How to track SWIS connections established via API?

The last time I had to do this I used Wireshark. 

Good to know. It won't do what I need for a recurring report, but it will help if I just need to figure out which utility accounts are still being used.

Completely spit balling here.

So, if I'm remembering correctly the API communicates over the SWIS ports (17774, 17777, 17778).

If you have a load balancer or a reverse-proxy in front of your server, you could view logs for any connections to those ports.  Maybe even ship those logs off to something else (like SolarWinds Observability, Papertrail, Loggly, Kiwi Syslog, a flat file).

Am I overthinking this? 100%.  Will that stop me?

Completely spit balling here.

So, if I'm remembering correctly the API communicates over the SWIS ports (17774, 17777, 17778).

If you have a load balancer or a reverse-proxy in front of your server, you could view logs for any connections to those ports.  Maybe even ship those logs off to something else (like SolarWinds Observability, Papertrail, Loggly, Kiwi Syslog, a flat file).

Am I overthinking this? 100%.  Will that stop me?

Would that get me the account ID for the connection, or would it just get me the fact that the connection occurred and the source IP?

Running a powershell script and doing a capture on port 17777 and my IP using - trusted as my Powershell authentication type I am able to see the account being used to run the script in the packet decode. 

I would suggest setting up a capture filter on port 17777, exclude all of your polling engines in the filter and let it run. See what hosts are connecting. After you have captured data change your Find filter as shown below and search for the suspected accounts.

I will give this a try!

This is how I track mine

If all users connect via AD could there be a way to track it from the AD Server? Maybe something that ARM could help with :P

Oh, good idea. I'll ask about that.

I have had to use IIS logs to track this type of activity. I REALLY would love more audit logs for swis. This is something of a security hole AND a troubleshooting black hole. Netflow is another method that I have tracked some of this. But you are looking at larger amounts of trafffic.