Uploaded image for project: 'Documentation'
  1. Documentation
  2. DOCS-3913

MMS OnPrem1.5: Document all supported audit events

    XMLWordPrintable

Details

    • Task
    • Status: Closed
    • Major - P3
    • Resolution: Fixed
    • None
    • v1.3.10, mms-1.5
    • Cloud Manager
    • None
    • 4
    • true

    Description

      Most audits are visible by all users by visiting the Activity Feed for a Group. Audits marked "admin-only" are only visible from Admin -> General -> Audits page.

      User Audits

      • JOINED_GROUP
        • A user joined a Group
        • This audit is not supported if using LDAP authentication for MMS users
      • REMOVED_FROM_GROUP
        • A user was removed from a Group
      • INVITED_TO_GROUP
        • A user was invited to a Group
      • MULTI_FACTOR_AUTH_RESET_EMAIL_SENT_AUDIT - admin-only
        • A user requested and was sent an email with a link that will allow them to reset their 2FA
      • MULTI_FACTOR_AUTH_RESET_AUDIT - admin-only
        • A user reset their 2FA
      • MULTI_FACTOR_AUTH_UPDATED_AUDIT - admin-only
        • A user updated their 2FA using the form in "My Profile"
      • PASSWORD_RESET_EMAIL_SENT_AUDIT - admin-only
        • A user requested and was sent an email with a link that will allow them to reset their password
      • PASSWORD_RESET_AUDIT - admin-only
        • A user successfully reset their password via the "reset password" flow
      • PASSWORD_UPDATED_AUDIT - admin-only
        • A user successfully updated their password using the form in "My Profile"
      • USER_EMAIL_ADDRESS_CHANGED_AUDIT - admin-only
        • A user changed their email address
      • USER_ROLES_CHANGED_AUDIT
        • A users roles in a particular Group were changed
      • SUCCESSFUL_LOGIN_AUDIT - admin-only
        • A user successfully authenticated with their username and password
      • UNSUCCESSFUL_LOGIN_AUDIT - admin-only
        • A user entered a valid username, but an invalid password
      • ACCOUNT_LOCKED_AUDIT
        • A user was locked out due to manual action taken by the administrator, or due to account locking policies
      • ACCOUNT_UNLOCKED_AUDIT
        • A user's account was unlocked by the administrator
      • USER_CREATED_AUDIT - admin-only
        • A new user was created

      Host Audits

      • DELETE_HOST_AUDIT
        • A host has been manually suppressed by a user
      • REACTIVATE_HOST_AUDIT
        • A host has been manually reactivated by a user
      • DEACTIVATE_HOST_AUDIT
        • A host has been deactivated by the system.
      • ADD_HOST_AUDIT
        • A new host has been added by a user, or auto-discovered by the system
      • UNDELETE_HOST_AUDIT
        • A previously suppressed host has been unsuppressed by a user
      • HIDE_AND_DISABLE_HOST_AUDIT
        • A host has been determined to be a duplicate by the system, and has been hidden
      • DB_PROFILER_ENABLE_AUDIT
        • Database profiling has been enabled for a host
      • DB_PROFILER_DISABLE_AUDIT
        • Database profiling data collection has been disabled by a host
      • HOST_IP_CHANGED_AUDIT
        • A change in IP address has been detected for a host

      Alert Config Audits

      • ALERT_ACKNOWLEDGED_AUDIT
        • An open alert has been acknowledged by a user.
      • ALERT_UNACKNOWLEDGED_AUDIT
        • An open alert has been unacknowledged by a user.
      • ALERT_CONFIG_DISABLED_AUDIT
        • An alert configuration has been disabled
      • ALERT_CONFIG_ENABLED_AUDIT
        • An alert configuration has been enabled
      • ALERT_CONFIG_ADDED_AUDIT
        • An alert configuration has been added
      • ALERT_CONFIG_DELETED_AUDIT
        • An alert configuration has been deleted
      • ALERT_CONFIG_CHANGED_AUDIT
        • An alert configuration has been edited

      Backup Audits

      • RS_STATE_CHANGED_AUDIT
        • Backup for a replica set is started, stopped or terminated by a user
      • CLUSTER_STATE_CHANGED_AUDIT
        • Backup for a cluster is started, stopped or terminated by a user
      • RESTORE_REQUESTED_AUDIT
        • A restore has been requested
      • SYNC_REQUIRED_AUDIT
        • A resync of a replica set or config server has been initiated by a user
      • CLUSTERSHOT_DELETED_AUDIT
        • A clustershot has been deleted by a user
      • SNAPSHOT_DELETED_AUDIT
        • A snapshot for a replica set has been deleted by a user
      • RS_CREDENTIAL_UPDATED_AUDIT
        • The authentication credentials for a replica set were updated by a user
      • CLUSTER_CREDENTIAL_UPDATED_AUDIT
        • The authentication credentials for a cluster were updated by a user
      • RS_BLACKLIST_UPDATED_AUDIT
        • The excluded namespaces for a replica set were updated by a user
      • CLUSTER_BLACKLIST_UPDATED_AUDIT
        • The excluded namespaces for a cluster were updated by a user
      • RS_SNAPSHOT_SCHEDULE_UPDATED_AUDIT
        • The snapshot schedule for a replica set was updated by a user
      • CLUSTER_SNAPSHOT_SCHEDULE_UPDATED_AUDIT
        • The snapshot schedule for a cluster was updated by a user
      • CLUSTER_CHECKKPOINT_UPDATED_AUDIT
        • The checkpoint schedule for a cluster was updated by a user

      Group Audits

      • GROUP_DELETED - admin-only
        • A Group was deleted
      • GROUP_CREATED
        • A new Group was created

      Attachments

        Activity

          People

            sam.kleinman Sam Kleinman (Inactive)
            cailin.nelson@mongodb.com Cailin Nelson
            Jonathan Dahl Jonathan Dahl
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:
              7 years, 51 weeks, 3 days ago