RestAPI - AuditEvents - DateTime filtering not working

[Jools86]

https://www.intel.com/content/dam/support/us/en/documents/software/manageability-products/Latestswagger.html#operation/AuditEvents_GetAuditEvents 

Following the guide,  I have written a command to get Audit Events via RestAPI.

It works fine, but as soon as I play around with the startDateTime and endDateTime fields, they dont work. It just returns everything.

for example:

#// Generate token to be passed for authorization with each RestAPI request
$Token=Invoke-RestMethod "https://ema.Domain.com/api/latest/accessTokens/getUsingWindowsCredentials" -Credential $Cred

$headers = @{
'authorization' = "bearer $($Token.access_token)"
}

$Body = @{
'callername' = 'JoeBloggs@Myco.Domain.com'
'resourceType' = 'ENDPOINT'
'startDateTime' = '2023-01-05T15:10:01Z'
'endDateTime' = '2023-01-06T15:10:01Z'
}

$Events=Invoke-RestMethod "https://ema.Domain.com/api/latest/auditevents" -Headers $headers -Body $Body

Returns values from December! Even though as you can see I am only asking for ones in Ja 23.

All other query values work, i.e. Action, ResourceType, callername etc.

I am using PowerShell.

[Victor_G_Intel]

Hello Jools86,

Thank you for posting on the Intel® communities.

Please let me review this information internally, and kindly wait for an update.

Once we have more information to share, we will post it on this thread.

Regards,

Victor G.

Intel Technical Support Technician  

[Victor_G_Intel]

Hello Jools86,

Thank you for posting on the Intel® communities.

I wanted to let you know that we have replicated your error and it does appear that there is an error in how the GEt-IntelEMAAuditEvents call parses the requested data. Therefore, we are targeting the next API version 1.7 for resolution but we don't guarantee backlog priorities. In the meantime, as a workaround, you can choose any one of the filters you used in the API call. Filtering on startDate/endDate then will allow you to programmatically filter other attributes in your script.

Regards,

Victor G.

Intel Technical Support Technician

[Jools86]

Thanks for the update Victor.

For the moment - I am basically retrieving all events throught the RestAPI then filtering them by date range via PowerShell afterwards.

[Victor_G_Intel]

Hello Jools86,

Thank you for getting back to me.

I’m glad to hear that you are working around this issue. We will do our best to see if we can work on this bug for future releases. If you don’t need to report anything else besides this, can you please confirm if we can proceed to close this thread?

Regards,

Victor G.

Intel Technical Support Technician

[Jools86]

Hi Victor, yes of course. Please close this thread.

[Victor_G_Intel]

Hello Jools86,

Thank you for your response.

We will proceed to close the thread. If you need any additional information, feel free to submit a new question as this thread will no longer be monitored.

Best regards,

Victor G. 

Intel Technical Support Technician