How to Export Devo Logs for Security Review
Summary
A practical guide to exporting Devo logs through its Query API or Python SDK, choosing time ranges and JSON output, troubleshooting common errors, and uploading data to LogTotal for sanitization and review.
Key points
- The guide uses Devo’s Query API with a LINQ query, time range, output mode, and either an API token or key-and-secret credentials.
- The sample request uses the regional endpoint apiv2-eu[.]devo[.]com/search/query and selects event fields from a table.
- Query time bounds use epoch seconds; JSON responses may be line-delimited or arrays that can be flattened with jq.
- For raw log lines, select the message field; the devo-sdk Python package is offered as an alternative to curl.
- The guide recommends checking credentials, regional endpoints, table names, time units, and output mode when exports fail, then uploading the file to LogTotal for review.
Article Details
- Topic
- Exporting Devo logs through the Query API and reviewing them in LogTotal