mirror of
https://github.com/Infisical/infisical.git
synced 2026-05-02 03:02:03 -04:00
85 lines
4.9 KiB
Plaintext
85 lines
4.9 KiB
Plaintext
---
|
|
title: "Overview"
|
|
description: "Track all actions performed within Infisical"
|
|
---
|
|
|
|
<Info>
|
|
Note that Audit Logs is a paid feature.
|
|
|
|
If you're using Infisical Cloud, then it is available under the **Pro**,
|
|
and **Enterprise Tier** with varying retention periods. If you're self-hosting Infisical,
|
|
then you should contact sales@infisical.com to purchase an enterprise license to use it.
|
|
|
|
</Info>
|
|
|
|
Infisical provides audit logs for security and compliance teams to monitor information access.
|
|
With the Audit Log functionality, teams can:
|
|
|
|
- **Track** 40+ different events;
|
|
- **Filter** audit logs by event, actor, source, date or any combination of these filters;
|
|
- **Inspect** extensive metadata in the event of any suspicious activity or incident review.
|
|
|
|
|
|
|
|
## Audit Log Structure
|
|
|
|
Each log contains the following data:
|
|
|
|
| Field | Type | Description | Purpose |
|
|
| ------------------------- | -------- | --------------------------------------------------------- | ------------------------------------------------------------- |
|
|
| **event** | Object | Contains details about the action performed | Captures what happened |
|
|
| event.type | String | The specific action that occurred (e.g., "create-secret") | Identifies the exact operation |
|
|
| event.metadata | Object | Context-specific details about the event | Provides detailed information relevant to the specific action |
|
|
| **actor** | Object | Information about who performed the action | Identifies the responsible entity |
|
|
| actor.type | String | Category of actor (user, service, identity, etc.) | Distinguishes between human and non-human actors |
|
|
| actor.metadata | Object | Details about the specific actor | Provides identity information |
|
|
| actor.metadata.userId | String | Unique identifier for user actors | Links to specific user account |
|
|
| actor.metadata.email | String | Email address for user actors | Email of the executing user |
|
|
| actor.metadata.username | String | Username for user actors | Username of the executing user |
|
|
| actor.metadata.serviceId | String | Identifier for service actors | ID of specific service token |
|
|
| actor.metadata.identityId | String | Identifier for identity actors | ID to specific identity |
|
|
| actor.metadata.permission | Object | Permission context for the action | Shows permission template data when action was performed |
|
|
| **orgId** | String | Organization identifier | Indicates which organization the action occurred in |
|
|
| **projectId** | String | Project identifier | Indicates which project the action affected |
|
|
| **ipAddress** | String | Source IP address | Shows where the request originated from |
|
|
| **userAgent** | String | Client application information | Identifies browser or application used |
|
|
| **userAgentType** | String | Category of client (web, CLI, SDK, etc.) | Classifies the access method |
|
|
| **timestamp** | DateTime | When the action occurred | Records the exact time of the event |
|
|
|
|
<Accordion title="Example Payload">
|
|
```json
|
|
{
|
|
"id": "[UUID]",
|
|
"ipAddress": "[IP_ADDRESS]",
|
|
"userAgent": "[USER_AGENT_STRING]",
|
|
"userAgentType": "web",
|
|
"expiresAt": "[TIMESTAMP]",
|
|
"createdAt": "[TIMESTAMP]",
|
|
"updatedAt": "[TIMESTAMP]",
|
|
"orgId": "[ORGANIZATION_UUID]",
|
|
"projectId": "[PROJECT_UUID]",
|
|
"projectName": "[PROJECT_NAME]",
|
|
"event": {
|
|
"type": "get-secrets",
|
|
"metadata": {
|
|
"secretPath": "[PATH]",
|
|
"environment": "[ENVIRONMENT_NAME]",
|
|
"numberOfSecrets": [NUMBER]
|
|
}
|
|
},
|
|
"actor": {
|
|
"type": "user",
|
|
"metadata": {
|
|
"email": "[EMAIL]",
|
|
"userId": "[USER_UUID]",
|
|
"username": "[USERNAME]",
|
|
"permission": {
|
|
"metadata": {},
|
|
"auth": {}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
```
|
|
</Accordion>
|