Cisco Cisco Firepower Management Center 2000 Guia Do Programador

You cannot perform joins on the 

 table.

The following query returns up to the 25 most recent audit log entries, sorted by time.

SELECT from_unixtime(action_time_sec) 

AS Time, user, subsystem, message, source, count(*) 

AS Total 

FROM audit_log 

GROUP BY source, subsystem, user, message 

ORDER BY source DESC;

The 

 table contains information on malware events. These events contain information on 

malware detected or quarantined within a cloud, the detection method, and hosts and users affected by 
the malware. New fields were added to identify the application which triggered the event, how the event 
is handled, and to correlate the event with connection, intrusion, and file events.

For more information, see the following sections:

The following table describes the database fields you can access in the 

 table.

subsystem

The menu path the user followed to generate the audit record.

user

The user name of the user who triggered the audit event.

application_id

ID number that maps to the application performing the file transfer. 

application_name

Name of the application performing the transfer.

client_application_id

The internal identification number for the client application, if applicable.

client_application_name

The name of the client application, if applicable.