We need to investigate which events we want to add the our Audit Log.

[underdarknl]

          We need to investigate which events we want to add the our Audit Log.

Originally posted by @underdarknl in https://github.com/minvws/nl-kat-coordination/issues/3038#issuecomment-2152755534

I currently see the following:

• Adding OOI's [1]
• Editing OOI's [1]
• Deleting OOI's [1]
• Setting Declared indemnifications on OOIs [1]
• Deleting Declared indemnifications on OOIs [1]
• Enabling Plugins [2]
• Disabling plugins [2]
• Editing plugin settings [2]
• Creating Plugin jobs [3]
• Downloading Raw files [4]
• Login [4]
• Logout[4]
• Password reset [4]
• Account creation [4]
• Account deletion [4]
• Member block/unblock [4]
• Member organization membership changes [4]
• Organization creation [4]
• Organization deletion [4]
• Setting Max indemnificatoin levels for users [4]
• Accepting Indemnification levels for yourself [2]

1: Can be stored on Octopoes on actual object model by adding specific fields 2: Needs a new table design to track changes over time (possibly move to XTDB?) 3: Store in Scheduler Job? 4: Newly created Audit Log?

All of the above should also be send out as structured logs to a remote aggregator.

[underdarknl]

Events

Each event has a unique event code. This code is used to identify the event and can be used to filter events in your logs. For rabbitMQ logging, each event will have a unique routing key that can be used to route events to different queues.

Action / Object	Event code	routing key	Description
Adding OOI	080001	OOI_change	OOI Create event
Editing OOI	080002	OOI_change	OOI Edit event
Deleting OOI	080003	OOI_change	OOI Delete event
------------------------------------	--------------------------------	-----------------------------------	---------------------------------------
Setting Declared indemnification	080010	OOI_Indemnification	indemnification (re)Declaration event
Deleting Declared indemnification	080011	OOI_Indemnification	indemnification clearance event
------------------------------------	--------------------------------	-----------------------------------	---------------------------------------
Enabling Plugin	080021	Plugin_enable	Plugin enabled event
Disable Plugin	080022	Plugin_disable	Plugin disabled event
Set Plugin settings	080023	Plugin_settings	Plugin setting chaged event
Create Plugin	080024	Plugin_create	Plugin copied / created event
Delete Plugin	080025	Plugin_delete	Copied Plugin deleted event
Plugin Schema change	080026	Plugin_schema_update	Copied Plugin schema change event
Plugin allowed / allowlisted	080031	Plugin_allowed	Plugin (version) allowed event
Plugin denied / denylisted	080032	Plugin_denied	Plugin (version) disallowed event
Plugin source added	080033	Plugin_source_change	Plugin source add event
Plugin source edited	080034	Plugin_source_change	Plugin source edit event
Plugin source deleted	080035	Plugin_source_change	Plugin source delete event
Plugin source Signing key trusted	080036	Plugin_source_change	Plugin Signing key trusted event
Plugin source Signing key untrusted	080037	Plugin_source_change	Plugin Signing key untrusted event
Plugin source Signing key trusted	080036	Plugin_source_change	Plugin Signing key trusted event
------------------------------------	--------------------------------	-----------------------------------	---------------------------------------
Create Job	080051	Job_create	Manual Job create event
Cancel Job	080052	Job_cancel	Job Cancel event
Download Raw file	080061	Raw_file_download	Raw File downloaded event
------------------------------------	--------------------------------	-----------------------------------	---------------------------------------
Organisation	090012	organisation_created	Created new organisation
Organisation	090013	organisation_changed	Updated organisation
------------------------------------	--------------------------------	-----------------------------------	---------------------------------------
User	900101	account_change	changed user data
User	900102	account_change	changed roles
User	900104	account_change	changed active enabled/disabled
User	900105	account_change	reset credentials
OrganisationMember	900106	account_change	Change user organisation
User2fa	900107	account_change	reset 2fa
User set max indemnification	900108	account_change	Set max allowed indemnification level
User accept indemnification	900109	account_change	Set max accepted indemnification level
------------------------------------	--------------------------------	-----------------------------------	---------------------------------------
User	091111	user_login	user login
User	092222	user_logout	user logout
User	093333	user_login_two_factor_failed	user login 2fa failed
------------------------------------	--------------------------------	-----------------------------------	---------------------------------------