Objective
To provide step-by-step instructions for using Automox Data Extracts to determine whether an unexpected endpoint reboot or software update was manually initiated by an Automox user from the either console.automox.com or from an API.
Overview
When system updates or endpoint reboots occur outside designated maintenance windows, administrators must verify the source of the event.
By generating and auditing the API History Data Extract from the Automox Console, you can review timestamped event logs, differentiate between API or console manual user interventions, and identify the specific user account responsible.
Audit Procedure
1.Navigate to Data Extracts in the Automox Console:
- Log in to the Automox Console as an administrator.
- Go to Reports and select Data Extracts.
2.Generate the API History Report:
- In the Select Report dropdown menu, select API History.
- Click Generate Report to initiate data compilation.
3.Download and Inspect the CSV Log:
- Once generation is complete, click Download to save the report as a
.csvfile. - Open the file in Microsoft Excel, Google Sheets, or your preferred spreadsheet viewer.
4.Filter Audit Columns for User Actions:
Filter the spreadsheet around the timeframe when the reboot or update occurred, then inspect the following key columns:
-
identity_type: Look for records containing the valueuseror multi-org-api-key. -
user_id: Identifies the specific user account ID that issued the command. -
request_path/command: Identifies the exact action performed (e.g., triggering a manual device reboot, running a policy out-of-cycle, or executing a manual patch command).
Troubleshooting Data Extract Issues
If you cannot generate or locate the API History report:
Verify Administrative Roles: Ensure your Automox account is assigned Global Admin or Zone Admin privileges. Users with restricted read-only or operator roles may not have access to export system Data Extracts.
Confirm Log Retention Limits: API history logs reflect actions taken within platform retention boundaries. If auditing an event from several months ago, export historical data routinely to maintain compliance records.