Sysdig Platform Audit

This is in contrast to the Activity Audit or Kubernetes Audit Log features which audit the activities on your target environments.

With Platform Audit, you can answer questions such as:

• Who deleted a policy?
• From where was a policy modified?
• Which modifications were made to a specific alert?
• What was the payload of the changed alert? What condition was changed?
• Who added this user?
• When did we change the single sign-on (SSO) settings?
• Are dashboards loading properly?

The audit includes the following request methods against the Sysdig system:

• PUT
• POST
• DELETE
• PATCH
• GET

The system audit data is retained for 90 days.

Use the Platform Audit UI

Access the UI

To access the Platform Audit UI in Sysdig Secure or Sysdig Monitor:

1. Log in as an administrator.
2. Navigate to Integrations in the left panel.
3. Under Data Sources, click Sysdig Platform Audit.

Use the UI

Use Platform Audit to understand what was done on the Sysdig platform, when, and by whom.

By default, the Platform Audit UI page filters out READ statements through the filter requestMethod != GET. This is based on the assumption that users are primarily interested in changes made on the platform in commands such as PUT, POST, DELETE, and PATCH. T

To view READ actions, click X on the the requestMethod != GET filter.

You can create custom filters by typing in the filter box, or by chossing from the selection of operators shown in the UI.

Data can be filtered based on:

• User
• Team
• Request Method
• Entity Type
• Origin IP

Use the Platform Audit API

Prerequisites

Ensure you have the following information to hand:

• Your Sysdig Secure or Sysdig Monitor API token
• The host region where your Sysdig platform is deployed. For example, https://app.sysdigcloud.com for AWS US-East.
• The Sysdig product you want to audit (Secure = SDS; Monitor = SDC)

Commands Overview

API Usage

Get All Audit Events Across the Product and Services

For Sysdig Secure

GET {{host}}/api/v1/platformAuditEvents?from={{from}}&to={{to}}&limit={{limit}}
X-Sysdig-Product: SDS
Authorization: Bearer {{token}}

For Sysdig Monitor

GET {{host}}/api/v1/platformAuditEvents?from={{from}}&to={{to}}&limit={{limit}}
X-Sysdig-Product: SDC
Authorization: Bearer {{token}}

Get Audit Events for a Specific Entity

auditTrail.entityType is used if you want to list audit events only for a specific entity or list of entities. In this example, we want to fetch only auth audit events.

X-Sysdig-Product:= SDS (Sysdig Secure) SDC (Sysdig Monitor)

GET {{host}}/api/v1/platformAuditEvents?filter=auditTrail.entityType in ("auth")&from={{from}}&to={{to}}&limit={{limit}}
X-Sysdig-Product: SDS
Authorization: Bearer {{token}}

Entities

Sysdig Admin Endpoints

Sysdig Monitor and Sysdig Platform

Some entities are also used in Sysdig Secure but are served by Sysdig Monitor

Sysdig Secure