Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
tutorial:adm:reading_audits [2019/09/02 13:27]
fiserp [New identity created]
tutorial:adm:reading_audits [2021/10/07 13:39]
fiserp
Line 1: Line 1:
 ====== Audit - Reading audit information ====== ====== Audit - Reading audit information ======
 This article shows how to connect CzechIdM to automated security monitoring system (SIEM). This form of integration is necessary in many organizations. IdM, being the central point where identities and their roles are managed, is just another piece of the security monitoring mosaic. This article shows how to connect CzechIdM to automated security monitoring system (SIEM). This form of integration is necessary in many organizations. IdM, being the central point where identities and their roles are managed, is just another piece of the security monitoring mosaic.
 +
 +<note tip>Starting CzechIdM 11.2.0, we discourage reading audit information using REST as is explained on this page.
 +
 +Please, use specialized [[devel:documentation:audit:dev:audit_logging_for_siem_tools|audit logging functionality]].</note>
  
 ===== Important events to monitor ===== ===== Important events to monitor =====
Line 508: Line 512:
       "id" : 528,       "id" : 528,
       "timestamp" : 1565769780568,       "timestamp" : 1565769780568,
 +      // who created the role
       "modifier" : "admin",       "modifier" : "admin",
 +      // role name in the form of NAME|environment
       "ownerCode" : "CTO|production",       "ownerCode" : "CTO|production",
       ... redacted ...       ... redacted ...
Line 515: Line 521:
           "creator" : "admin",           "creator" : "admin",
           "code" : "CTO|production",           "code" : "CTO|production",
 +          // implementation name of the role
           "baseCode" : "CTO",           "baseCode" : "CTO",
 +          // deployment environment the role is intended for
           "environment" : "production",           "environment" : "production",
 +          // user friendly name of the role
           "name" : "CTO",           "name" : "CTO",
           "roleType" : "TECHNICAL",           "roleType" : "TECHNICAL",
  • by fiserp