Audit logs

Audit logs document changes in a system. In the case of ReachFive, audit logs capture when certain events occur in your ReachFive account.

Currently, you can produce audit logs for the following Action(s) below.

All security-related (settings-update) updates are detected automatically.

Action Description

console:login

jobs:create

Creating an export job.

jobs:copy

Copying an export job.

jobs:update

Updating an export job.

jobs:delete

Deleting an export job.

jobs:execution

Deleting an export job.

clients:create

Creating a Client.

clients:update

Updating a Client.

clients:delete

Deleting a Client.

users:update

Updating a User.

users:delete

Deleting a User.

settings:update

Updating security settings such as rate limits, SSO, password policy, user lockouts and/or activating (or deactivating) account features.

These security-related updates are detected automatically.

Why is this useful?

Having audit logs available allows you to track changes in your system more easily. This acts as an important security mechanism, informing you of changes in the system each time they occur automatically. If, for example, someone unexpectedly exports user profiles, you will automatically be informed via the audit logs and could potentially prevent a data breach.

Create Pub/Sub hook from console

The Pub/Sub hook that you create in the ReachFive Console is triggered after an event is generated similar to that of a typical Post-event webhook.

In order for an audit log to be produced for a specified event, you must first create a Pub/Sub hook in the ReachFive Console.

Prerequisites

You must have access to the ReachFive Console.
You must have a Developer, Manager, or Administrator role.
You must have the Pub/Sub Hooks feature enabled.

Instructions

Log in to your ReachFive Console.
Go to Settings Pub/Sub Hooks Audit Logs.
Select New Pub/Sub hook or edit an existing Pub/Sub Hook.
Enable your Pub/Sub hook.

From the drop-down menu, choose the Action(s) that will trigger the Pub/Sub hook.

Action(s)

Action Description

console:login

jobs:create

Creating an export job.

jobs:copy

Copying an export job.

jobs:update

Updating an export job.

jobs:delete

Deleting an export job.

jobs:execution

Deleting an export job.

clients:create

Creating a Client.

clients:update

Updating a Client.

clients:delete

Deleting a Client.

users:update

Updating a User.

users:delete

Deleting a User.

settings:update

Updating security settings such as rate limits, SSO, password policy, user lockouts and/or activating (or deactivating) account features.

These security-related updates are detected automatically.

Enter your Project ID for your Google Cloud account.
Enter the Topic where you want requests sent.
Enter the Credentials (in JSON format) needed to connect to Google Cloud.
Don’t forget to Save your input.

View Pub/Sub results

To view the Audit Logs, you should go to your Pub/Sub page in your Google Cloud Platform (GCP) account.

Go to Topics.
Choose the desired Topic ID.
Click View Messages.
Select the desired Cloud Pub/Sub subscription.
Follow the on-screen instructions.

Audit log example

{
  "user_email": "user@gmail.com", (1)
  "entity_name": "jobs", (2)
  "user_name": "My user name", (3)
  "action_name": "create", (4)
  "created_at" : "2021-09-09T09:21:22.107809Z", (5)
  "id": "a040230b-60...998", (6)
  "ip_address": "x.x.x.x", (7)
  "action_data": { (8)
    "jobId": "AXvK4s..UnUYyz",
    "jobType": "export"
  },
  "client_id": "Console ReachFive", (9)
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36" (10)
}

1	The email of the ReachFive Console user that produced the audit log.
2	The name of the entity that produced the audit log.
3	The user name of the ReachFive Console user that produced the audit log.
4	The Action name that triggered the Pub/Sub hook that produced the audit log.
5	The creation date timestamp for the audit log.
6	The ID of the audit log.
7	The IP address of the ReachFive Console user that produced the audit log.
8	The Action data (more information about the trigger). In this case, an export event with the Id `AXvK4s..UnUYyz`.
9	The client that produced the audit log.
10	The `user_agent` that produced the audit log.