Sysdig Platform Audit

Sysdig provides both a UI and a set of APIs for auditing and reporting on the use of the Sysdig platform itself. (This is in contrast to the Activity Audit or Kubernetes Audit Log features which audit activity on your target environments.)

With Platform Audit, you can answer questions such as:

• Who deleted a policy?
• From where a policy was modified?
• Which modifications were made for a specific alert?
• What was the payload of the changed alert (condition changed?)
• Who added this user?
• When did we change the SSO settings?
• Are dashboards loading properly?

The audit includes the following request methods against the Sysdig system:

• PUT
• POST
• DELETE
• PATCH
• GET

The data retention for system audit info is 90 days.

Use the Platform Audit UI

Access the UI

From Sysdig Secure

1. Log in to Sysdig Secure as an administrator.
2. Navigate to Integrations > Sysdig Platform Audit.

From Sysdig Monitor

1. Log in to Sysdig Monitor as an administrator.
2. Navigate to Integrations > Data Sources | Sysdig Platform Audit.

UI Usage

Use Platform Audit to understand what was done on the Sysdig platform, by whom, and when.

By default, the Platform Audit UI page filters out the READ statements (i.e. requestMethod != GET) on the assumption that users are interested in changes taken on the platform (PUT, POST, DELETE, and PATCH). This filter can be modified if read actions are required.

The data can be filtered based on:

• User
• Team
• Request Method
• Entity Type
• Origin IP

Use the Platform Audit API

Prerequisites

Know your:

• Sysdig Secure or Sysdig Monitor API token
• The host region where your Sysdig platform is deployed, e.g., https://app.sysdigcloud.com for AWS us-east.
• The Sysdig product you want to audit (Secure = SDS; Monitor = SDC)

Commands Overview

API Usage

Get All Audit Events Across the Product and Services

For Sysdig Secure

GET {{host}}/api/v1/platformAuditEvents?filter=from={{from}}&to={{to}}&limit={{limit}}
X-Sysdig-Product: SDS
Authorization: Bearer {{token}}

For Sysdig Monitor

GET {{host}}/api/v1/platformAuditEvents?filter=from={{from}}&to={{to}}&limit={{limit}}
X-Sysdig-Product: SDC
Authorization: Bearer {{token}}

Get Audit Events for a Specific Entity

auditTrail.entityType is used if you want to list audit events only for a specific entity or list of entities. In this example, we want to fetch only auth audit events.

X-Sysdig-Product:= SDS (Sysdig Secure) SDC (Sysdig Monitor)

GET {{host}}/api/v1/platformAuditEvents?filter=auditTrail.entityType in ("auth")&from={{from}}&to={{to}}&limit={{limit}}
X-Sysdig-Product: SDS
Authorization: Bearer {{token}}

Entities Used

For Sysdig Monitor/Sysdig Platform

Some entities are also used in Sysdig Secure but are served from Monitor

For Sysdig Secure