Access Control Logs​ㅤ

Overview

This page logs the history of granting and revoking direct server access permissions assigned to QueryPie users or groups.

Viewing Access Control Logs

1. Navigate to the Administrator > Audit > Servers > Access Control Logs menu.

2. Logs are displayed in descending order based on the current month.

3. You can search the table using the search field in the upper left corner with the following criteria:

   1. Name: User name

   2. Email: User email

   3. Server Group: Server group name

   4. Server Name: Server name

   5. Host: Server host

   6. Account: Server account

4. You can apply AND/OR filters by clicking the filter button on the right side of the search field with the following options:

   

   1. Event: Type of event

      1. Access Control Granted: History of granted permissions

      2. Access Control Revoked: History of revoked permissions

      3. Whitelist Granted : History of granted command whitelists

      4. Whitelist Revoked : History of revoked command whitelists

   2. Action At: Date range of permission grant/revocation

5. You can refresh the log list using the refresh button in the upper right corner of the table.

6. The table provides the following column information:

   1. No: Event identification number

   2. Action At: Date and time of permission grant/revocation

   3. Event: Event related to the permission

      1. Access Control Granted: Event where permission is granted to a user/group

      2. Access Control Revoked: Event where permission is revoked from a user/group

      3. Whitelist Granted: Event where a Command Whitelist is granted to a user/group

      4. Whitelist Revoked: Event where a Command Whitelist is revoked from a user/group

   4. User Type: Type of user/group

   5. Name: Name of the target user/group

   6. Email: Email of the target user

      1. Not displayed for groups

   7. Server Group: Server group name

   8. Server Name: Server name

   9. Host: Server host

   10. Expiration Date: Expiration date of the granted permission (revocation date)

   11. Account: Server account

   12. Action By: Name of the administrator who granted/revoked the permission or "System"

Viewing Access Control Log Details

Click on each row to view detailed information.

1. At the top, the following basic event information is displayed:

   1. Action At: Date and time of permission grant/revocation

   2. Event: Event when permission was granted/revoked from a user/group

   3. User Type: Type of user/group

   4. Name: Name of the target user/group

   5. Email: Email of the target user

   6. Server Group: Server group name

   7. Server Name: Server name

   8. Host: Server host

   9. Expiration Date: Expiration date of the granted permission (revocation date)

   10. Account: Server account

   11. Action By: Name of the administrator who granted/revoked the permission or "System"

       • If permissions were granted through a workflow, an Access Request link appears, allowing you to open the Request page in a new window.

2. At the bottom, the policies applied to the granted/revoked permissions are listed:

   1. Access Control related logs - Policy

      1. Access Time: Allowed access time

      2. Weekday Access Allow: Allowed access days

      3. IP Addresses: Allowed IP addresses

      4. Command Audit: Command audit status

      5. Proxy Usage: Whether access through Proxy (Agent) is allowed

      6. Max Sessions: Maximum number of allowed sessions

      7. Session Timeout (minutes): Session timeout duration

      8. Protocols: Allowed protocols

      9. Command Template: Applied restricted command set

   2. Whitelist related logs - Whitelisted Commands

      1. Keyword : Keyword for exception

      2. RegEx : Regular expression for exception

      3. Whitelist Expiration Date : Expiration date for the exceptions