[{"data":1,"prerenderedAt":789},["ShallowReactive",2],{"post:\u002F2016\u002F02\u002F22\u002Fpowershell-connect-to-logicmonitors-rest-api\u002F":3},{"post":4,"newer":740,"older":748,"related":758,"series":787},{"id":5,"title":6,"body":7,"canonical":719,"categories":720,"date":723,"description":724,"extension":725,"featured":726,"hero":727,"image":727,"meta":728,"navigation":395,"path":729,"readingTime":202,"seo":730,"series":727,"seriesOrder":727,"sites":731,"source":733,"stem":734,"tags":735,"updated":737,"url":738,"__hash__":739},"blog\u002Fblog\u002F2016\u002F02\u002F22\u002Fpowershell-connect-to-logicmonitors-rest-api.md","PowerShell: Connect to LogicMonitor’s REST API",{"type":8,"value":9,"toc":712},"minimark",[10,14,19,41,45,48,182,186,189,210,213,241,245,696,700,708],[11,12,13],"p",{},"It’s been a while since I’ve posted. Way too long. I’ve had this script for quite a while that I wanted to share with the world. LogicMonitor is releasing a new REST API which requires some session based login. This script helps you obtain that session and download the audit log for the last hour. The start time is calculated in UTC, so no timezone settings need changing.",[15,16,18],"h2",{"id":17},"requirements","Requirements",[20,21,22,31,34],"ul",{},[23,24,25,26,30],"li",{},"Windows PowerShell 3.0 or later (",[27,28,29],"code",{},"Invoke-RestMethod",").",[23,32,33],{},"A LogicMonitor user that is allowed to read the access (audit) logs.",[23,35,36,37,40],{},"HTTPS access to ",[27,38,39],{},"\u003Caccount>.logicmonitor.com",".",[15,42,44],{"id":43},"parameters","Parameters",[11,46,47],{},"The script takes no parameters. Edit these values before running it.",[49,50,51,70],"table",{},[52,53,54],"thead",{},[55,56,57,61,64,67],"tr",{},[58,59,60],"th",{},"Name",[58,62,63],{},"Type",[58,65,66],{},"Required",[58,68,69],{},"Description",[71,72,73,93,110,128,147,165],"tbody",{},[55,74,75,81,84,87],{},[76,77,78],"td",{},[27,79,80],{},"$user",[76,82,83],{},"String",[76,85,86],{},"Yes",[76,88,89,90,40],{},"LogicMonitor username. Replace ",[27,91,92],{},"\u003Cusername>",[55,94,95,100,102,104],{},[76,96,97],{},[27,98,99],{},"$pass",[76,101,83],{},[76,103,86],{},[76,105,106,107,40],{},"Password for that user. Replace ",[27,108,109],{},"\u003Cpassword>",[55,111,112,117,119,121],{},[76,113,114],{},[27,115,116],{},"\u003Caccount>",[76,118,83],{},[76,120,86],{},[76,122,123,124,127],{},"Your LogicMonitor account (portal) name, in the ",[27,125,126],{},"$uri"," host name.",[55,129,130,135,138,141],{},[76,131,132],{},[27,133,134],{},"$hours",[76,136,137],{},"Int",[76,139,140],{},"No",[76,142,143,144,40],{},"How many hours back the audit log starts. Defaults to ",[27,145,146],{},"1",[55,148,149,154,156,158],{},[76,150,151],{},[27,152,153],{},"$filter",[76,155,83],{},[76,157,140],{},[76,159,160,161,164],{},"Access log filter. Defaults to ",[27,162,163],{},"_all~update","; see the LogicMonitor documentation.",[55,166,167,172,174,176],{},[76,168,169],{},[27,170,171],{},"$fields",[76,173,83],{},[76,175,140],{},[76,177,178,179,40],{},"Comma-separated fields to return. Defaults to ",[27,180,181],{},"username,happenedOnLocal,description",[15,183,185],{"id":184},"usage","Usage",[11,187,188],{},"Edit the variables at the top of the script, then run it.",[190,191,196],"pre",{"className":192,"code":193,"language":194,"meta":195,"style":195},"language-powershell shiki shiki-themes github-dark",".\\Get-LogicMonitorAuditLog.ps1\n","powershell","",[27,197,198],{"__ignoreMap":195},[199,200,203,206],"span",{"class":201,"line":202},"line",1,[199,204,40],{"class":205},"s95oV",[199,207,209],{"class":208},"sDLfK","\\Get-LogicMonitorAuditLog.ps1\n",[11,211,212],{},"To keep the result, redirect the output to a file.",[190,214,216],{"className":192,"code":215,"language":194,"meta":195,"style":195},".\\Get-LogicMonitorAuditLog.ps1 | Out-File .\\logicmonitor-audit.txt\n",[27,217,218],{"__ignoreMap":195},[199,219,220,222,225,229,232,235,238],{"class":201,"line":202},[199,221,40],{"class":205},[199,223,224],{"class":208},"\\Get-LogicMonitorAuditLog.ps1",[199,226,228],{"class":227},"snl16"," |",[199,230,231],{"class":208}," Out-File",[199,233,234],{"class":205}," .\\logicmonitor",[199,236,237],{"class":227},"-",[199,239,240],{"class":205},"audit.txt\n",[15,242,244],{"id":243},"script","Script",[190,246,248],{"className":192,"code":247,"language":194,"meta":195,"style":195},"\u003C#\n.SYNOPSIS\n    Downloads the LogicMonitor audit (access) log for the last hour through the REST API.\n.DESCRIPTION\n    Builds the start time as UTC epoch seconds, builds a Basic authentication\n    header from the user name and password, and calls the \u002Fsantaba\u002Frest\u002Fsetting\u002Faccesslogs endpoint of\n    your LogicMonitor account. The events are returned with the username, local time and description\n    fields and displayed.\n.EXAMPLE\n    .\\Get-LogicMonitorAuditLog.ps1\n.NOTES\n    Author  : Thomas Lasswell (https:\u002F\u002Fwww.techcolumnist.com)\n    Version : 1.1 (2026-09-20)\n    History : 1.0 2016-02-22 Initial version.\n              1.1 2026-09-20 Start time is computed in UTC instead of a fixed EST offset;\n                  removed the unused end time.\n    Requires: Windows PowerShell 3.0+ (Invoke-RestMethod), a LogicMonitor user with access log rights\n#>\n$user = \"\u003Cusername>\"\n$pass = \"\u003Cpassword>\"\n\n# How many hours back to read the audit log.\n$hours = 1\n\n# Get the start time as UTC epoch seconds, rounded to not have decimals.\n$epoch = New-Object DateTime 1970, 1, 1, 0, 0, 0, ([DateTimeKind]::Utc)\n$epochStart = [math]::Round(((Get-Date).ToUniversalTime().AddHours(-$hours) - $epoch).TotalSeconds)\n\n# Check the LogicMonitor documentation on filters.\n$filter = \"_all~update\"\n$fields = \"username,happenedOnLocal,description\"\n\n# Build the URI for the access logs.\n$uri = \"https:\u002F\u002F\u003Caccount>.logicmonitor.com\u002Fsantaba\u002Frest\u002Fsetting\u002Faccesslogs?sort=-happenedOn&filter=$filter,happenedOn>:$epochStart&fields=$fields\"\n\n# Build the base64 authentication string for the header.\n$base64AuthInfo = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes((\"{0}:{1}\" -f $user, $pass)))\n\n# Get the events.\n$events = Invoke-RestMethod -Headers @{Authorization = (\"Basic {0}\" -f $base64AuthInfo)} -Uri $uri\n\n# Display the events that were gathered.\n$events\n",[27,249,250,256,264,270,278,284,290,296,302,310,316,324,330,336,342,348,354,360,366,379,390,397,403,414,419,425,476,509,514,520,531,542,547,553,580,585,591,627,632,638,679,684,690],{"__ignoreMap":195},[199,251,252],{"class":201,"line":202},[199,253,255],{"class":254},"sAwPA","\u003C#\n",[199,257,259,261],{"class":201,"line":258},2,[199,260,40],{"class":208},[199,262,263],{"class":227},"SYNOPSIS\n",[199,265,267],{"class":201,"line":266},3,[199,268,269],{"class":254},"    Downloads the LogicMonitor audit (access) log for the last hour through the REST API.\n",[199,271,273,275],{"class":201,"line":272},4,[199,274,40],{"class":208},[199,276,277],{"class":227},"DESCRIPTION\n",[199,279,281],{"class":201,"line":280},5,[199,282,283],{"class":254},"    Builds the start time as UTC epoch seconds, builds a Basic authentication\n",[199,285,287],{"class":201,"line":286},6,[199,288,289],{"class":254},"    header from the user name and password, and calls the \u002Fsantaba\u002Frest\u002Fsetting\u002Faccesslogs endpoint of\n",[199,291,293],{"class":201,"line":292},7,[199,294,295],{"class":254},"    your LogicMonitor account. The events are returned with the username, local time and description\n",[199,297,299],{"class":201,"line":298},8,[199,300,301],{"class":254},"    fields and displayed.\n",[199,303,305,307],{"class":201,"line":304},9,[199,306,40],{"class":208},[199,308,309],{"class":227},"EXAMPLE\n",[199,311,313],{"class":201,"line":312},10,[199,314,315],{"class":254},"    .\\Get-LogicMonitorAuditLog.ps1\n",[199,317,319,321],{"class":201,"line":318},11,[199,320,40],{"class":208},[199,322,323],{"class":227},"NOTES\n",[199,325,327],{"class":201,"line":326},12,[199,328,329],{"class":254},"    Author  : Thomas Lasswell (https:\u002F\u002Fwww.techcolumnist.com)\n",[199,331,333],{"class":201,"line":332},13,[199,334,335],{"class":254},"    Version : 1.1 (2026-09-20)\n",[199,337,339],{"class":201,"line":338},14,[199,340,341],{"class":254},"    History : 1.0 2016-02-22 Initial version.\n",[199,343,345],{"class":201,"line":344},15,[199,346,347],{"class":254},"              1.1 2026-09-20 Start time is computed in UTC instead of a fixed EST offset;\n",[199,349,351],{"class":201,"line":350},16,[199,352,353],{"class":254},"                  removed the unused end time.\n",[199,355,357],{"class":201,"line":356},17,[199,358,359],{"class":254},"    Requires: Windows PowerShell 3.0+ (Invoke-RestMethod), a LogicMonitor user with access log rights\n",[199,361,363],{"class":201,"line":362},18,[199,364,365],{"class":254},"#>\n",[199,367,369,372,375],{"class":201,"line":368},19,[199,370,371],{"class":205},"$user ",[199,373,374],{"class":227},"=",[199,376,378],{"class":377},"sU2Wk"," \"\u003Cusername>\"\n",[199,380,382,385,387],{"class":201,"line":381},20,[199,383,384],{"class":205},"$pass ",[199,386,374],{"class":227},[199,388,389],{"class":377}," \"\u003Cpassword>\"\n",[199,391,393],{"class":201,"line":392},21,[199,394,396],{"emptyLinePlaceholder":395},true,"\n",[199,398,400],{"class":201,"line":399},22,[199,401,402],{"class":254},"# How many hours back to read the audit log.\n",[199,404,406,409,411],{"class":201,"line":405},23,[199,407,408],{"class":205},"$hours ",[199,410,374],{"class":227},[199,412,413],{"class":208}," 1\n",[199,415,417],{"class":201,"line":416},24,[199,418,396],{"emptyLinePlaceholder":395},[199,420,422],{"class":201,"line":421},25,[199,423,424],{"class":254},"# Get the start time as UTC epoch seconds, rounded to not have decimals.\n",[199,426,428,431,433,436,439,442,445,448,450,452,454,457,459,461,463,465,467,470,473],{"class":201,"line":427},26,[199,429,430],{"class":205},"$epoch ",[199,432,374],{"class":227},[199,434,435],{"class":208}," New-Object",[199,437,438],{"class":205}," DateTime ",[199,440,441],{"class":208},"1970",[199,443,444],{"class":227},",",[199,446,447],{"class":208}," 1",[199,449,444],{"class":227},[199,451,447],{"class":208},[199,453,444],{"class":227},[199,455,456],{"class":208}," 0",[199,458,444],{"class":227},[199,460,456],{"class":208},[199,462,444],{"class":227},[199,464,456],{"class":208},[199,466,444],{"class":227},[199,468,469],{"class":205}," ([",[199,471,472],{"class":227},"DateTimeKind",[199,474,475],{"class":205},"]::Utc)\n",[199,477,479,482,484,487,490,493,496,499,501,504,506],{"class":201,"line":478},27,[199,480,481],{"class":205},"$epochStart ",[199,483,374],{"class":227},[199,485,486],{"class":205}," [",[199,488,489],{"class":227},"math",[199,491,492],{"class":205},"]::Round(((",[199,494,495],{"class":208},"Get-Date",[199,497,498],{"class":205},").ToUniversalTime().AddHours(",[199,500,237],{"class":227},[199,502,503],{"class":205},"$hours) ",[199,505,237],{"class":227},[199,507,508],{"class":205}," $epoch).TotalSeconds)\n",[199,510,512],{"class":201,"line":511},28,[199,513,396],{"emptyLinePlaceholder":395},[199,515,517],{"class":201,"line":516},29,[199,518,519],{"class":254},"# Check the LogicMonitor documentation on filters.\n",[199,521,523,526,528],{"class":201,"line":522},30,[199,524,525],{"class":205},"$filter ",[199,527,374],{"class":227},[199,529,530],{"class":377}," \"_all~update\"\n",[199,532,534,537,539],{"class":201,"line":533},31,[199,535,536],{"class":205},"$fields ",[199,538,374],{"class":227},[199,540,541],{"class":377}," \"username,happenedOnLocal,description\"\n",[199,543,545],{"class":201,"line":544},32,[199,546,396],{"emptyLinePlaceholder":395},[199,548,550],{"class":201,"line":549},33,[199,551,552],{"class":254},"# Build the URI for the access logs.\n",[199,554,556,559,561,564,566,569,572,575,577],{"class":201,"line":555},34,[199,557,558],{"class":205},"$uri ",[199,560,374],{"class":227},[199,562,563],{"class":377}," \"https:\u002F\u002F\u003Caccount>.logicmonitor.com\u002Fsantaba\u002Frest\u002Fsetting\u002Faccesslogs?sort=-happenedOn&filter=",[199,565,153],{"class":205},[199,567,568],{"class":377},",happenedOn>:",[199,570,571],{"class":205},"$epochStart",[199,573,574],{"class":377},"&fields=",[199,576,171],{"class":205},[199,578,579],{"class":377},"\"\n",[199,581,583],{"class":201,"line":582},35,[199,584,396],{"emptyLinePlaceholder":395},[199,586,588],{"class":201,"line":587},36,[199,589,590],{"class":254},"# Build the base64 authentication string for the header.\n",[199,592,594,597,599,601,604,607,610,613,616,619,622,624],{"class":201,"line":593},37,[199,595,596],{"class":205},"$base64AuthInfo ",[199,598,374],{"class":227},[199,600,486],{"class":205},[199,602,603],{"class":227},"Convert",[199,605,606],{"class":205},"]::ToBase64String([",[199,608,609],{"class":227},"Text.Encoding",[199,611,612],{"class":205},"]::ASCII.GetBytes((",[199,614,615],{"class":377},"\"{0}:{1}\"",[199,617,618],{"class":227}," -f",[199,620,621],{"class":205}," $user",[199,623,444],{"class":227},[199,625,626],{"class":205}," $pass)))\n",[199,628,630],{"class":201,"line":629},38,[199,631,396],{"emptyLinePlaceholder":395},[199,633,635],{"class":201,"line":634},39,[199,636,637],{"class":254},"# Get the events.\n",[199,639,641,644,646,649,652,655,658,661,663,666,669,671,674,676],{"class":201,"line":640},40,[199,642,643],{"class":205},"$events ",[199,645,374],{"class":227},[199,647,648],{"class":208}," Invoke-RestMethod",[199,650,651],{"class":227}," -",[199,653,654],{"class":205},"Headers ",[199,656,657],{"class":227},"@",[199,659,660],{"class":205},"{Authorization ",[199,662,374],{"class":227},[199,664,665],{"class":205}," (",[199,667,668],{"class":377},"\"Basic {0}\"",[199,670,618],{"class":227},[199,672,673],{"class":205}," $base64AuthInfo)} ",[199,675,237],{"class":227},[199,677,678],{"class":205},"Uri $uri\n",[199,680,682],{"class":201,"line":681},41,[199,683,396],{"emptyLinePlaceholder":395},[199,685,687],{"class":201,"line":686},42,[199,688,689],{"class":254},"# Display the events that were gathered.\n",[199,691,693],{"class":201,"line":692},43,[199,694,695],{"class":205},"$events\n",[15,697,699],{"id":698},"notes","Notes",[20,701,702],{},[23,703,704,705,707],{},"Update 2026-09-20 (v1.1): the start time used to be the local time plus a hard-coded 4 hours (EST, and wrong during daylight saving), and an end time was calculated but never used. The start is now computed in UTC from ",[27,706,134],{},", so it works in any timezone.",[709,710,711],"style",{},"html pre.shiki code .s95oV, html code.shiki .s95oV{--shiki-default:#E1E4E8}html pre.shiki code .sDLfK, html code.shiki .sDLfK{--shiki-default:#79B8FF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .snl16, html code.shiki .snl16{--shiki-default:#F97583}html pre.shiki code .sAwPA, html code.shiki .sAwPA{--shiki-default:#6A737D}html pre.shiki code .sU2Wk, html code.shiki .sU2Wk{--shiki-default:#9ECBFF}",{"title":195,"searchDepth":258,"depth":258,"links":713},[714,715,716,717,718],{"id":17,"depth":258,"text":18},{"id":43,"depth":258,"text":44},{"id":184,"depth":258,"text":185},{"id":243,"depth":258,"text":244},{"id":698,"depth":258,"text":699},"techcolumnist",[721,722],"ps","scripts","2016-02-22T20:53:26Z","It’s been a while since I’ve posted. Way too long. I’ve had this script for quite a while that I wanted to share with the world.","md",false,null,{},"\u002Fblog\u002F2016\u002F02\u002F22\u002Fpowershell-connect-to-logicmonitors-rest-api",{"title":6,"description":724},[732,719],"lasswell","both","blog\u002F2016\u002F02\u002F22\u002Fpowershell-connect-to-logicmonitors-rest-api",[736,194],"logicmonitor","2026-09-20T00:00:00Z","\u002F2016\u002F02\u002F22\u002Fpowershell-connect-to-logicmonitors-rest-api\u002F","_bT6e_CdkJjJgureoXpZcS2oTiLN__YhazOaJg8w--8",{"title":741,"description":742,"date":743,"url":744,"categories":745,"tags":746,"image":727,"readingTime":202,"canonical":719,"sites":747,"series":727,"seriesOrder":727},"First post in a long time — changing hosting providers","Wow, it’s been a while since I’ve done a real post on this site. I’ve got many interesting things to discuss, but it has been a great last few years.","2018-03-28T22:59:53Z","\u002F2018\u002F03\u002F28\u002Ffirst-post-in-a-long-time-changing-hosting-providers\u002F",[],[],[732,719],{"title":749,"description":750,"date":751,"url":752,"categories":753,"tags":754,"image":727,"readingTime":202,"canonical":719,"sites":757,"series":727,"seriesOrder":727},"PowerShell: Autotask – Get Picklist Values","When using AutoTask’s API it’s required to lookup a various amount of picklist values that are used in updating you’re web request.","2015-02-06T18:11:32Z","\u002F2015\u002F02\u002F06\u002Fpowershell-autotask-get-picklist-values\u002F",[721,722],[755,194,756],"autotask","soap",[732,719],[759,769,778],{"title":760,"description":761,"date":762,"url":763,"categories":764,"tags":765,"image":727,"readingTime":280,"canonical":719,"sites":768,"series":727,"seriesOrder":727},"PowerShell: Active Directory – Report Group Membership Sprawl","Rank AD security groups by nesting depth, transitive member count, ownership and staleness for an access review, plus a per-user Kerberos token size estimate.","2025-12-03T14:00:00Z","\u002F2025\u002F12\u002F03\u002Fpowershell-active-directory-report-group-membership-sprawl\u002F",[721,722],[194,766,767],"active-directory","reporting",[719],{"title":770,"description":771,"date":772,"url":773,"categories":774,"tags":775,"image":727,"readingTime":272,"canonical":719,"sites":777,"series":727,"seriesOrder":727},"PowerShell: Windows Server – Disable SMBv1 Fleet-Wide and Verify","A script that audits SMBv1 access (event 3000), disables the SMBv1 server and optional feature across Windows servers, and reports which ones still need a restart.","2025-11-26T14:00:00Z","\u002F2025\u002F11\u002F26\u002Fpowershell-windows-server-disable-smbv1-fleet-wide-and-verify-it-stuck\u002F",[721,722],[194,776],"windows",[719],{"title":779,"description":780,"date":781,"url":782,"categories":783,"tags":784,"image":727,"readingTime":272,"canonical":719,"sites":786,"series":727,"seriesOrder":727},"PowerShell: Azure – Audit Who Has Owner Role Across All Subscriptions","A script that walks every subscription a credential can see and reports every Owner assignment, active or PIM-eligible, by the scope it was granted at.","2025-11-19T14:00:00Z","\u002F2025\u002F11\u002F19\u002Fpowershell-azure-audit-who-has-owner-role-across-all-subscriptions\u002F",[721,722],[194,785],"azure",[719],{"doc":727,"posts":788},[],1790223957287]