From 9edfdb7234ff7c799c5b7b815945c07446cc8657 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Wed, 15 Jan 2025 02:33:21 +0100 Subject: [PATCH 1/2] docs(audit-logs): audit log streams structure --- .infisicalignore | 1 + .../audit-log-streams/audit-log-streams.mdx | 142 ++++++++++++++++++ 2 files changed, 143 insertions(+) diff --git a/.infisicalignore b/.infisicalignore index 4c19af70c..638a799e2 100644 --- a/.infisicalignore +++ b/.infisicalignore @@ -7,3 +7,4 @@ docs/self-hosting/configuration/envars.mdx:generic-api-key:106 frontend/src/views/Project/MembersPage/components/MemberListTab/MemberRoleForm/SpecificPrivilegeSection.tsx:generic-api-key:451 docs/mint.json:generic-api-key:651 backend/src/ee/services/hsm/hsm-service.ts:generic-api-key:134 +docs/documentation/platform/audit-log-streams/audit-log-streams.mdx:generic-api-key:104 diff --git a/docs/documentation/platform/audit-log-streams/audit-log-streams.mdx b/docs/documentation/platform/audit-log-streams/audit-log-streams.mdx index fdd8cc7c7..817cf7a6a 100644 --- a/docs/documentation/platform/audit-log-streams/audit-log-streams.mdx +++ b/docs/documentation/platform/audit-log-streams/audit-log-streams.mdx @@ -80,3 +80,145 @@ Your Audit Logs are now ready to be streamed. 3. Create a new header with key **DD-API-KEY** and set the value as **API Key**. + +## Audit Log Stream Data + +Each log entry sent to the external logging provider will follow the same structure. + +### Example + +Below is an example of a log entry: + +```created-secret.json +{ + "id": "7dc1713b-d787-4147-9e21-770be01cc992 ", + "actor": "user", + "actorMetadata": { + "email": "example@infisical.com", + "userId": "7383b701-d83f-45c0-acb4-04e138b987ab", + "username": "example@infisical.com" + }, + "ipAddress": "127.0.0.1", + "eventType": "create-secret", + "eventMetadata": { + "secretId": "3e5c796e-6599-4181-8dca-51133bb3acd0", + "secretKey": "TEST-SECRET", + "secretPath": "/", + "environment": "dev", + "secretVersion": 1 + }, + "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36", + "userAgentType": "web", + "expiresAt": "2025-01-18T01:11:25.552Z", + "createdAt": "2025-01-15T01:11:25.552Z", + "updatedAt": "2025-01-15T01:11:25.552Z", + "orgId": "785649f1-ff4b-4ef9-a40a-9b9878e46e57", + "projectId": "09bfcc01-0917-4bea-9c7a-2d320584d5b1", + "projectName": "example-project" +} +``` + +### Audit Logs Structure + + The unique identifier for the log entry. + + + + The entity responsible for performing or causing the event; this can be a user or service. + + + + The metadata associated with the actor. This differs based on the actor type. + + + This metadata is present when the `actor` field is set to `user`. + + + The unique identifier for the actor. + + + The email address of the actor. + + + The username of the actor. + + + + + This metadata is present when the `actor` field is set to `identity`. + + + The unique identifier for the identity. + + + The name of the identity. + + + + + This metadata is present when the `actor` field is set to `service`. + + + The unique identifier for the service. + + + The name of the service. + + + + + + If the `actor` field is set to `platform`, `scimClient`, or `unknownUser`, the `actorMetadata` field will be an empty object. + + + + + + The IP address of the actor. + + + + The type of event that occurred. Below you can see a list of possible event types. More event types will be added in the future as we expand our audit logs further. + + `get-secrets`, `delete-secrets`, `get-secret`, `create-secret`, `update-secret`, `delete-secret`, `get-workspace-key`, `authorize-integration`, `update-integration-auth`, `unauthorize-integration`, `create-integration`, `delete-integration`, `add-trusted-ip`, `update-trusted-ip`, `delete-trusted-ip`, `create-service-token`, `delete-service-token`, `create-identity`, `update-identity`, `delete-identity`, `login-identity-universal-auth`, `add-identity-universal-auth`, `update-identity-universal-auth`, `get-identity-universal-auth`, `create-identity-universal-auth-client-secret`, `revoke-identity-universal-auth-client-secret`, `get-identity-universal-auth-client-secret`, `create-environment`, `update-environment`, `delete-environment`, `add-workspace-member`, `remove-workspace-member`, `create-folder`, `update-folder`, `delete-folder`, `create-webhook`, `update-webhook-status`, `delete-webhook`, `get-secret-imports`, `create-secret-import`, `update-secret-import`, `delete-secret-import`, `update-user-workspace-role`, `update-user-workspace-denied-permissions`, `create-certificate-authority`, `get-certificate-authority`, `update-certificate-authority`, `delete-certificate-authority`, `get-certificate-authority-csr`, `get-certificate-authority-cert`, `sign-intermediate`, `import-certificate-authority-cert`, `get-certificate-authority-crl`, `issue-cert`, `get-cert`, `delete-cert`, `revoke-cert`, `get-cert-body`, `create-pki-alert`, `get-pki-alert`, `update-pki-alert`, `delete-pki-alert`, `create-pki-collection`, `get-pki-collection`, `update-pki-collection`, `delete-pki-collection`, `get-pki-collection-items`, `add-pki-collection-item`, `delete-pki-collection-item`, `org-admin-accessed-project`, `create-certificate-template`, `update-certificate-template`, `delete-certificate-template`, `get-certificate-template`, `create-certificate-template-est-config`, `update-certificate-template-est-config`, `get-certificate-template-est-config`, `update-project-slack-config`, `get-project-slack-config`, `integration-synced`, `create-shared-secret`, `delete-shared-secret`, `read-shared-secret`. + + + + The metadata associated with the event. This differs based on the event type. + + + + The user agent of the actor, if applicable. + + + + The type of user agent. + + + + The expiration date of the log entry. When this date is reached, the log entry will be deleted from Infisical. + + + + The creation date of the log entry. + + + + The last update date of the log entry. This is an unlikely to be out of sync with the `createdAt` field, as we do not update log entries after they've been created. + + + + The unique identifier for the organization where the event occurred. + + + + The unique identifier for the project where the event occurred. + + The `projectId` field will only be present if the event occurred at the project level, not the organization level. + + + + The name of the project where the event occurred. + + The `projectName` field will only be present if the event occurred at the project level, not the organization level. + \ No newline at end of file From 5fdec97319d4ea2dd195d018548a794d274d9a98 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Wed, 15 Jan 2025 17:50:30 +0100 Subject: [PATCH 2/2] requested changes --- .../audit-log-streams/audit-log-streams.mdx | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/docs/documentation/platform/audit-log-streams/audit-log-streams.mdx b/docs/documentation/platform/audit-log-streams/audit-log-streams.mdx index 817cf7a6a..2f38a3930 100644 --- a/docs/documentation/platform/audit-log-streams/audit-log-streams.mdx +++ b/docs/documentation/platform/audit-log-streams/audit-log-streams.mdx @@ -85,13 +85,11 @@ Your Audit Logs are now ready to be streamed. Each log entry sent to the external logging provider will follow the same structure. -### Example - -Below is an example of a log entry: +### Example Log Entry ```created-secret.json { - "id": "7dc1713b-d787-4147-9e21-770be01cc992 ", + "id": "7dc1713b-d787-4147-9e21-770be01cc992", "actor": "user", "actorMetadata": { "email": "example@infisical.com", @@ -109,7 +107,7 @@ Below is an example of a log entry: }, "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36", "userAgentType": "web", - "expiresAt": "2025-01-18T01:11:25.552Z", + "expiresAt": "2025-01-18T01:11:25.552Z", "createdAt": "2025-01-15T01:11:25.552Z", "updatedAt": "2025-01-15T01:11:25.552Z", "orgId": "785649f1-ff4b-4ef9-a40a-9b9878e46e57", @@ -128,7 +126,7 @@ Below is an example of a log entry: - The metadata associated with the actor. This differs based on the actor type. + The metadata associated with the actor. This varies based on the actor type. This metadata is present when the `actor` field is set to `user`. @@ -184,7 +182,7 @@ Below is an example of a log entry: - The metadata associated with the event. This differs based on the event type. + The metadata associated with the event. This varies based on the event type. @@ -204,7 +202,7 @@ Below is an example of a log entry: - The last update date of the log entry. This is an unlikely to be out of sync with the `createdAt` field, as we do not update log entries after they've been created. + The last update date of the log entry. This is unlikely to be out of sync with the `createdAt` field, as we do not update log entries after they've been created.