MMS OnPrem1.5: Document all supported audit events

Most audits are visible by all users by visiting the Activity Feed for a Group. Audits marked "admin-only" are only visible from Admin -> General -> Audits page.

User Audits

• JOINED_GROUP
  • A user joined a Group
  • This audit is not supported if using LDAP authentication for MMS users
• REMOVED_FROM_GROUP
  • A user was removed from a Group
• INVITED_TO_GROUP
  • A user was invited to a Group
• MULTI_FACTOR_AUTH_RESET_EMAIL_SENT_AUDIT - admin-only
  • A user requested and was sent an email with a link that will allow them to reset their 2FA
• MULTI_FACTOR_AUTH_RESET_AUDIT - admin-only
  • A user reset their 2FA
• MULTI_FACTOR_AUTH_UPDATED_AUDIT - admin-only
  • A user updated their 2FA using the form in "My Profile"
• PASSWORD_RESET_EMAIL_SENT_AUDIT - admin-only
  • A user requested and was sent an email with a link that will allow them to reset their password
• PASSWORD_RESET_AUDIT - admin-only
  • A user successfully reset their password via the "reset password" flow
• PASSWORD_UPDATED_AUDIT - admin-only
  • A user successfully updated their password using the form in "My Profile"
• USER_EMAIL_ADDRESS_CHANGED_AUDIT - admin-only
  • A user changed their email address
• USER_ROLES_CHANGED_AUDIT
  • A users roles in a particular Group were changed
• SUCCESSFUL_LOGIN_AUDIT - admin-only
  • A user successfully authenticated with their username and password
• UNSUCCESSFUL_LOGIN_AUDIT - admin-only
  • A user entered a valid username, but an invalid password
• ACCOUNT_LOCKED_AUDIT
  • A user was locked out due to manual action taken by the administrator, or due to account locking policies
• ACCOUNT_UNLOCKED_AUDIT
  • A user's account was unlocked by the administrator
• USER_CREATED_AUDIT - admin-only
  • A new user was created

Host Audits

• DELETE_HOST_AUDIT
  • A host has been manually suppressed by a user
• REACTIVATE_HOST_AUDIT
  • A host has been manually reactivated by a user
• DEACTIVATE_HOST_AUDIT
  • A host has been deactivated by the system.
• ADD_HOST_AUDIT
  • A new host has been added by a user, or auto-discovered by the system
• UNDELETE_HOST_AUDIT
  • A previously suppressed host has been unsuppressed by a user
• HIDE_AND_DISABLE_HOST_AUDIT
  • A host has been determined to be a duplicate by the system, and has been hidden
• DB_PROFILER_ENABLE_AUDIT
  • Database profiling has been enabled for a host
• DB_PROFILER_DISABLE_AUDIT
  • Database profiling data collection has been disabled by a host
• HOST_IP_CHANGED_AUDIT
  • A change in IP address has been detected for a host

Alert Config Audits

• ALERT_ACKNOWLEDGED_AUDIT
  • An open alert has been acknowledged by a user.
• ALERT_UNACKNOWLEDGED_AUDIT
  • An open alert has been unacknowledged by a user.
• ALERT_CONFIG_DISABLED_AUDIT
  • An alert configuration has been disabled
• ALERT_CONFIG_ENABLED_AUDIT
  • An alert configuration has been enabled
• ALERT_CONFIG_ADDED_AUDIT
  • An alert configuration has been added
• ALERT_CONFIG_DELETED_AUDIT
  • An alert configuration has been deleted
• ALERT_CONFIG_CHANGED_AUDIT
  • An alert configuration has been edited

Backup Audits

• RS_STATE_CHANGED_AUDIT
  • Backup for a replica set is started, stopped or terminated by a user
• CLUSTER_STATE_CHANGED_AUDIT
  • Backup for a cluster is started, stopped or terminated by a user
• RESTORE_REQUESTED_AUDIT
  • A restore has been requested
• SYNC_REQUIRED_AUDIT
  • A resync of a replica set or config server has been initiated by a user
• CLUSTERSHOT_DELETED_AUDIT
  • A clustershot has been deleted by a user
• SNAPSHOT_DELETED_AUDIT
  • A snapshot for a replica set has been deleted by a user
• RS_CREDENTIAL_UPDATED_AUDIT
  • The authentication credentials for a replica set were updated by a user
• CLUSTER_CREDENTIAL_UPDATED_AUDIT
  • The authentication credentials for a cluster were updated by a user
• RS_BLACKLIST_UPDATED_AUDIT
  • The excluded namespaces for a replica set were updated by a user
• CLUSTER_BLACKLIST_UPDATED_AUDIT
  • The excluded namespaces for a cluster were updated by a user
• RS_SNAPSHOT_SCHEDULE_UPDATED_AUDIT
  • The snapshot schedule for a replica set was updated by a user
• CLUSTER_SNAPSHOT_SCHEDULE_UPDATED_AUDIT
  • The snapshot schedule for a cluster was updated by a user
• CLUSTER_CHECKKPOINT_UPDATED_AUDIT
  • The checkpoint schedule for a cluster was updated by a user

Group Audits

• GROUP_DELETED - admin-only
  • A Group was deleted
• GROUP_CREATED
  • A new Group was created