Audit Logging (Limited Availability)

As an administrator, you can analyze the activity of users in your organization through audit logs and gain crucial insight into the history of different user actions, ensuring transparency, traceability, compliance, reporting, and accountability for every action initiated by API clients, users, or automated processes.

Furthermore, capturing information about Anomali applications, users, actions, event timestamps, and specifics such as search queries enhances your organization's ability to operate securely.

Accessing User Audit Logs

User activity logs can be retrieved from the audit system lookup table, which captures events from both ThreatStream and Security Analytics. The table includes logs generated through the user interface as well as API interactions.

Note: Alternatively, you can view ThreatStream user audit logs on the User page of ThreatStream Settings. For details, refer to User Activity Audit.

To access user activity logs on the Anomali platform:

  1. Navigate to Search > Manage > Lookup Tables.

  2. Locate the audit system lookup table using the Search field.

  3. Click the audit link to view the table details on the Result tab.

  4. (Optionally) Use AQL expressions with the where clause to narrow down your results based on available audit fields. For example:

    Copy 
    audit | where app = "ts_user_action"

    displays all user audit logs for the ThreatStream UI.

    Copy 
    audit | where app = "search" 

    displays the list of users and AQL search queries they performed.

For the list of available fields, refer to Audit Fields.

Creating Dashboards for Audits

To simplify the process of examining audit logs, Anomali recommends you create an audit dashboard that contains dashboard panels dedicated to user actions specific to the Anomali apps such as search, api, ts_user_action, alert, and identity_sync.

To create an audit log dashboard:

  1. Navigate to the Search homepage.

  2. Enter a valid query using the audit operator. For example, the following query returns audit logs for all the users that issued a retrospective search:

    Copy 
    audit
    | where category in ('retrosearch')
    | fields user, action, timestamp

  3. Switch to the Visualization tab under the Search Box.

  4. Add the suggested visualization to your dashboard as a dashboard panel. See Working with Visualizations for more information on how you can configure the panel.

  5. Repeat steps 1–4 to add a panel for each of the applications in your audit log dashboard.