Auditing

Overview

UNIFYConnect raises notable events and interactions with the service as audit entries for each of the configured audit writers, containing information such as the who, when, where, and what.

Configuration

Audit writers can be configured from the Logging tab, including:

• PowerShell Audit Writer
• Azure Log Analytics Audit Writer
• Text Audit Writer

NOTE

Due to the extra processing required for auditing, after adding the first audit writer a service restart must be performed to enable the audit capability.

Details

Audit messages can contain large amounts of information per message. Each message corresponds to an action that was performed inside the service, describing time, who, what, and details.

For example, enabling a connector would result in the following audit message:

{
    "Id": "14875045-f8b8-4e74-b8ec-0a5a1ad8d732",
    "LogTime": "2025-03-06T23:17:53Z",
    "Initiator": {
        "InitiatorType": "EventInitiator",
        "InitiatorName": "Event",
        "InitiatorIdentity": "AzureAD\\UserNameHere"
    },
    "Target": {
        "ConnectorId": "79e1e88d-32c2-4f4a-b4de-92c75036efee"
    },
    "Action": {
        "ActionDescription": "ConnectorEngine.EnableConnectorAction",
        "ActionType": "Engine",
        "ConnectorState": "True"
    },
    "Observer": {
        "ObserverId": "f031f83c-5703-456c-aa79-8e02a6844d84",
        "ObserverName": "Audit",
        "ObserverType": "Unify.AuditWriter.Text"
    },
    "Scope": [
        {
            "ScopeId": "14875045-f8b8-4e74-b8ec-0a5a1ad8d732",
            "LocationClass": "ConnectorEngine",
            "LocationMethod": "ToggleConnectorEnabled",
            "ScopeLevel": 0,
            "Current": true
        }
    ]
}

This describes who performed the action, which component the action was performed on, and any information that was changed.

Some audit messages contain larger amounts of information. For example, a connector import operation will describe not only the path taken to complete the audit action, but also the details of the data received through the action (in this case, Connector Entities).

{
    "Id": "b8d0ee13-0d80-432d-8f12-aa667e2e55d3",
    "LogTime": "2025-03-06T23:19:52Z",
    "Initiator": {
        "InitiatorType": "EventInitiator",
        "InitiatorName": "Event",
        "InitiatorIdentity": "AzureAD\\UserNameHere"
    },
    "Target": {
        "Type": "Connector",
        "ConnectorKeys": "id"
    },
    "Action": {
        "ActionDescription": "Connector.GetAllEntitiesAction",
        "ActionType": "ReadAll",
        "ActionOver": 3,
        "Async": false,
        "Entities": [
            {
                "EntityType": "ConnectorEntity",
                "Values": {
                    "id": "1",
                    "firstName": "Red",
                    "positionId": "7",
                    "lastName": "Baglow"
                }
            },
            {
                "EntityType": "ConnectorEntity",
                "Values": {
                    "id": "2",
                    "firstName": "Hilary",
                    "positionId": "3",
                    "lastName": "Cleverly"
                }
            },
            {
                "EntityType": "ConnectorEntity",
                "Values": {
                    "id": "3",
                    "firstName": "Ilyse",
                    "positionId": "9",
                    "lastName": "Dodimead"
                }
            }
        ]
    },
    "Observer": {
        "ObserverId": "f031f83c-5703-456c-aa79-8e02a6844d84",
        "ObserverName": "Audit",
        "ObserverType": "Unify.AuditWriter.Text"
    },
    "Scope": [
        {
            "ScopeId": "b8d0ee13-0d80-432d-8f12-aa667e2e55d3",
            "LocationClass": "ConnectorToReadingConnectorBridge",
            "LocationMethod": "GetAllEntities",
            "ConnectorId": "79e1e88d-32c2-4f4a-b4de-92c75036efee",
            "ScopeLevel": 1,
            "Current": true
        },
        {
            "ScopeId": "af6a96c6-ca62-4241-9e1e-114d20b41ff6",
            "LocationClass": "ChangeDetectionImportAllJob",
            "LocationMethod": "RunBase",
            "ConnectorId": "79e1e88d-32c2-4f4a-b4de-92c75036efee",
            "ScopeLevel": 0,
            "Current": false
        }
    ]
}