/AWS1/IF_TRL=>LISTINSIGHTSDATA()

About ListInsightsData

Returns Insights events generated on a trail that logs data events. You can list Insights events that occurred in a Region within the last 90 days.

ListInsightsData supports the following Dimensions for Insights events:

• Event ID

• Event name

• Event source

All dimensions are optional. The default number of results returned is 50, with a maximum of 50 possible. The response includes a token that you can use to get the next page of results.

The rate of ListInsightsData requests is limited to two per second, per account, per Region. If this limit is exceeded, a throttling error occurs.

Method Signature

METHODS /AWS1/IF_TRL~LISTINSIGHTSDATA
  IMPORTING
    !IV_INSIGHTSOURCE TYPE /AWS1/TRLRESOURCEARN OPTIONAL
    !IV_DATATYPE TYPE /AWS1/TRLLISTINSIGHTSDATATYPE OPTIONAL
    !IT_DIMENSIONS TYPE /AWS1/CL_TRLLSTINSIGHTSDATAD00=>TT_LISTINSIGHTSDATADIMENSIONS OPTIONAL
    !IV_STARTTIME TYPE /AWS1/TRLDATE OPTIONAL
    !IV_ENDTIME TYPE /AWS1/TRLDATE OPTIONAL
    !IV_MAXRESULTS TYPE /AWS1/TRLLSTINSIGHTSDATAMAXR00 OPTIONAL
    !IV_NEXTTOKEN TYPE /AWS1/TRLPAGINATIONTOKEN OPTIONAL
  RETURNING
    VALUE(OO_OUTPUT) TYPE REF TO /aws1/cl_trllstinsightsdatarsp
  RAISING
    /AWS1/CX_TRLINVALIDPARAMETEREX
    /AWS1/CX_TRLOPNOTPERMITTEDEX
    /AWS1/CX_TRLUNSUPPORTEDOPEX
    /AWS1/CX_TRLCLIENTEXC
    /AWS1/CX_TRLSERVEREXC
    /AWS1/CX_RT_TECHNICAL_GENERIC
    /AWS1/CX_RT_SERVICE_GENERIC.

IMPORTING

Required arguments:

iv_insightsource TYPE /AWS1/TRLRESOURCEARN /AWS1/TRLRESOURCEARN

The Amazon Resource Name(ARN) of the trail for which you want to retrieve Insights events.

iv_datatype TYPE /AWS1/TRLLISTINSIGHTSDATATYPE /AWS1/TRLLISTINSIGHTSDATATYPE

Specifies the category of events returned. To fetch Insights events, specify InsightsEvents as the value of DataType

Optional arguments:

it_dimensions TYPE /AWS1/CL_TRLLSTINSIGHTSDATAD00=>TT_LISTINSIGHTSDATADIMENSIONS TT_LISTINSIGHTSDATADIMENSIONS

Contains a map of dimensions. Currently the map can contain only one item.

iv_starttime TYPE /AWS1/TRLDATE /AWS1/TRLDATE

Specifies that only events that occur after or at the specified time are returned. If the specified start time is after the specified end time, an error is returned.

iv_endtime TYPE /AWS1/TRLDATE /AWS1/TRLDATE

Specifies that only events that occur before or at the specified time are returned. If the specified end time is before the specified start time, an error is returned.

iv_maxresults TYPE /AWS1/TRLLSTINSIGHTSDATAMAXR00 /AWS1/TRLLSTINSIGHTSDATAMAXR00

The number of events to return. Possible values are 1 through 50. The default is 50.

iv_nexttoken TYPE /AWS1/TRLPAGINATIONTOKEN /AWS1/TRLPAGINATIONTOKEN

The token to use to get the next page of results after a previous API call. This token must be passed in with the same parameters that were specified in the original call. For example, if the original call specified a EventName as a dimension with PutObject as a value, the call with NextToken should include those same parameters.

RETURNING

oo_output TYPE REF TO /aws1/cl_trllstinsightsdatarsp /AWS1/CL_TRLLSTINSIGHTSDATARSP

Domain	/AWS1/RT_ACCOUNT_ID
Primitive Type	NUMC

Examples

Syntax Example

This is an example of the syntax for calling the method. It includes every possible argument and initializes every possible value. The data provided is not necessarily semantically accurate (for example the value "string" may be provided for something that is intended to be an instance ID, or in some cases two arguments may be mutually exclusive). The syntax shows the ABAP syntax for creating the various data structures.

DATA(lo_result) = lo_client->listinsightsdata(
  it_dimensions = VALUE /aws1/cl_trllstinsightsdatad00=>tt_listinsightsdatadimensions(
    (
      VALUE /aws1/cl_trllstinsightsdatad00=>ts_listinsightsdatadim_maprow(
        value = new /aws1/cl_trllstinsightsdatad00( |string| )
        key = |string|
      )
    )
  )
  iv_datatype = |string|
  iv_endtime = '20150101000000.0000000'
  iv_insightsource = |string|
  iv_maxresults = 123
  iv_nexttoken = |string|
  iv_starttime = '20150101000000.0000000'
).

This is an example of reading all possible response values

lo_result = lo_result.
IF lo_result IS NOT INITIAL.
  LOOP AT lo_result->get_events( ) into lo_row.
    lo_row_1 = lo_row.
    IF lo_row_1 IS NOT INITIAL.
      lv_string = lo_row_1->get_eventid( ).
      lv_string = lo_row_1->get_eventname( ).
      lv_string = lo_row_1->get_readonly( ).
      lv_string = lo_row_1->get_accesskeyid( ).
      lv_date = lo_row_1->get_eventtime( ).
      lv_string = lo_row_1->get_eventsource( ).
      lv_string = lo_row_1->get_username( ).
      LOOP AT lo_row_1->get_resources( ) into lo_row_2.
        lo_row_3 = lo_row_2.
        IF lo_row_3 IS NOT INITIAL.
          lv_string = lo_row_3->get_resourcetype( ).
          lv_string = lo_row_3->get_resourcename( ).
        ENDIF.
      ENDLOOP.
      lv_string = lo_row_1->get_cloudtrailevent( ).
    ENDIF.
  ENDLOOP.
  lv_paginationtoken = lo_result->get_nexttoken( ).
ENDIF.