Bxp - Audit Logs
From All n One's bxp software Wixi
Contents
1 Overview
Security is a primary concern of bxp software (bxp). To that end there are a number of mechanisms in effect for logging and event management from an operational and security perspective that are employed.
The area is broken into two primary suites of audit-able log areas.
- Infrastructure
- Application
Infrastructure and operating system level logging is available to the All n One support departments of Security, Frameworks and Infrastructure. The detail and information of these logs is not generally available and is used in the performance monitoring and enhancement of the solution. For proper security logging and infrastructure management the logs can also be used to refine and tweak low level security parameters to reduce and eliminate threats.
Application level logging is available to end users of bxp with correct access permissions. This information is primarily available and managed through the System Access Management module however bxp maintains numerous logs for varying purposes throughout the framework.
2 Infrastructure
2.1 Technical Operations Centre monitoring
Monitored and managed by AWS, the entire network and primary infrastructure is monitored 24/7 with varying alarms and audited change request mechanisms. At no point do these logs include customer data. All communications within the infrastructure are encrypted, including data at rest.
2.2 Event Viewer
The server solutions in the bxp framework are Microsoft based. To this end Event Viewer provides application, security and event logging, which are reviewed by period Security department operations.
2.3 IIS Logs
The primary web services are delivered using Microsoft Internet Information Server. The logs from the numerous IIS nTeir web solutions are collated and extracted for performance and reporting purposes managed by the Infrastructure department.
These logs are also used to help generate Black Lists of IP addresses seeking to affect the service.
2.4 MySQL Logs
Numerous audit-able logs are available from MySQL. The primary audit log is the slow-log, which is used to tweak and enhance the performance of the database service and provide actionable efforts to the Frameworks department to improve the service.
2.5 SFTP Logs
The SFTP server service provides access logs. These logs are used to refine Black Lists.
2.6 Hamsters
For trappable and actionable IIS error events, e.g. (500 internal server error or 404 page not found), a hamster error report is generated. These events are distributed to various departments to manage their resolution. For more information on the hamsters please review Meet_the_Hamsters The information stored in a Hamster log will include all browser transmitted information at the time of the error. A snapshot of the identifiable information is available from https://ww3.allnone.ie/public/client_debug.asp
3 Application
Within the bxp platform there are numerous further actionable audit logs.
3.1 PageView
Every page that a user visits is logged in a client specific table called the PageLog. The information does not contain customer identifiable information. The primary information logged is:
- DateTime
- User
- Page
- Module
- Section
PageLogs are retained on a rolling six months basis and are only available to All n One support staff for security purposes to trouble shoot issues.
Main Menu > System Access Management > Security Reports > Security - System Page Log Full Audit Trail
3.2 SecurityLog
The SecurityLog provides audit-able event history specifically around login and logout events.
A number of key interaction pieces of information are maintained.
- Date Time
- Remote Address
- Remote Host
- Remote User
- Called Server
- Called URL
- System
- User Id
- User Name
- User Entered Values
- Event Type
- Result
Main Menu > System Access Management > Security Reports >
- Login Report - Last Login
- Login Report - All Logins
- Login Report - Failed Logins
- Login Report - Failed Logins - IP Restricted
SecurityLogs are retained on a rolling six month basis.
3.3 ArticleView
A second audit-able event log is maintained for key event recording. These events record key Ids for auditing purposes but customer identifiable information . The events currently recorded include:
- Accounts - Data File
- Accounts - Edit Transaction
- Campaign - Data Load
- Campaign - XML Load
- Create Archive - Complete
- Create Archive - Custom Output
- Create Campaign Archive - Complete
- FAQ - View
- InfoCentre - Local - View
- InfoCentre - Master - View
- SAM - Add User
- SAM - Edit User
- SAM - Group file user create
- SAM - Group User Field Update -
- SAM - Group User Security Reset
- SAM - User Profile
- Campaign [ & intCampaign_Id & "] - Document View
- Check mailbox - Campaign Management
- Check mailbox - Task Management
- Security - Password updated
- Update : Adding : & strTable_Name
- Update : Deleting : & strTable_Name
Logs of these events are available through reports in the System Access Management module
Main Menu > System Access Management > Security Reports > Security - System Events Audit Trail >
ArticleViews are retained on a rolling six month basis.
3.4 Logging and Reporting
There is extensive reporting available within each module on various aspects of content entered into the bxp instance. For all Wixi articles on reports available you can use as an initial reference point.
3.4.1 Form Management
Vast amounts of information are recorded with every interaction with a data record. For further information on what is stored with every interaction from an Inbound, Outbound, Blended, Case, Examination, Quality Assurance or Survey form, please refer to the reporting documentation for each area for what is possible. Training
3.4.2 eCourse Management
eLearning and eCourse interaction is recorded separately and extensively for eCourse and eCourse modification interactions. For more information on the reporting and data available please refer to the various training materials available for eLearning. Learning_and_Development_Training