Audit log
This section provides an overview of the audit log for the OneWelcome Identity Platform.
The Activity section is available for administrator and operator roles. The events section provides access to events that are generated by the OneWelcome Identity Platform engine as well as the console. For more information, see Event types.
Filter events
Events can be filtered on several properties. The values are case-sensitive.
- Start and/or end date: Both days (dd-MM-yyyy) and date times (dd-MM-yyyy HH:mm) are allowed. If no time is entered, the default is 00:00.
- Event Type: The different events that are triggered in the OneWelcome Identity Platform due to user action (for example, consent given or access token issued).
- Exclude access token introspections and validations: These events types appear in the audit log when the resource gateway validates a OneWelcome Identity Platform token from a client. Select this checkbox to exclude these common events from the results list.
- User ID: Unique identifier of a user.
- OAuth Client ID: The client ID given to an OAuth client or application.
- Transaction ID: Unique identifier of a transaction.
| Column name | Description |
|---|---|
| Date | The date and time of the event that was triggered. |
| Event | The event type that was triggered. For more information, see Event types. |
| OAuth Client ID | The identifier of the OAuth client that triggered the event. |
| User ID | The end user that triggered the event. |
| Client IP | The IP address of the client that triggered the event. |
| User Agent | The software agent that is acting on behalf of the user. For example, a specific internet browser version. |
| Transaction ID | The name of the header that contains a transaction id. This transaction id will be included in the audit events and requests sent to external systems. When the specified header is not available in the request, a transaction id will be generated by the application prefixed with "ONEGINI-". Note: The network gateway, for example WebSEAL, should strip the configured header name from any incoming request to prevent malicious input via this header. This header serves strictly the purpose of enabling a SIEM solution to create a transactional view of the communication flow between systems. |
An example of activity information is shown in the console screenshot that follows. On the console, hover over values with your mouse to reveal detailed information.
