Get Windows Events

get

https://api.controlup.com/historical/v1/windowsEvents

Returns matched Event Log Monitoring rows (30-day rolling retention, filtered on event timestamp).

Query Params

_timeFrom

date-time

Start date and time of the search period in the format: YYYY-MM-DD'T'hh:mm:ss.sssZ

_timeTo

date-time

End date and time of the search period in the format: YYYY-MM-DD'T'hh:mm:ss.sssZ

logLevel

array of strings

Filter by log level. CSV, case-insensitive. Valid values: Critical, Error, Warning, Information, Verbose.

logLevel

logName

array of strings

Filter by the full programmatic log name (e.g. Microsoft-FSLogix-Apps/Operational). Exact match, case-insensitive. CSV.

logName

sourceName

array of strings

Filter by event source/provider name. Exact match, case-insensitive. CSV.

sourceName

eventId

array of int32s

Filter by Windows event ID. CSV.

eventId

machineName

array of strings

Filter by machine name. Exact match, case-insensitive. CSV.

machineName

userName

array of strings

Filter by user name (DOMAIN\User or SID-string fallback). Exact match, case-insensitive. CSV.

userName

_sortBy

string

Response field to sort by. Default: eventTime.

_sortOrder

string

enum

Sort order. Default: desc.

Allowed:

_page

int32

≥ 1

The page number returned. The first page is 1.

_limit

int32

1 to 100000

The number of items returned per page. Minimum is 1.

Headers

string

enum

Defaults to application/json

Generated from available response content types

Allowed:

Responses

200Successfully retrieved

400Bad Request - one of the inputs isn't correct

401User is not authorized to access the resource

403Authorization details are not provided

500Internal Server Error

501Internal Server Error

504Internal Server Error