273-object-collection-audit-modifications-24h.xml

<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright (c) 2010-2019 Evolveum and contributors
  ~
  ~ This work is dual-licensed under the Apache License 2.0
  ~ and European Union Public License. See LICENSE file for details.
  -->

<objectCollection xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
                  xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3"
                  xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
                  oid="00000000-0000-0000-0001-000000000002">
    <name>Modification audit records in 24h</name>
    <type>AuditEventRecordType</type>
    <filter>
        <q:and>
            <q:equal>
                <q:path>eventStage</q:path>
                <q:value>execution</q:value>
            </q:equal>
            <q:or>
                <q:equal>
                    <q:path>eventType</q:path>
                    <q:value>modifyObject</q:value>
                </q:equal>
                <q:equal>
                    <q:path>eventType</q:path>
                    <q:value>addObject</q:value>
                </q:equal>
                <q:equal>
                    <q:path>eventType</q:path>
                    <q:value>deleteObject</q:value>
                </q:equal>
            </q:or>
            <q:greater>
                <q:path>timestamp</q:path>
                <expression>
                    <script>
                        <code>
                            calendar = basic.addDuration(basic.currentDateTime(), "-P1D");
                            return calendar;
                        </code>
                    </script>
                </expression>
            </q:greater>
        </q:and>
    </filter>
    <domain>
        <collectionRef oid="00000000-0000-0000-0001-000000000285" type="c:ObjectCollectionType"/>
    </domain>
</objectCollection>