Security Audit report

During the audit process, records of all events registered in the system will be displayed in the report.

Using the report, you can track events, view detailed information about them, and filter records by parameters. Events related to data retrieval, such as printing and displaying reports, will not be registered in the system.

начало внимание 

Only system administrators and users who were granted audit access when configuring the module can work with the report.

конец внимание

Set up the report

The report is placed on a separate page using the Security audit widget. To do this:

  1. Create a page in the main left menu or in any workspace.
  2. Add the Security audit widget to the page. Set its system settings if necessary.
    The widget will display data in a table format immediately after placement.
  3. To finish editing the page, click the button in the top right corner.

Working with the report

A finished report of registered events may look like this:

audit_report1

Above the table of events, you can see filters for quickly searching data by various parameters:

  • Events. The system action whose history you want to display in the table.
  • Secrets. Confidential information contained in the app in which the event was recorded.
  • Event ID. The app item ID. This is used if the item name is unknown or non-unique.
  • Event object name. The name of the app in which the event occurred. If the app has been renamed, its previous name can be used, as each app name is stored in the system database.
  • Event description. Detailed information about the registered event.
  • Event time. The date and time of the event.
  • Event author. This can be the user who performed the action that led to the event being recorded, such as logging in, changing app settings, etc.
     
    Or the system, if the event was generated automatically, such as counting login attempts, an authentication error, etc. In this case, the row in the Author’s name column will be empty.
  • Author's IP address. The identification number of the device from which the user accessed system components.
  • Author's name. The first or last name of the employee who performed the action.
  • Login. The login of the user who performed the event.
  • Search in archive data. Select this option to search for events by specified parameters among archive data. If the option is unchecked, the events are searched only in the operational storage. The option appears if the system administrator has enabled event archiving and set the period of operational data storage in the Security Audit module settings.

To view detailed information about an event, click its name.

The data about the registered events is stored in the external database specified upon installation, separately from the information that is processes by built-in apps or Store components. These data are saved as JSON and can be processed by external applications.

Set up report table

You can customize the appearance of the table: add or remove data columns, swap their positions, or set sorting by a specific parameter.

To do this, in the top right corner of the page, click the More button and select Table Settings from the list:

  • Show Properties. Check the fields whose values will be displayed in the table by clicking on the plus icon. To remove a field from the display list, click on the minus icon. Drag and drop fields to change their display order.
  • Sort. From the drop-down list, select the parameter by which the data in the table will be sorted. Then specify the type of sorting: ascending or descending.

Event export

You can export data stored in the security audit report. Data is saved in a file in .xlsx or .csv format with a limit of 1000 records.

To start exporting data, click the More button in the top right corner, and then click Export Data.

In the window that opens, specify:

  • Format. You can save the data in .xlsx or .csv file format;
  • Export by current filter. Select this option to export data that you have pre-selected using specific parameters through report filters. For example, information on events related to confidential information, or events filtered by creation time.

The file with the exported events will be saved in the Downloads folder on your computer's hard drive.

audit-module-settings.html