[mayur-tolexo]

Why
The audit trail now records every program that ran in a sandbox and every connection those programs opened, not only the calls made to it. A sandbox can also turn that recording off. The SDK had no models for the new events and no way to set it.

What

• Events come in three OCSF classes: API Activity (6003), Process Activity (1007) and Network Activity (4001). New models AuditProcess, AuditFile, AuditDstEndpoint and AuditDevice; api and resources are now optional, since program and connection events carry neither.
• actor.user.type uses the OCSF captions (User, API Key, System, Unknown), and the API key moves to actor.user.programmatic_credentials.
• sandboxes.update and sandbox.update accept execution_trace; sandbox.execution_trace reports it.
• An "Audit trail" reference section covering the classes, which filters apply to which class, and how to tie a program to the call that started it. README and examples/audit_trail.py updated.

Example

trail = sandbox.audit(limit=50)
for e in trail.data:
    proc = e.process or e.actor.process
    what = e.api.operation if e.api else (proc.name if proc else None)
    print(e.time, e.type_name, what, e.status)

sandbox.update({"execution_trace": False})
print(sandbox.execution_trace)  # False

Hold the release until the API serves the new actor captions everywhere: responses are validated strictly, so an API still sending the old lowercase values fails to parse.

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 27c00af5-9ecf-4a2e-b538-02f09d6d2e63

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn