Audits

This page describes how to use Lenses to enable auditing to track every action in Lenses.

Lenses audits all user actions. Audit events can be viewed in Lenses and also sent to two channels, Splunk and Webhook.

For version below Lenses 6.0 omit the environment selection.

Audits can also written to a file by setting a file path in the lenses.audit.to.log.file option in lenses.conf. Lenses will then write audit entries to disk as JSON for collection by your log aggregation systems.

Viewing audit logs in Lenses

Go to Environments->[Your Environment]->Audit Logs. Lenses will display the activity including, who performed the action and when. Details can also be viewed (dependent on the action).

Sending audit logs to Splunk

To send audit logs to Splunk, you first need a Splunk connection.

1. Go to Environments->[Your Environment]->Configuration and select Splunk and enter your required details in the editor.

2. Go to Environments->[Your Environment]->Audits->Channels and create a new channel with your connection.

Sending audit logs to a Webhook

First, you need a Webhook connection.

1. Go to Environments->[Your Environment]->Configuration and select Webhook and enter your required details in the editor.

2. Go to Environments->[Your Environment]->Audits->Channels and create a new channel with your connection.

Enter:

1. Choose a name for your Channel instance.

2. Select your connection.

3. Set the HTTP method to use.

4. Set the Request path. A URI-encoded request path, which may include a query string. Supports alert-variable interpolation.

5. Set the HTTP Headers

6. Set the Body payload

Lenses can also audit users' access to data and send events to multiple channels at the same time.