auditlog

Documentation

Index

• Constants
• func AnalyticsSQLAuditLogArchival() string
• func AnalyticsSQLAuditLogSIEM() string
• func AnalyticsSQLAuditLogUI() string
• func AuditLogJobExportColumns() []string
• func AuditLogUIExportColumns() []string
• type AnalyticsAuditResponse
  • func ParseAnalyticsAuditLogArchivalAPIResponse(r io.Reader) (*AnalyticsAuditResponse, error)
• type AuditEvent
  • func AuditEventParseMap(m map[string]string) (*AuditEvent, error)
• type AuditEventSQL
  • func (s AuditEventSQL) Event() (*AuditEvent, error)
• type AuditEvents
  • func AuditEventsParseMaps(m []map[string]string) (AuditEvents, error)
  • func (e AuditEvents) EventTimes() timeutil.Times

Constants

const AttrTimeFrame = "timeFrame" // from docs

Functions

func AnalyticsSQLAuditLogArchival

func AnalyticsSQLAuditLogArchival() string

AnalyticsSQLAuditLogArchival provides a SQL query which returns the output of the EIC Archival job.

func AnalyticsSQLAuditLogSIEM

func AnalyticsSQLAuditLogSIEM() string

AnalyticsSQLSIEM represents the SIEM Integration query listed here: https://docs.saviyntcloud.com/bundle/EIC-Admin-v23x/page/Content/Chapter20-EIC-Integrations/Saviynt-SIEM-Integration.htm#Step

func AnalyticsSQLAuditLogUI

func AnalyticsSQLAuditLogUI() string

AuditLogSQLQueryUI represents a SQL query that very closely matches the CSV / XLSX download from the Audit Log UI. The primary difference is that the `MESSAGE` column value is wrapped in the API response.

func AuditLogJobExportColumns

func AuditLogJobExportColumns() []string

func AuditLogUIExportColumns

func AuditLogUIExportColumns() []string

ExportColumns provides the column names in a standard audit log CSV or Excel export.

Types

type AnalyticsAuditResponse

type AnalyticsAuditResponse struct {
	DisplayCount int         `json:"displaycount"`
	Msg          string      `json:"msg"`
	TotalCount   int         `json:"totalcount"`
	Results      AuditEvents `json:"results"`
}

func ParseAnalyticsAuditLogArchivalAPIResponse

func ParseAnalyticsAuditLogArchivalAPIResponse(r io.Reader) (*AnalyticsAuditResponse, error)

ParseAnalyticsAuditLogArchivalAPIResponse parses an API response, e.g. `*http.Response.Body` that is associated with the SQL query defined by `AnalyticsSQLAuditLogArchival()`.`

type AuditEvent

type AuditEvent struct {
	AccessBy            string     `json:"accessBy,omitempty"`
	AccessURL           string     `json:"accessURL,omitempty"`
	Action              string     `json:"action,omitempty"`
	Data                string     `json:"data,omitempty"`
	Detail              string     `json:"detail,omitempty"`
	EventID             string     `json:"eventID,omitempty"`
	EventTime           time.Time  `json:"eventTime,omitempty"`
	IPAddress           string     `json:"ipAddress,omitempty"`
	LoginComments       string     `json:"loginComments,omitempty"`
	LoginKey            string     `json:"loginKey,omitempty"`
	LoginTime           *time.Time `json:"loginTime,omitempty"`
	LogoutTime          *time.Time `json:"logoutTime,omitempty"`
	Message             string     `json:"message,omitempty"`
	NewValue            string     `json:"newValue,omitempty"`
	ObjectAttributeName string     `json:"objectAttributeName,omitempty"`
	ObjectKey           string     `json:"objectKey,omitempty"`
	ObjectName          string     `json:"objectName,omitempty"`
	ObjectType          string     `json:"objectType,omitempty"`
	OldValue            string     `json:"oldValue,omitempty"`
	QueryParam          string     `json:"queryParam,omitempty"`
}

func AuditEventParseMap

func AuditEventParseMap(m map[string]string) (*AuditEvent, error)

type AuditEventSQL

type AuditEventSQL struct {
	AccessBy            string `json:"ACCESS_BY,omitempty"`
	AccessURL           string `json:"ACCESS_URL,omitempty"`
	Action              string `json:"ACTION,omitempty"`
	Detail              string `json:"DETAIL,omitempty"`
	EventID             string `json:"EVENT_ID,omitempty"`
	EventTime           string `json:"EVENT_TIME,omitempty"`
	IPAddress           string `json:"IP_ADDRESS,omitempty"`
	LoginComments       string `json:"LOGIN_COMMENTS,omitempty"`
	LoginKey            string `json:"LOGIN_KEY,omitempty"`
	LoginTime           string `json:"LOGIN_TIME,omitempty"`
	LogoutTime          string `json:"LOGOUT_TIME,omitempty"`
	NewValue            string `json:"NEW_VALUE,omitempty"`
	ObjectAttributeName string `json:"OBJECT_ATTRIBUTE_NAME,omitempty"`
	ObjectKey           string `json:"OBJECT_KEY,omitempty"`
	ObjectType          string `json:"OBJECT_TYPE,omitempty"`
	OldValue            string `json:"OLD_VALUE,omitempty"`
	QueryParam          string `json:"QUERY_PARAM,omitempty"`
}

func (AuditEventSQL) Event

func (s AuditEventSQL) Event() (*AuditEvent, error)

type AuditEvents

type AuditEvents []AuditEvent

func AuditEventsParseMaps

func AuditEventsParseMaps(m []map[string]string) (AuditEvents, error)

func (AuditEvents) EventTimes

func (e AuditEvents) EventTimes() timeutil.Times