Audit Logging
Audit records and application logs stream to Amazon CloudWatch Logs or optionally be sent to ESA. Cloud Protect uses a JSON format for audit records that is described in the following sections.
You can analyze and alert on audit records using Protegrity ESA or Amazon CloudWatch. Third-party solutions may be used if they are supported by Amazon Cloudwatch or AWS Lambda logging extensions. For more information about forwarding your audit records to ESA, contact Protegrity. For more information about Amazon CloudWatch, refer to the Amazon CloudWatch User Guide.
For more information about audit records, refer to the Protegrity Analytics Guide.
Audit record fields
The audit record format has been altered in version 3.1 of the protector to provide more information.
| Field | Description |
|---|---|
| additional_info.deployment_id | The deployment_id contains the name of the Protect Function. It is automatically set based on the cloud-specific environment variables assigned to the Protect Function. This allows identifying the Cloud Protect deployment responsible for generating audit log. |
| additional_info.cluster | (Optional) Redshift cluster ARN |
| additional_info.description | A human-readable message describing the operation |
| additional_info.query_id | (Optional) Identifies the query that triggered the operation |
| additional_info.request_id | (Optional) AWS Lambda request identifier |
| cnt | Number of operations, may be aggregated |
| correlationid | (Deprecated) Use additional_info instead |
| level | Log severity, one of: SUCCESS, WARNING, ERROR, EXCEPTION |
| logtype | Always “Protection” |
| origin.ip | The private IP address of the compute resource that operates the Protect Function and is responsible for generating the log entry.NoteThe IP address is private, meaning it is used for internal network communication and is not accessible directly from the public internet.When Log Forwarding is enabled the IP address may be aggregated into minimal CIDR blocks. |
| origin.hostname | Hostname of the system that generated the log entry |
| origin.time_utc | UTC timestamp when the log entry was generated |
| protection.audit_code | Audit code of the protect operation; see the log return codes table in the Protegrity Troubleshooting Guide |
| protection.dataelement | Data element used for the policy operation |
| protection.datastore | Name of the data store corresponding to the deployed policy |
| protection.mask_setting | (Optional) Mask setting from policy management |
| protection.operation | Operation type, one of: Protect, Unprotect, Reprotect |
| protection.policy_user | User that performed the operation |
| protector.core_version | Internal core component version |
| protector.family | Always “cp” for Cloud Protect |
| protector.lambda_version | Protector Lambda application version. |
| protector.pcc_version | Internal pcc component version |
| protector.vendor | Identifies the cloud vendor and the database vendor |
| protector.version | Protector version number |
| signature.checksum | Hash value of the signature key ID used to sign the log message when the log is generated |
| signature.key_id | Key used to sign the log message when the log is generated |
Example Audit Records
The following are sample audit messages:
Protect Success:
{
"additional_info": {
"deployment_id": "Protegrity-Protect-function-deployment-id",
"description": "Data protect operation was successful.",
"query_id": "sf-query-id:01978dbc-0582-d7e4-0000-002a3603a20d",
"request_id": "8476a536-e9f4-11e8-9739-2dfe598c3fcd"
},
"cnt": 4000,
"correlationid": "sf-query-id:01978dbc-0582-d7e4-0000-002a3603a20d",
"logtype": "Protection",
"level": "SUCESS",
"origin": {
"hostname": "localhost",
"ip": "127.0.0.1",
"time_utc": 1635363966
},
"protection": {
"dataelement": "deAddress",
"operation": "Protect",
"audit_code": 6,
"datastore": "SAMPLE_POLICY",
"policy_user": "test_user"
},
process":{
"name":"protect",
"id":"13",
"module":"coreprovider",
"thread_id":"573580544",
"user":"sbx_user1051",
"platform":"\"Linux_x64\"",
"version":"UNKNOWN"
},
"client": {
"ip":"169.254.62.117"
},
"protector": {
"family": "cp",
"version": "4.0.0.102",
"vendor": "aws.snowflake",
"datastore":"SAMPLE_POLICY",
"pcc_version": "4.0.0.9",
"core_version": "2.1.4+0.g93016.2.1",
"lambda_version":"4.0.1"
},
"signature": {
"key_id": "95f5a194-b0a4-4351-a",
"checksum": "B324AF7C56944D91C47847A77C0367C594C0B948E7E75654B889571BD4F60A71"
}
}
User permission denied:
{
"additional_info": {
"deployment_id": "Protegrity-Protect-function-deployment-id",
"description": "The user does not have the appropriate permissions to perform the requested operation.",
"query_id": "sf-query-id:01978dbc-0582-d7e4-0000-002a3603a20d",
"request_id": "8476a536-e9f4-11e8-9739-2dfe598c3fcd"
},
"cnt": 4000,
"correlationid": "sf-query-id:01978dbc-0582-d7e4-0000-002a3603a20d",
"logtype": "Protection",
"level": "ERROR",
"origin": {
"hostname": "localhost",
"ip": "127.0.0.1",
"time_utc": 1635363966
},
"protection": {
"dataelement": "deAddress",
"operation": "Protect",
"audit_code": 3,
"datastore": "SAMPLE_POLICY",
"policy_user": "test_user"
},
process":{
"name":"protect",
"id":"13",
"module":"coreprovider",
"thread_id":"573580544",
"user":"sbx_user1051",
"platform":"\"Linux_x64\"",
"version":"UNKNOWN"
},
"client": {
"ip":"169.254.62.117"
},
"protector": {
"family": "cp",
"version": "4.0.0.102",
"vendor": "aws.snowflake",
"datastore":"SAMPLE_POLICY",
"pcc_version": "4.0.0.9",
"core_version": "2.1.4+0.g93016.2.1",
"lambda_version":"4.0.1"
},
"signature": {
"key_id": "95f5a194-b0a4-4351-a",
"checksum": "A216797C56944D91C47847A77C0367C594C0B948E7E75654B889571BD4F60A71"
}
}
Data element not found:
{
"additional_info": {
"deployment_id": "Protegrity-Protect-function-deployment-id",
"description": "The data element could not be found in the policy.",
"query_id": "sf-query-id:01978dbc-0582-d7e4-0000-002a3603a20d",
"request_id": "8476a536-e9f4-11e8-9739-2dfe598c3fcd"
},
"cnt": 4000,
"correlationid": "sf-query-id:01978dbc-0582-d7e4-0000-002a3603a20d",
"logtype": "Protection",
"level": "ERROR",
"origin": {
"hostname": "localhost",
"ip": "127.0.0.1",
"time_utc": 1635363966
},
"protection": {
"dataelement": "deAddress",
"operation": "Protect",
"audit_code": 2,
"datastore": "SAMPLE_POLICY",
"policy_user": "test_user"
},
process":{
"name":"protect",
"id":"13",
"module":"coreprovider",
"thread_id":"573580544",
"user":"sbx_user1051",
"platform":"\"Linux_x64\"",
"version":"UNKNOWN"
},
"client": {
"ip":"169.254.62.117"
},
"protector": {
"family": "cp",
"version": "4.0.0.102",
"vendor": "aws.snowflake",
"datastore":"SAMPLE_POLICY",
"pcc_version": "4.0.0.9",
"core_version": "2.1.4+0.g93016.2.1",
"lambda_version":"4.0.1"
},
"signature": {
"key_id": "95f5a194-b0a4-4351-a",
"checksum": "AF09217C56944D91C47847A77C0367C594C0B948E7E75654B889571BD4F60A71"
}
}