Skip to content

`maqpna audit import`

Import tool calls from CloudTrail, OpenAI or Anthropic audit logs into the ledger, flagging calls that bypassed the gateway

Observe-o json | yaml

Synopsis#

maqpna audit import --source cloudtrail|openai|anthropic --ledger FILE [--since T] [--until T] [--state FILE] [--raw-dir DIR]
                    [--namespace NS [--agent A]] [--event-source S]... [--type T]... [--region R] [--endpoint URL] [--key-env VAR] [--dry-run]
maqpna audit import --source cloudtrail --ledger FILE CLOUDTRAIL_LOG_FILE|DIR...

Flags#

Flag	Type	Description	Default
`--agent`	string	attribute the events to this agent (with `--namespace`)	none
`--dry-run`	switch	fetch and report without appending or moving the cursor	none
`--endpoint`	string	API base URL (default the provider's)	none
`--event-source`	string	cloudtrail: event source to import (repeatable; default bedrock.amazonaws.com, bedrock-agentcore.amazonaws.com; files: * for all)	none
`--key-env`	string	env var holding the API key (default OPENAI_ADMIN_KEY; ANTHROPIC_COMPLIANCE_ACCESS_KEY, then ANTHROPIC_ADMIN_KEY)	none
`--ledger`	string	ledger FILE to append to (a dedicated imports ledger, or one no running gateway writes)	none
`--lookback`	duration	first import without a cursor: how far back	`24h0m0s`
`--max-events`	int	refuse a window with more events (nothing is imported; narrow it with `--until`)	`50000`
`--namespace`	string	attribute the events to this MAQPNA namespace (for evidence packs of that system)	none
`--overlap`	duration	re-read this much before the cursor (late delivery); repeats are skipped by event ID	`15m0s`
`--raw-dir`	string	also keep each raw event as DIR/SOURCE/SHA256.json	none
`--region`	string	cloudtrail: AWS region (default AWS_REGION)	none
`--since`	string	window start: RFC3339, or a duration ago (72h); default the cursor minus `--overlap`, else `--lookback`	none
`--source`	string	cloudtrail, openai or anthropic	none
`--state`	string	cursor file (default LEDGER.import-SOURCE.json)	none
`--type`	string	openai: event type, anthropic: activity type to import (repeatable; default all)	none
`--until`	string	window end, exclusive: RFC3339 or a duration ago (default now)	none

The global flags (--context, -o, --no-color, ...) work with every command.

What happens when you run it#

Reads the audit ledger offline with --ledger FILE: ledger FILE to append to (a dedicated imports ledger, or one no running gateway writes).
--dry-run: fetch and report without appending or moving the cursor.
Prints a table by default; -o json or -o yaml print the data, and --jq EXPR filters the JSON.

Exit codes#

Code	Meaning
`0`	success
`1`	error (the message says what failed, with a hint when there is one)
`2`	usage error: unknown flag, missing argument or bad value; the synopsis is printed
`3`	a check failed, a change is blocked, or a result did not match (tamper, policy mismatch) (not used by this command)