cyber.hendryadrian.com
Security Insights · socprime.com

How to Export and Review Securonix Activity Logs

· Original article ↗

Summary

A guide shows how to use Securonix’s REST API or Spotter UI to export activity events as JSON or JSONL, then sanitize and review them in LogTotal, with troubleshooting for tokens, queries, paging, and older data.

Key points

  • API export requires a Securonix user with API access; the guide shows generating a token with a chosen validity period.
  • Spotter queries can be sent to the REST API endpoint /ws/spotter/index/search with a query and time window.
  • The exported events can be converted to one JSON event per line with jq.
  • The guide recommends reviewing and sanitizing exported data before uploading it to LogTotal.
  • Troubleshooting covers API permissions, query syntax and date formats, paging, and searching older data in long-term storage.

Article Details

Topic
Exporting Securonix activity logs through the REST API and reviewing them in LogTotal.

Vendors

SecuronixGenerate an API token, run your Spotter query through the Securonix REST API (/ws/spotter/index/search), and save the events as JSON.

Products

LogTotalBelow is how to get data out, sanitize it, and investigate it for free in LogTotal.SecuronixGenerate an API token, run your Spotter query through the Securonix REST API (/ws/spotter/index/search), and save the events as JSON.SpotterGenerate an API token, run your Spotter query through the Securonix REST API (/ws/spotter/index/search), and save the events as JSON.

Related Articles