Documentation (activity and audit logs) — Defguard

Cited by

Facts read from this source

• Activity log overview Report an error

  “The Activity Log provides a comprehensive view of user interactions within your Defguard instance. This allows you to monitor user behaviour, troubleshoot issues, and maintain an audit trail of important activities.”

• Activity log fields Report an error

  “Date - timestamp of when an event has occurred User - which user triggered the event IP - location from which the action was performed Event - brief description of the event Module - which module given event belongs to Device - device (or more specifically user agent) from which the action was performed”

• Activity log modules Report an error

  “defguard - operations performed in the core Web UI (e.g. adding users, modifying devices, managing groups etc.) client - actions performed by desktop client applications enrollment - events related to the user enrollment process vpn - events related to VPN clients (e.g. client connecting to a location) posture - managing device posture checks and the result of every evaluation active_directory and ldap - LDAP and Active Directory synchronization, in both directions oidc_directory_sync - directory synchronization with an external OpenID provider”

• Activity log search Report an error

  “You can search by: Username Module Event Device The search is case-insensitive and will match partial text.”

• Activity log date filter Report an error

  “The Select range control next to the Search input limits the list to a period of time. Set Start and End, then click Apply; Reset clears the range. Both ends of the range are inclusive. Timestamps are compared in UTC.”

• Activity log permissions Report an error

  “Each user can always view their own activities (events triggered by themselves). Additionally administrators can view events related to all users.”

• Activity log events defguard Report an error

  “At the moment following events are tracked in the Activity log: defguard module UserLogin UserLoginFailed UserLogout UserMfaLogin UserMfaLoginFailed”

• Activity log events vpn Report an error

  “vpn module VpnClientConnected VpnClientDisconnected VpnClientMfaConnected VpnClientMfaDisconnected VpnClientMfaSuccess VpnClientMfaFailed VpnClientSessionSuperseded VpnClientMfaSessionSuperseded”

• Activity log events enrollment Report an error

  “enrollment module EnrollmentStarted EnrollmentDeviceAdded EnrollmentCompleted PasswordResetRequested PasswordResetStarted PasswordResetCompleted”

• Activity log events posture Report an error

  “posture module DevicePostureCreated DevicePostureUpdated DevicePostureDeleted DevicePostureDuplicated DevicePostureLocationsAssigned LocationPosturesAssigned DevicePostureCheckPassed DevicePostureCheckFailed”

• Activity log events ldap Report an error

  “active_directory and ldap modules LdapSyncUserCreated LdapSyncUserDeleted LdapSyncUserModified LdapSyncUserEnabled LdapSyncUserDisabled”

• Activity log events oidc sync Report an error

  “oidc_directory_sync module OidcDirectorySyncUserCreated OidcDirectorySyncUserDeleted OidcDirectorySyncUserEnabled OidcDirectorySyncUserDisabled”

• Siem streaming enterprise Report an error

  “Please note, that enterprise version supports streaming of audit logs to external SIEM systems.”

Scores citing this record

• The DevOps Engineer Logs, audit trail & incident response
• The IT Lead Identity, access policy & device posture
• The IT Lead Logs, audit trail & incident response
• The MSP Technician Logs, audit trail & incident response
• The Operations Manager Logs, audit trail & incident response
• The Information Security Officer Logs, audit trail & incident response
• The Skeptic Logs, audit trail & incident response