# Audit Logs

![](https://1981611109-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LthAmlGL8PG1hh-vzkV%2F-LvrbVNJ3Dte998vE3B9%2F-Lvrcc706mPanfzSSUwv%2FSEARCH.audit_logs%20Header.png?alt=media\&token=9bace499-5603-4263-8fab-b552e3d09bcc)

## About Audit Logs

Audit logs are provided to you as a means to track key events and user usage generated within your workgroup in the Ardexa Web App . Example events captured include by whom and when; a file is sent to your device, or a device was moved to another workgroup, when a user logged-in, or when a device was renamed. 

A detailed breakdown of audited events is provided [**below**](https://docs.ardexa.com/knowledge/app.ardexa/search/audit_logs#here-are-some-of-the-events-we-capture).

{% hint style="info" %}
**NOTE:** Records captured in the `audit_logs` table are kept indefinitely.
{% endhint %}

## **Who can access and view Audit Logs?**

Access to view this data is dependent on your workgroup and your role within that workgroup:

* User role(s) of type: 
  * `owner`are able view the `audit_logs` table to conduct searches
  * Anyone with the `read audit logs` permission.

All other role types **do not** have access to this data.

## Where can I see the Audit Logs in the Ardexa Web App?

Under the `[SEARCHES]` tab, select the `audit_logs` table to begin building your search against this data.

## Search Criteria for Common Searches

There are a number of fields associated with the audit trail, as discussed in the sections below. This table shows the common user actions that are logged, and how to search for them in the audit traill. The "action", "controller", "attribute", "new value" and "old value" refer to the fields in the audit trial. Please be aware that all the actions below have the "user\_id" field populated by the user that made the change. Also, the "status" field will indicate the success or failure of the command. 

#### User Account Actions

<table><thead><tr><th width="155.375">User Action</th><th width="122.83984375">action</th><th width="114.953125">controller</th><th width="127.79296875">attribute</th><th width="118.5703125">new_value</th><th>old_value</th></tr></thead><tbody><tr><td>Successful Login</td><td>login</td><td>auth</td><td>“MFA send challenge” (1)</td><td>No</td><td>No</td></tr><tr><td>Successful Login with MFA (1)</td><td>MFA login</td><td>auth</td><td><br></td><td>No</td><td>No</td></tr><tr><td>Failed Password Login</td><td>Login</td><td>auth</td><td><br></td><td>No</td><td>No</td></tr><tr><td>Invalid MFA code</td><td>MFA login</td><td>auth</td><td><br></td><td>No</td><td>No</td></tr><tr><td>User Profile Change</td><td>Update</td><td>me</td><td>record</td><td>Yes</td><td>Yes</td></tr><tr><td>Change Email (userid)</td><td>Request email change</td><td>me</td><td>email</td><td>Yes</td><td>Yes</td></tr><tr><td>Change Password</td><td>Change password</td><td>me</td><td><br></td><td>No</td><td>No</td></tr><tr><td>Logouts (3)</td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td></tr></tbody></table>

(1): This will appear only if the user is using MFA

(3): Logouts, either by the user or by inactivity timeout, are currently not logged

#### Workgroup Actions

<table><thead><tr><th width="157.015625">User Action</th><th width="120.625">action</th><th width="113.28125">controller</th><th>attribute</th><th width="122.68359375">new_value</th><th>old_value</th></tr></thead><tbody><tr><td>Change Workgroup Settings (2)(4)</td><td>(5)</td><td>workgroup-setting</td><td><br></td><td>Yes</td><td>Yes</td></tr><tr><td>Change Lookup Table (2)(4)</td><td>(5)</td><td>lookupTable</td><td><br></td><td>Yes</td><td>Yes</td></tr><tr><td>Run a Security Scan</td><td>bulk-run</td><td>Job</td><td><br></td><td>No</td><td>No</td></tr><tr><td>Device Group Actions (2)(4)</td><td>(5)</td><td>device-group</td><td><br></td><td>(4)</td><td>(4)</td></tr></tbody></table>

(2): The “entity\_id” table entry in the audit table will also be populated, when undertaking this activity

(4): The “old\_value\_full” and/or “new\_value\_full” may be populated with this record

(5): This can be one of update, create or delete

#### User Permissions

<table><thead><tr><th width="153.8359375">User Action</th><th>action</th><th width="110.96875">controller</th><th>attribute</th><th width="121.00390625">new_value</th><th>old_value</th></tr></thead><tbody><tr><td>User Permission Change (6)</td><td>update</td><td>org</td><td>permissions</td><td>Yes</td><td>Yes</td></tr><tr><td>Invite a User (9)</td><td>invite</td><td>org</td><td>membership</td><td>Yes</td><td>No</td></tr><tr><td>Remove a User (10)</td><td>remove</td><td>org</td><td>membership</td><td>No</td><td>Yes</td></tr><tr><td>New User</td><td>accept</td><td>org</td><td>invite</td><td>No</td><td>No</td></tr></tbody></table>

(6): The user/device that is affected by the change will be in the “Comments” column

(9): The "new\_value" contains the user email that was invited and the workgroup invited to

(10):  "old\_value" contains the removed user's email and the workgroup from which they were removed.

#### Tables and External Sources

<table><thead><tr><th width="158.30078125">User Action</th><th width="112.99609375">action</th><th>controller</th><th>attribute</th><th>new_value</th><th>old_value</th></tr></thead><tbody><tr><td>Delete a Table</td><td>delete</td><td>storage</td><td>object</td><td>No</td><td>No</td></tr><tr><td>Delete an External Source</td><td>delete</td><td>externalSources</td><td>record</td><td>No</td><td>No</td></tr><tr><td>Create an External Source</td><td>create</td><td>externalSources</td><td>record</td><td>Yes</td><td>No</td></tr></tbody></table>

#### Device Actions

<table><thead><tr><th width="158.33203125">User Action</th><th width="125.4609375">action</th><th>controller</th><th>attribute</th><th>new_value</th><th>old_value</th></tr></thead><tbody><tr><td>Rename a Device</td><td>update</td><td>device</td><td>name</td><td>Yes</td><td>Yes</td></tr><tr><td>Create a new Device (6)</td><td>create</td><td>device</td><td>object</td><td>Yes</td><td>No</td></tr><tr><td>Remove a Device (6)</td><td>remove</td><td>device</td><td>object</td><td>No</td><td>Yes</td></tr><tr><td>Update a Certificate</td><td>update</td><td>device</td><td>certificate</td><td>Yes</td><td>No</td></tr><tr><td>Refresh Metadata</td><td>refresh_meta</td><td>websocket_device</td><td><br></td><td>No</td><td>No</td></tr><tr><td>Move a Device to a new Workgroup</td><td>move</td><td>device</td><td>workgroup.deviceId</td><td>Yes</td><td>Yes</td></tr><tr><td>Run a Command</td><td>run_cmd</td><td>websocket_device</td><td><br></td><td>No</td><td>No</td></tr><tr><td>Send a File</td><td>send</td><td>device</td><td>file</td><td>Yes</td><td>No</td></tr><tr><td>Get a File</td><td>get</td><td>device</td><td>file</td><td>Yes</td><td>No</td></tr><tr><td>Install a Plugin</td><td>install</td><td>plugin</td><td>{plugin name}</td><td>No</td><td>No</td></tr><tr><td>Uninstall a Plugin</td><td>uninstall</td><td>plugin</td><td>{plugin name}</td><td>No</td><td>No</td></tr><tr><td>Change Agent Config (7)</td><td>apply_config</td><td>websocket_device</td><td><br></td><td>No</td><td>No</td></tr><tr><td>Change Network Settings (8)</td><td>send</td><td>device</td><td>file</td><td>Yes</td><td>No</td></tr><tr><td>Network Scan</td><td>run</td><td>device</td><td>discovery</td><td>"network scan"</td><td>No</td></tr><tr><td>Port Scan</td><td>run</td><td>device</td><td>discovery</td><td>"port scan"</td><td>No</td></tr><tr><td>Open Services Scan</td><td>run</td><td>device</td><td>discovery</td><td>"open services"</td><td>No</td></tr><tr><td>Web Tunnel</td><td>start_session</td><td>remote_web</td><td><br></td><td>No</td><td>No</td></tr><tr><td>TCP Port Tunnel</td><td>open_tunnel</td><td>websocket_device</td><td><br></td><td>No</td><td>No</td></tr><tr><td>Tunnel Start<br></td><td>start_tunnel_session</td><td>websocket_device</td><td><br></td><td>No</td><td>No</td></tr><tr><td><br>Tunnel Close</td><td>close_tunnel</td><td>websocket_device</td><td><br></td><td>No</td><td>No</td></tr><tr><td>Device Offline</td><td>offline</td><td>state_change</td><td><br></td><td>No</td><td>No</td></tr><tr><td>Device Online</td><td>online</td><td>state_change</td><td><br></td><td>No</td><td>No</td></tr></tbody></table>

(6): The user/device that is affected by the change will be in the “Comments” column

(7): Details of the new config will be in the "config" field

(8): Details of file for interface config will be in the "new\_value" field

#### Alert Actions

<table><thead><tr><th width="160.74609375">User Action</th><th width="115.0859375">action</th><th width="133.92578125">controller</th><th>attribute</th><th>new_value</th><th>old_value</th></tr></thead><tbody><tr><td>Alert Changed</td><td>update</td><td>alert</td><td><br></td><td>(4)</td><td>(4)</td></tr><tr><td>Alert Deleted</td><td>delete</td><td>alert</td><td><br></td><td>No</td><td>No</td></tr><tr><td>Alert Created</td><td>create</td><td>alert</td><td><br></td><td>(4)</td><td>No</td></tr></tbody></table>

(4): The “old\_value\_full” and/or “new\_value\_full” may be populated with this record

#### Search Actions

<table><thead><tr><th width="162.0234375">User Action</th><th width="119.328125">action</th><th>controller</th><th>attribute</th><th>new_value</th><th>old_value</th></tr></thead><tbody><tr><td>Change a Saved Search</td><td>update</td><td>search</td><td>name</td><td>Yes</td><td>Yes</td></tr><tr><td>Share a Search</td><td>share</td><td>search</td><td>record</td><td>Yes</td><td>Yes</td></tr></tbody></table>

## How to read and understand your audit\_logs searches

The audit\_logs table works like any other search. You can build filters and show the columns relevant to your needs.\
\
To understand how you might go about reading this data, provided here, are the most important fields and their description:

| Field             | Always? | Description                                                                                                                                                                                                            |
| ----------------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **EVENT\_TIME**   | Y       | When the event was recorded.                                                                                                                                                                                           |
| **CONTROLLER**    | Y       | The component inside the Ardexa Web App that recorded and applied the event against the `ENTITY`.                                                                                                                      |
| **DEVICE**        | N       | The device that the event was related, if the event was actually related to a device.                                                                                                                                  |
| **ENTITY**        | Y       | The unit or something that was worked upon. Examples might be: `device`, `user`, `workgroup,`                                                                                                                          |
| **ACTION**        | Y       | <p>The simple description of the event. Examples might be:</p><p><code>get</code>, <code>update</code>, <code>send</code>, <code>run</code>, <code>login</code>, <code>move</code></p>                                 |
| **ATTRIBUTE**     | N       | A simple description of the attribute that was affected by the action                                                                                                                                                  |
| **OLD\_VALUE**    | N       | If a prior value of the attribute is relevant and available for the action being applied then it will be captured here.                                                                                                |
| **NEW\_VALUE**    | N       | Specifics for the audit event are captured here. For example: new attribute values, files names, descriptors of the event                                                                                              |
| **STATUS**        | N       | Reports if the attempted action was `success` or `failed` .For example some events are thrown-out due to permission limitations but there is still a need to know it was attempted, eg deleting the `audit_log` table. |
| **WORKGROUP\_ID** | Y       | The user's workgroup that the was active when the user triggered the event.                                                                                                                                            |
| **USER\_ID**      | Y       | The user's details that triggered the event.                                                                                                                                                                           |

## Can the audit\_log Table be Deleted?

{% hint style="success" %}
**No**.&#x20;

The `audit_log` table is among a number of system tables that can never be deleted.&#x20;

Any attempt to delete a table or an index, the `audit_log` table itself included, whether it succeeds or fails, is recorded as an entry in the audit\_log table. This can be viewed through your searches on the `audit_log` table.
{% endhint %}

## An example audit\_logs concise search

![A suggested search to easily read the audit data (best viewed on a large monitor)](https://1981611109-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LthAmlGL8PG1hh-vzkV%2F-LvrarepcjacQEMHexyn%2F-Lvrb2CKqjDyjyWTTCtM%2FSEARCH.audit_log.png?alt=media\&token=47ddf862-d4a3-4ed7-b0df-e00d9b5bb655)