topic Re: Audit log - question about some userType and eventType parameters in Alerting

Audit log - question about some userType and eventType parameters

MAkimov — Fri, 14 May 2021 12:33:40 GMT

Hello

Security department ask us about Audit log parameters.

I do not understand some parameters for userType and eventType (the documentation does not explain when they arise)

what the following parameters mean, when they are displayed:

userType:

REQUEST_ID - ??
SERVICE_NAME - ??
TOKEN_HASH -??

eventType:

GENERAL ??

Re: Audit log - question about some userType and eventType parameters

ChadTurner — Thu, 24 Dec 2020 15:34:50 GMT

I am not finding any more information on this. I will have to reach out to Dynatrace to get a better idea of what these represent. With the holidays a lot of them are offline so likely would not have an answer for you till monday

For eventType my guess is General is a catch all for anything that does not fit into any of the other options. I am not sure what action would not fit any others haha.

Re: Audit log - question about some userType and eventType parameters

ChadTurner — Wed, 30 Dec 2020 20:08:55 GMT

Update:

SERVICE_NAME holds mostly the Session Management and any users who's actions (i.e. logout) are done automatically. So basically what Dynatrace is doing automatically. It also groups USER_NAME shows the actual user performing what actions.

One of my colleague uses this API often with their customer, they have not seen any log entry with GENERAL for eventType. It is likely just a catch all for when the value does not fit a different category but is not likely used often.

Request_ID and Token_hash are likely additional identifiers that can be stored. I reached out to our API team on these, still awaiting a response