audit-compliance

Query and analyze Webex audit logs, security events, and compliance data via wxcli.

3|Updated Mar 20, 2026
One-click install
npx skills add https://github.com/achobgood/wxops --skill audit-compliance-achobgood
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: audit-compliance
Source: https://github.com/achobgood/wxops/tree/main/.claude/skills/audit-compliance
Command: npx skills add https://github.com/achobgood/wxops --skill audit-compliance-achobgood

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Investigating who changed what in Webex Control Hub, tracking security incidents, and running compliance reviews requires navigating multiple audit APIs with different scopes, date parameter formats, and filtering conventions. This Skill guides the full workflow from authentication verification through query design, execution, and result analysis. ## Core Features & Use Cases - Admin and security audit queries: Pull admin change history from Control Hub and security events (logins, token grants) with correct scope and date parameter handling for each API. - Compliance and authorization review: Query platform events for eDiscovery, review OAuth grants per user, and revoke integrations with explicit confirmation gates. - Service app and data source management: Create service app tokens and register JWT-authenticated data sources that stream Webex data to external endpoints. - Use Case: A security team investigating suspicious logins runs a scoped security-audit query over the past 7 days, exports results as JSON for SIEM ingestion, and summarizes the most active actors. ## Quick Start Ask the assistant to pull all admin audit events from the last week and summarize changes by category.

Frequently Asked Questions about audit-compliance

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I query Webex admin audit logs from the command line?

Use wxcli audit-events list with --from and --to date parameters in ISO 8601 format. You can filter by actor ID or event category, and run wxcli audit-events list-event-categories first to discover exact category names.

What is the difference between Webex admin audit and security audit events?

Admin audit events track configuration changes made by admins in Control Hub and work with a standard admin token. Security audit events track logins, token grants, and authorization changes, and require the audit:events_read scope.

Why does wxcli security-audit return 401 or 403 errors?

The security-audit API requires the audit:events_read scope specifically. A standard admin token without this scope returns 401 or 403, so regenerate the token with that scope or use a service app that has it.

Why does data-sources list return 403 when list-schemas works?

The data-sources list endpoint requires spark-admin:datasource_read, which personal access tokens do not carry, while list-schemas works without it. Use a service app or OAuth integration with the datasource scopes explicitly selected.

Can I export Webex security events to a SIEM?

Yes, run wxcli security-audit list with a date range and -o json, redirecting output to a file. For ongoing ingestion, use a rolling 24-hour window and append results to your SIEM feed file.

When should I use the events API instead of audit-events?

Use the events API for platform activity like messages, calls, meetings, and deletions in compliance or eDiscovery reviews. Use audit-events specifically for tracking admin configuration changes in Control Hub.