Exploiting the audit trail

Duration20 minOfferModule Conformité

Objectives

• I know how to open logging and read an event line
• I know how to combine category, severity, and time period filters
• I know how to go from an event to the complete history of an entity
• I know the retention period and how to exceed it

0 / 4 objectives achieved — check them off as you go through the lesson.

Why it's useful

Everything that happens in VaultysHub, from logins to administrative actions to password sharing and Shadow IT detections, is recorded in a single log. This is the source of truth that you show to an auditor, and the one you dig into when an incident occurs.

Your turn

1. In the sidebar, click on Compliance, then on the Logging tab. → Logging
2. Filter by the category Authentication and severity Warning: you will see the denied logins.
3. Set the period to Last 7 days, then copy the page URL: the filters are included, and the view can be shared as is.
4. Click on a line to open its details. In Associated Entities, click on Filter to display only the events for that entity.
5. Click on Copy Event ID: this is the reference to cite in a ticket or audit report.
6. Open the record of an application, then its Logging tab: the filter on the application is locked there.
7. Click on Reset Filters.

Limited retention

Events are retained for a limited time (30 days by default) and then permanently deleted. To keep a longer history, export them to your log management tool using the webhook audit.event, which falls under the module Integration.

tip

For periodic review, prefer filtering by category over filtering by type: it automatically includes new types of events added to the platform.

Check your knowledge

1In which category can you find forms blocked by the extension?

2What severity does a detected Shadow IT event carry?

3How can you show an auditor exactly the view you filtered?

4You need events from six months ago. What should you have set up?

Key takeaways

• A single log, in Compliance › Logging, and one tab per application, user, and folder.
• The filters category, severity, and period combine and pass into the URL.
• Limited retention: externalize with the webhook audit.event.

Next lesson: Reports and sending to auditors