Configuring auditing to track events
SafeNet Excess Exchange includes a suite of auditing capabilities. You can record every login and administrator action and review those actions in the Admin Console. SafeNet Excess Exchange also includes a Listener SPI that listens for events and can trigger actions. Examples of built-in listeners include log files and sending emails if an event occurs.
Auditing user events
You can record and view every event that affects users. SafeNet Excess Exchange triggers login events for actions such as successful user login, a user entering an incorrect password, or a user account updating. By default, SafeNet Excess Exchange does not store or display events in the Admin Console. Only the error events are logged to the Admin Console and the server’s log file.
Procedure
Use this procedure to start auditing user events.
-
Click Realm settings in the menu.
-
Click the Events tab.
-
Click the User events settings tab.
-
Toggle Save events to ON. The User events settings are displayed.
-
Specify the length of time to store events in the Expiration field.
-
Click Add saved types to see other events you can save.
-
Click Add.
-
Click Clear user events when you want to delete all saved events.
Procedure
You can now view events.
-
Click the Events tab in the menu.
-
To filter events, click Search user event.
Event types
Login events
| Events | Description |
|---|---|
Login |
A user logs in. |
Register |
A user registers. |
Logout |
A user logs out. |
Code to Token |
An application, or client, exchanges a code for a token. |
Refresh Token |
An application, or client, refreshes a token. |
Account events
| Events | Description |
|---|---|
Social Link |
A user account links to a social media provider. |
Remove Social Link |
The link from a social media account to a user account severs. |
Update Email |
An email address for an account changes. |
Update Profile |
A profile for an account changes. |
Send Password Reset |
SafeNet Excess Exchange sends a password reset email. |
Update Password |
The password for an account changes. |
Update TOTP |
The Time-based One-time Password (TOTP) settings for an account changes. |
Remove TOTP |
SafeNet Excess Exchange removes TOTP from an account. |
Send Verify Email |
SafeNet Excess Exchange sends an email verification email. |
Verify Email |
SafeNet Excess Exchange verifies the email address for an account. |
Each event has a corresponding error event.
Event listener
Event listeners listen for events and perform actions based on that event. SafeNet Excess Exchange includes two built-in listeners, the Logging Event Listener and Email Event Listener.
Auditing admin events
You can record all actions that are performed by an administrator in the Admin Console. The Admin Console performs administrative actions by invoking the SafeNet Excess Exchange REST interface and SafeNet Excess Exchange audits these REST invocations. You can view the resulting events in the Admin Console.
Procedure
Use this procedure to start auditing admin actions.
-
Click Realm settings in the menu.
-
Click the Events tab.
-
Click the Admin events settings tab.
-
Toggle Save events to ON.
SafeNet Excess Exchange displays the Include representation switch.
- Toggle Include representation to ON. The Include Representation switch includes JSON documents sent through the admin REST API so you can view the administrators actions.
Admin events settings
-
Click Save.
-
To clear the database of stored actions, click Clear admin events.
Procedure
You can now view admin events.
-
Click Events in the menu.
-
Click the Admin events tab.
When the Include Representation switch is ON, it can lead to storing a lot of information in the database.
