoded value of what would have been shown in the <body> element, and is shown ONLY if the <body> text contains characters that are invalid according to XML specification. These characters are typically the result of binary data being sent through chat messages.|
|gsnumber (attribute)||Indicates the gsnumber of the entity to which the event was destined.|
|type (attribute)||Indicates whether this entity was the system or a user.|
|[value]||The name of the entity to which the event was destined.|
|name (attribute)||The name of the transferred file.|
|size (attribute)||An integer indicating the size of the transferred file.|
Query Examples for Team
|Activity started July 1 2016 to present||
|Activity started the month of July 2016||
|Activity started 8:00 AM July 1 2016 to present||
|Activity started 8:00 AM July 1 2016 to 6:00 PM July 1 2016||
|Activity started July 1 2016 to present for a specific team||
|Activity ended July 1 2016 to present||
|Activity ended the month of July 2016||
|Activity ended 8:00 AM July 1 2016 to present||
|Activity ended 8:00 AM July 1 2016 to 6:00 PM July 1 2016||
|Activity ended July 1 2016 to present for a specific team||