Sysdig Platform Audit

This is in contrast to the Activity Audit or Kubernetes Audit Log features which audit the activities on your target environments.

With Platform Audit, you can answer questions such as:

• Who deleted a policy?
• From where was a policy modified?
• Which modifications were made to a specific alert?
• Who added this user?
• When did we change the single sign-on (SSO) settings?

The audit includes the following request methods against the Sysdig system:

• PUT
• POST
• DELETE
• PATCH
• GET

Sysdig retains system audit data for 90 days. To retain Sysdig Secure platform audit data for longer, you can use Event Forwarding, to forward platform audit events to third-party tools, such as Mezmo. See Event Forwarding. You cannot forward Sysdig Monitor system audit data.

Use the Platform Audit UI

Access the UI

To access the Platform Audit in Sysdig Secure or Sysdig Monitor UI:

1. Log in as an administrator.
2. From the left navigation bar, select Integrations > Data Sources | Sysdig Platform Audit.

Use the UI

Platform Audit lets you understand what was done on the Sysdig platform, when, and by whom.

You can create custom filters by typing in the filter box, or by choosing from the selection of operators shown in the UI.

Data can be filtered based on:

• User
• Team
• Request Method
• Entity Type
• Origin IP

By default, the Platform Audit UI page filters out READ statements through the filter requestMethod != GET. This is based on the assumption that you might be primarily interested in changes made on the platform with commands such as PUT, POST, DELETE, and PATCH. To view READ actions, click X to delete the requestMethod != GET filter.

The date range is given to the right of the filter bar. Select the dates to open up a calendar, where you can define a custom range. The date range can be a maximum of 14 days.

Use the Platform Audit API

Prerequisites

Ensure you have the following information to hand:

• Your Sysdig Secure or Sysdig Monitor API token
• The correct URL for the region where your Sysdig SaaS platform is deployed. For example, https://app.sysdigcloud.com for AWS US-East. To find the correct URL for your region, see SaaS Regions and IP Ranges.
• The code of the Sysdig product you want to audit. Secure = SDS. Monitor = SDC.

Commands Overview

API Usage

Get All Audit Events Across the Product and Services

For Sysdig Secure

GET {{host}}/api/v1/platformAuditEvents?from={{from}}&to={{to}}&limit={{limit}}
X-Sysdig-Product: SDS
Authorization: Bearer {{token}}

For Sysdig Monitor

GET {{host}}/api/v1/platformAuditEvents?from={{from}}&to={{to}}&limit={{limit}}
X-Sysdig-Product: SDC
Authorization: Bearer {{token}}

Get Audit Events for a Specific Entity

auditTrail.entityType is used if you want to list audit events only for a specific entity or list of entities. In this example, we want to fetch only auth audit events.

X-Sysdig-Product:= SDS (Sysdig Secure) SDC (Sysdig Monitor)

GET {{host}}/api/v1/platformAuditEvents?filter=auditTrail.entityType in ("auth")&from={{from}}&to={{to}}&limit={{limit}}
X-Sysdig-Product: SDS
Authorization: Bearer {{token}}

Entities

Sysdig Admin Endpoints

Sysdig Monitor and Sysdig Platform

Some entities are also used in Sysdig Secure but are served by Sysdig Monitor

Sysdig Secure

The Infrastructure as Code (IAC) Entities

This list contains Infrastructure as Code (IAC) entities in Sysdig Secure: