4 ms·
What questions do you ask around the audit log? We audit a lot of things but it'd be a good idea to improve that if we can. Thanks enterprise-y person. :)
by winrid 5y ago
What questions do you ask around the audit log?
We audit a lot of things but it'd be a good idea to improve that if we can.
Thanks enterprise-y person. :)
- jcims 5y agoBasically? who, what, when, were, why and how. AWS CloudTrail is far from perfect but it has been battle tested as much as any SaaS audit log out there. Who: userIdentity.arn What: requestParameters.*, responseElements.* When: eventTime Where: sourceIPAddress, sourceVpce, userAgent Why: userIdentity.issuer/rolesession How: eventName, eventSource Baller move is to include internal ops actions in your log. Main thing is to think of it as a product rather than an a feature. People don't want 10 different audit logs...everything should flow through it. With CloudTrail this extensibility comes through the requestParameters/responseElements sections. Most of the schema is fixed but in these sections its service-specific. In terms of integration, push audit via webhook or various cloud event/message brokers is ideal, but at bare minimum the customer needs to be able to ingest that data wholesale to integrate with their security stack.
- wizwit999 5y agoI would agree, CloudTrail is a pretty good example. The who what where when why is a good starting point. We're building audit logs as a service and our event format looks similar: https://apptrail.com/docs/applications/guide/event-format https://apptrail.com/docs/applications/guide/event-format