Export Audit Log Command

The Audit Log Export command allows administrators to export ThreatQ audit logs to a consolidated CSV or JSON file. Exported audit logs can be archived for long-term retention, imported into external reporting tools, or scheduled to run automatically using operating system schedulers such as cron.

The export includes audit records for all supported ThreatQ object types, including custom object types, and automatically includes new object types as they are added to your environment.

Before You Begin

• You must be running ThreatQ v6.20.1 or later.

• You must have command-line access to the ThreatQ application server.

• You must have permission to run ThreatQ Artisan commands.

• Ensure sufficient disk space is available for the exported file. By default the export will be written to the tmp folder. Example: /tmp/audit_log_export_<timestamp>.csv. This location can be changed using the --output flag - see the Export Audit Log Command Flags section below for more details. 

Performance Considerations

The Audit Log Export command is optimized for large environments and enterprise deployments.

The command:

• Streams records directly to disk to minimize memory usage.

• Automatically discovers newly added custom object types.

• Supports configurable batch sizes for large exports.

• Uses non-blocking database reads by default to minimize impact on normal ThreatQ operations.

These optimizations allow the command to export very large audit datasets without requiring significant system memory.

Export Audit Logs Command

Use the following command to export audit logs:

Copy Code

The object argument specifies which audit logs to export. If you omit it, the command exports audit logs for all supported object types.

You can specify one of the following for the object argument:

Target	Description	Example
all (default)	Exports audit logs for all supported object types.	php artisan threatq:export-audit-log
Object type	Exports audit logs for one or more object types. Specify multiple object types as a comma-separated list.	php artisan threatq:export-audit-log indicator,event
Audit table	Exports records from a specific audit table.	php artisan threatq:export-audit-log indicator_audit_log

Export Audit Logs Command Flags

The following flags will allow you to filter an export to your organization's needs. 

Flag	Description
--discover	Lists available audit tables without exporting data.
--from	Exports records changed on or after the specified date.
--to	Exports records changed on or before the specified date.
--format=csv|json	Specifies the export format. Default is CSV.
--output	Specifies the output file location.
--limit	Limits the number of exported records per table.
--chunk-size	Sets the number of records processed in each batch.
--memory-limit	Overrides the PHP memory limit used during export.
--no-dirty-read	Disables the default non-blocking database read mode.

Filtering Scenarios

Scenario	Command	Description
Export all audit logs	php artisan threatq:export-audit-log	Exports audit logs for all supported object types. By default, the output is written as a CSV file to /tmp/audit_log_export_<timestamp>.csv.
Export specific object types	php artisan threatq:export-audit-log indicator,event	Exports audit logs for the specified ThreatQ object types. Specify multiple object types as a comma-separated list.
Export a specific audit table	php artisan threatq:export-audit-log indicator_audit_log	Exports records from a single audit table instead of all object types.
Export a date range	php artisan threatq:export-audit-log --from="2026-01-01" --to="2026-01-31"	Exports only audit records modified within the specified date range.
Export recent records	php artisan threatq:export-audit-log --from="30 days ago"	Exports audit records modified within the last 30 days using a relative date.
Export a sample of records	php artisan threatq:export-audit-log --limit=1000	Limits the export to the specified number of records per audit table, which is useful for testing or sampling.
Export as CSV	php artisan threatq:export-audit-log	Exports audit logs in CSV format. This is the default output format, so the --format option is not required.
Export as JSON	php artisan threatq:export-audit-log --format=json	Exports audit logs in JSON format. The JSON output includes export metadata, audit log records, and the total number of exported records.
Save the export to a custom location	php artisan threatq:export-audit-log --output=/exports/audit_logs.csv	Writes the exported audit logs to the specified file path instead of the default output location.
View available audit tables	php artisan threatq:export-audit-log --discover	Lists all exportable audit tables that can be used with the command. Tables that do not support exporting, such as cache_audit_log, are automatically excluded.

Exported Data

Each export contains normalized audit information from every supported audit table.

Depending on the audit event, exported records may include:

• Object type

• Audit table

• Audit event type

• Object ID

• Object value

• Modified field

• Updated value

• User or integration that made the change

• Date and time of the change

• Relationship source and destination objects (for link events)

• Additional audit metadata

Relationship events include both the source and destination objects, making it easier to identify objects that were linked or unlinked.

Schedule Automatic Exports

Because the Audit Log Export command is a standard Artisan command, it can be scheduled using cron or another operating system scheduler.

Example:

Copy Code

This example exports all audit logs every day at 2:00 AM.

Troubleshooting

Issue	Resolution
Invalid object type	Verify the object type or audit table name, or run --discover to view available export targets.
Invalid output format	Specify either csv or json.
Invalid chunk size or limit	Specify a positive integer value.
Command unavailable	Contact your ThreatQ administrator to verify that the Audit Log Export feature is installed and available in your deployment.