Details
-
Task
-
Status: Closed
-
Major - P3
-
Resolution: Fixed
-
None
-
None
-
4
-
true
Description
Most audits are visible by all users by visiting the Activity Feed for a Group. Audits marked "admin-only" are only visible from Admin -> General -> Audits page.
User Audits
- JOINED_GROUP
- A user joined a Group
- This audit is not supported if using LDAP authentication for MMS users
- REMOVED_FROM_GROUP
- A user was removed from a Group
- INVITED_TO_GROUP
- A user was invited to a Group
- MULTI_FACTOR_AUTH_RESET_EMAIL_SENT_AUDIT - admin-only
- A user requested and was sent an email with a link that will allow them to reset their 2FA
- MULTI_FACTOR_AUTH_RESET_AUDIT - admin-only
- A user reset their 2FA
- MULTI_FACTOR_AUTH_UPDATED_AUDIT - admin-only
- A user updated their 2FA using the form in "My Profile"
- PASSWORD_RESET_EMAIL_SENT_AUDIT - admin-only
- A user requested and was sent an email with a link that will allow them to reset their password
- PASSWORD_RESET_AUDIT - admin-only
- A user successfully reset their password via the "reset password" flow
- PASSWORD_UPDATED_AUDIT - admin-only
- A user successfully updated their password using the form in "My Profile"
- USER_EMAIL_ADDRESS_CHANGED_AUDIT - admin-only
- A user changed their email address
- USER_ROLES_CHANGED_AUDIT
- A users roles in a particular Group were changed
- SUCCESSFUL_LOGIN_AUDIT - admin-only
- A user successfully authenticated with their username and password
- UNSUCCESSFUL_LOGIN_AUDIT - admin-only
- A user entered a valid username, but an invalid password
- ACCOUNT_LOCKED_AUDIT
- A user was locked out due to manual action taken by the administrator, or due to account locking policies
- ACCOUNT_UNLOCKED_AUDIT
- A user's account was unlocked by the administrator
- USER_CREATED_AUDIT - admin-only
- A new user was created
Host Audits
- DELETE_HOST_AUDIT
- A host has been manually suppressed by a user
- REACTIVATE_HOST_AUDIT
- A host has been manually reactivated by a user
- DEACTIVATE_HOST_AUDIT
- A host has been deactivated by the system.
- ADD_HOST_AUDIT
- A new host has been added by a user, or auto-discovered by the system
- UNDELETE_HOST_AUDIT
- A previously suppressed host has been unsuppressed by a user
- HIDE_AND_DISABLE_HOST_AUDIT
- A host has been determined to be a duplicate by the system, and has been hidden
- DB_PROFILER_ENABLE_AUDIT
- Database profiling has been enabled for a host
- DB_PROFILER_DISABLE_AUDIT
- Database profiling data collection has been disabled by a host
- HOST_IP_CHANGED_AUDIT
- A change in IP address has been detected for a host
Alert Config Audits
- ALERT_ACKNOWLEDGED_AUDIT
- An open alert has been acknowledged by a user.
- ALERT_UNACKNOWLEDGED_AUDIT
- An open alert has been unacknowledged by a user.
- ALERT_CONFIG_DISABLED_AUDIT
- An alert configuration has been disabled
- ALERT_CONFIG_ENABLED_AUDIT
- An alert configuration has been enabled
- ALERT_CONFIG_ADDED_AUDIT
- An alert configuration has been added
- ALERT_CONFIG_DELETED_AUDIT
- An alert configuration has been deleted
- ALERT_CONFIG_CHANGED_AUDIT
- An alert configuration has been edited
Backup Audits
- RS_STATE_CHANGED_AUDIT
- Backup for a replica set is started, stopped or terminated by a user
- CLUSTER_STATE_CHANGED_AUDIT
- Backup for a cluster is started, stopped or terminated by a user
- RESTORE_REQUESTED_AUDIT
- A restore has been requested
- SYNC_REQUIRED_AUDIT
- A resync of a replica set or config server has been initiated by a user
- CLUSTERSHOT_DELETED_AUDIT
- A clustershot has been deleted by a user
- SNAPSHOT_DELETED_AUDIT
- A snapshot for a replica set has been deleted by a user
- RS_CREDENTIAL_UPDATED_AUDIT
- The authentication credentials for a replica set were updated by a user
- CLUSTER_CREDENTIAL_UPDATED_AUDIT
- The authentication credentials for a cluster were updated by a user
- RS_BLACKLIST_UPDATED_AUDIT
- The excluded namespaces for a replica set were updated by a user
- CLUSTER_BLACKLIST_UPDATED_AUDIT
- The excluded namespaces for a cluster were updated by a user
- RS_SNAPSHOT_SCHEDULE_UPDATED_AUDIT
- The snapshot schedule for a replica set was updated by a user
- CLUSTER_SNAPSHOT_SCHEDULE_UPDATED_AUDIT
- The snapshot schedule for a cluster was updated by a user
- CLUSTER_CHECKKPOINT_UPDATED_AUDIT
- The checkpoint schedule for a cluster was updated by a user
Group Audits
- GROUP_DELETED - admin-only
- A Group was deleted
- GROUP_CREATED
- A new Group was created