Audit Service

📘
The audit service is only available as a S3 bucket replication and therefore requires organization to have AWS and a S3 bucket created for this purpose. Please see Setup Requirements below.

The Audit Service provides organizations with a way to keep track of what actions have occurred within the Unit21 platform. For example, audited actions may look like:

agent.login - when an agent logs in
team.create - when a team is created
team.add_permission - when team permissions are changed
team.remove_permission - when team permissions are changed

Currently, there are over 100 actions tracked by the Audit Service: Action Types

Examples of Audited Actions

{
  "actor": "146",
  "action": "agent.login",
  "asset": "146",
  "org_id": "11",
  "ip": "13.89.202.10",
  "metadata": {
    "actor_type": "agent",
    "asset_type": "agent",
    "action_details": []
  },
  "created_at": 1.656407774456435e9,
  "id": "bac507ae-9ec5-477f-b829-eb7ad73d705f",
  "submitted_at": 1.65640777447856e9,
  "env": "dev"
}

{
  "actor": "146",
  "action": "team.create",
  "asset": "2",
  "org_id": "11",
  "ip": "13.89.202.10",
  "metadata": {
    "actor_type": "agent",
    "asset_type": "team",
    "action_details": [
      { "detail_id": "146", "detail_type": "agent" },
      { "detail_id": "134", "detail_type": "agent" }
    ]
  },
  "created_at": 1.656407774456435e9,
  "id": "bac507ae-9ec5-477f-b829-eb7ad73d705f",
  "submitted_at": 1.65640777447856e9,
  "env": "dev"
}

Field Descriptions for the Actions

Field	Description
`actor`	The id of who performed/initiated the action (an agent for Unit21)
`action`	This is what was done, we should codify this to match our APIs.
`asset`	What was acted against
`org_id`	All actions take context within an organization, this is the organization id where the action took place
`ip`	If we have it, the ip address of the actor
`metadata`	Additional information about the action.
`metadata.actor_type`	The type of actor
`metadata.asset_type`	The type of the asset
`metadata.action_details`	Optional. If applicable, a list of what was impacted by the action
`metadata.action_details.detail_type`	The type of asset impacted by the action
`metadata.action_details.detail_id`	The id of the asset impacted by the action
`created_at`	The time the action took place
`submitted_at`	When the action was submitted to the service
`id`	Unit21 action id
`env`	Environment

Setup Requirements

Note: AWS is required, and only top-level bucket replication is supported.

Create a new S3 bucket with versioning enabled.
Contact your customer success manager to begin the setup process -
1. Mention your AWS account ID
2. Mention the S3 bucket name
3. Request the policy.
Once you have received the policy, add it to the S3 bucket.
Reach out to Unit21 informing us that you have added the policy, and asking us to turn on replication.
Watch our audit service replicate to your bucket!