diff --git a/airlock_libs.pyi b/airlock_libs.pyi index 6c09cb0..2e061f1 100644 --- a/airlock_libs.pyi +++ b/airlock_libs.pyi @@ -19,4 +19,69 @@ def api(AirlockAPIWrapper): self.api_key = api_key self.headers = {"X-APIKey": self.api_key} ``` - """ \ No newline at end of file + """ + +def history_logging( + api, + exec_types: str, + checkpoint_number: str, + policy_names: str, + ) -> List[Dict[str, Any]]: + """ + Query execution history logs from the Airlock API. + + Parameters + ---------- + exec_types : str + A JSON-style string list of execution types to retrieve. + Example: "[3,5,8]" + - 0 = Trusted Execution + - 1 = Blocked Execution + - 2 = Untrusted Execution [Audit] + - 3 = Untrusted Execution [OTP] + - 5 = Trusted Publisher Execution + - 8 = Trusted Process Execution + (etc.) + + checkpoint_number : str + The checkpoint ID. Used to fetch results after a certain event. + Example: "601d275487bacb01e3470713" + + policy_names : str + A comma-separated or JSON-style list of policy group names. + Example: "Apple Mac" or "["Apple Mac", "Servers London"]" + + Returns + ------- + List[Dict[str, Any]] + A list of dictionaries, where each dictionary represents an + execution history record. Each record can include fields like: + + - checkpoint: str + - type: int + - username: str + - hostname: str + - filename: str + - ppolicy: str + - policyname: str + - policyver: str + - commandline: str + - publisher: str + - pprocess: str + - gprocess: str + - sha256: str + - datetime: str + - ip: str + - localip: str + Raises + ------ + RuntimeError + If the request fails or the response cannot be parsed. + + Example + ------- + >>> histories = await airlock_libs.history_logging("[3,5,8]", "601d275487bacb01e3470713", "Apple Mac") + >>> print(histories[0]["filename"]) + 'chrome.exe' + """ + ... \ No newline at end of file