Export single ASM Event Log over API

I had the same issue. When you make the get request with the support id, when the support id is not correctly passed to the f5, it generates a report but a useless empty one.

In my case, because of my mistake:

Correct one:

What I can suggest is that you try to check your inputs. If you need more insight sharing the code:

    try:

        data = {
            "restPath": "/mgmt/tm/asm/events/requests",
            "filename": f"ASM_security_event_report_{datetime.now().strftime(DATE_FORMAT)}.html",
            "filter": f"id eq '{vt_number}'"
        }
        request = requests.post(url=f'{selected_f5}/mgmt/tm/asm/tasks/export-to-file', headers=headers, json=data, verify=False)
        filename = json.loads(request.text)['filename']
        id = json.loads(request.text)['id']
        request = requests.get(url=f'{selected_f5}/mgmt/tm/asm/tasks/export-to-file/{id}', headers=headers, verify=False)
        while json.loads(request.text)['status'] == "STARTED":
            request = requests.get(url=f'{selected_f5}/mgmt/tm/asm/tasks/export-to-file/{id}', headers=headers, verify=False)
            if json.loads(request.text)['status'] == 'COMPLETED':
                request = requests.delete(url=f'{selected_f5}/mgmt/tm/asm/tasks/export-to-file/{id}', headers=headers, verify=False)
        response = requests.get(url=f'{selected_f5}/mgmt/tm/asm/file-transfer/downloads/{filename}', headers=headers, verify=False)
        response.raise_for_status()
        with open('logs/%s' % filename, 'wb') as f:
            f.write(response.content)
        print(f'{filename} is saved to logs folder.')

I didn't use the article that you shared. I intercept every request with UI and replicate the steps in python. 

I hope it helps your case.

It has been a few years since I looked into the report generation process, so you may need to do some sniffing of the requests the webui makes through Developer Tools in your browser and double check this still works.

The following call is one I used to grab the report data in JSON format, this is in Python. Set the $filter attribute in the query paramater (aka the variable exampleid in this case) to match the appropriate support ID number. Send this URL via requests as a GET query:

url = "/mgmt/tm/asm/events/requests?$expand=violations%2FcontentProfileReference%2Cviolations%2FpolicyEntityReference%2Cviolations%2FsignatureReference%2Cviolations%2FhttpSubviolationReference%2F*%2Cviolations%2FwssSubviolationReference%2F*%2Cviolations%2FevasionSubviolationReference%2F*%2CrequestPolicyReference&$select=*%2CrequestPolicy%2FfullPath%2CrawRequest%2F*%2CrawResponse%2F*%2CenforcementState%2F*&$top=100&ver=13.1.1&$filter=id%20eq%20'{exampleid}'&servertime=true&$orderBy=requestDatetime%20desc%2Cid%20desc".format(exampleid=exampleid)

After obtaining the data, if you want to use it in the HTML template it normally goes into, I found it necessary to set the encoding to utf-8 before base64 encoding it. Otherwise as it is just a big JSON file, you can do whatever you want with it.