The Audit Log API provides the query parameters startDateandendDate. These only support “date” and not “date-time”. Being the case, only a full days log is retrievable at a time.
Since audit logs are necessary for SIEM, we would want this data feed to be more timely than once every 24 hrs. Being the case, we would run the retrieval throughout the day and our process is responsible for filtering this data on the client side. By end of the day and assuming every 1 hr run, this would mean filtering out 96% of the response data.
As a system admin, I would like the Audit Log API the query parameters ofstartDateTimeandendDateTimeto support “YYYY-MM-DD hh-mm” or “YYYY-MM-DD hh-mm-ss”