Audit Export GraphQL Reference Guide

Public preview: This feature is public preview and available to all accounts.

Use these audit export configuration commands to manage exporting your audit logs to S3 and ADLS Gen2. To configure an audit export see the Export to S3 or Export to ADLS guides.

Disable a configuration

To disable a configuration, use the disableExportConfiguration mutation:

Mutation

mutation {
  disableExportConfiguration(
    id: "<export configuration ID>"
  )
  {
    id
  }
}

Response

"data": {
  "disableExportConfiguration": {
    "id": "<export configuration ID>"
  }
}

Enable a configuration

To enable a disabled configuration, use the enableExportConfiguration mutation:

Mutation

mutation {
  enableExportConfiguration(
    id: "<export configuration ID>"
  )
  {
    id
  }
}

Response

"data": {
  "enableExportConfiguration": {
    "id": "<export configuration ID>"
  }
}

Delete a configuration

To delete a configuration, use the deleteExportConfiguration mutation:

Mutation

mutation {
  deleteExportConfiguration(
    id: "<export configuration ID>"
  )
  {
    id
  }
}

Response

"data": {
  "deleteExportConfiguration": {
    "id": "<export configuration ID>"
  }
}

Update a configuration

To update an existing configuration, use the mutation for your specific export configuration:

• Export to S3 with access key: updateS3AccessKeyExportConfiguration

• Export to S3 with assumed role: updateS3AssumedRoleExportConfiguration

• Export to ADLS: updateAdlsSasTokenExportConfiguration

Update the configuration to make small changes, i.e., to rotate the token, rather than deleting the existing one and creating a new one.

Mutation

mutation {
    updateAdlsSasTokenExportConfiguration(
        data: {
            id: "<export configuration ID>"
            interval: EVERY_2_HOURS
            storageAccount: "your-adls-storage-account",
            fileSystem: "audit-output",
            path: "immuta-audit",
            sasToken: "your-sas-token"
        } 
     ) 
     {
       id
       interval
       enabled
       endpointConfiguration {
            __typename
            ... on AdlsSasTokenEndpointConfiguration {
                storageAccount
                path
                fileSystem
            }
        }
    }
}

Response

{
    "data": {
        "updateAdlsSasTokenExportConfiguration": {
            "id": "<export configuration ID>",
            "interval": "EVERY_12_HOURS",
            "enabled": true,
            "endpointConfiguration": {
                "storageAccount": "your-adls-storage-account",
                "fileSystem": "audit-output",
                "path": "immuta-audit"
            }
        }
    }
}