Security Logging¶
In addition to other logging options, Atfinity logs security relevant actions in a special way to make it easy to detect suspicious activity. Security logging happens via the default logging mechanism.
Logging Format¶
A typical entry in the log for a security relevant user actions looks like this:
2021-03-16 14:34:31,581 [USER_ACTION] [0b4f2d1c-1f7a-4a3c-9d61-8c2e4f5a6b70] - ACTION update_phone_number USER thorben@atfinity.ch IP 165.5.3.18 PARAMS <QueryDict: {}> DATA {'phone_number': '+41786167706', 'tenant': 1} PATH /api/1/admin/users/26
As you can see, the date and time (2021-03-16 14:34:31,581), the request id
(0b4f2d1c-1f7a-4a3c-9d61-8c2e4f5a6b70), the action (update_phone_number), the performing user
(thorben@atfinity.ch), the client IP (165.5.3.18) the query params (if any) the data of the change (so here the new
phone number) and the local path are logged.
With this information, it's possible to trace back exactly which action happened and what data has been
manipulated.
Info
If the request contains sensitive information like a password, this information is displayed with stars, e.g.
********
Following a Request¶
Info
New in Atfinity 17.
Every log line of a request carries its request id, in square brackets after the log level, so all the lines of one
request can be read together.
The last line of a request names its method, path and status and says how long the request took, for example
POST /api/1/cases 200 in 312.4 ms.
Health probes are answered without that line, so a monitoring system polling them does not fill the log.
Work a request hands off to run in the background keeps the same id, so a request that starts an export, a document
or an integration call can be followed into the work it caused, however much later that runs.
Background work that no request started, for example a scheduled rule, gets an id of its own for that run.
Lines that belong to no request and no background work show - instead.
Atfinity generates a request id per request and returns it in the X-Request-ID response header.
To follow a request from your own gateway into Atfinity, send your own id in an X-Request-ID request header and
Atfinity uses it instead:
curl -H "X-Request-ID: your-own-id" -H "Authorization: Api-Key $ATFINITY_API_KEY" \
https://your-tenant.atfinity.app/api/1/cases/
An id you send is accepted when it is at most 200 characters long and uses only letters, digits and the characters
., _, :, @, =, +, / and -.
Anything else is replaced by a generated id, which is still returned in the response header.
Logged Actions¶
A refused login is recorded under the tenant of the user it names.
When no user has the given email address, it is recorded under the tenant the login page was opened on.
error_login_inactive_account and error_login_unknown_username are recorded for SAML logins as well.
At least these security relevant actions are logged:
| Key | Description | Since version |
|---|---|---|
| Login | ||
login_password_change_required |
The user that made a login requests needs a password change. | |
login_success |
Successful login. | |
login_with_password_change |
Successful login after the user changed the password. | |
| Login Errors | ||
error_login_without_sso_but_sso_required |
The user that made the login request tried to log in with a password, but is only cleared for login via SSO. | |
error_login_of_locked_user |
The user that made the login request is locked. | |
error_login_invalid_2fa_code |
The user provided an invalid 2FA code. | |
error_login_inactive_account |
The given username exists, but the user is marked as inactive. | |
error_login_wrong_password |
The given password doesn't match the given username. | |
error_login_unknown_username |
The given username is unknown. | |
error_login_without_permissions |
The user has neither a role nor admin access. | 17 |
error_login_saml_user_without_tenant |
The user that logged in with SAML belongs to no tenant. | 17 |
error_login_saml_without_groups |
The SAML response carries no groups. | 17 |
error_login_saml_without_application_access_group |
The SAML groups do not contain the application access group, or the tenant has none configured. | 17 |
error_login_saml_without_roles |
No SAML group matches a role, and none grants admin access. | 17 |
error_login_saml_unreadable_attributes |
The attributes of the SAML response could not be read. | 17 |
error_login_saml_response_rejected |
The SAML response was rejected before the user was identified, for example for an invalid signature or because the identity provider denied the login. | 17 |
error_login_of_user_no_longer_valid |
The user that made the login request is past the date the account is valid until. | |
error_login_2fa_timeout |
A 2FA code was entered after it expired, or without one having been requested. | 17 |
error_login_2fa_not_set_up |
The user has to log in with 2FA but has no 2FA method set up. | 17 |
error_login_password_change_refused |
The user had to change the password and the new password was refused. | 17 |
| Case Manager | ||
download_booklet |
The booklet of a case was downloaded as a PDF file. | |
download_booklet_zip |
The booklet of a case was downloaded as a zip file. | |
send_booklet |
The booklet of a case was send via email. | |
download_uploaded_documents |
All the uploaded files of a case were downloaded as a zip file. | |
unautorized_case_request |
The user doesn't have access to the requested case | |
| Integrations | ||
get_comply_advantage_hits_for_person |
A request was sent to ComplyAdvantage. | |
get_world_check_hits_for_person |
A request was sent to WorldCheck. | |
send_custom_api_request |
Custom API request was sent. | |
create_idnow_ident |
A request to IDNow was sent. | |
send_sms |
SMS was sent. | |
send_email |
Email was sent. | |
external_source_search |
A search request to external data source was sent. | |
external_source_load_values |
A request to load values from external data source was sent. | |
| Avaloq | ||
avaloq_export_create |
Avaloq xml file was created for a case. | |
avaloq_export_toogle_email_updates |
The user has toogled the subscription to email updates about Avaloq response for a specific case. | |
avaloq_export_download_xml |
Avaloq xml file of a case was downloaded. | |
avaloq_export_download_result_xml |
Avaloq result xml file of a case was downloaded. | |
| HyperArchive | ||
hyperarchive_export_create |
Case documents and sidecar files were exported to HyperArchive folder. | |
hyperarchive_download_rendered_files |
HyperArchive sidecar files of a case were downloaded. | |
| Admin | ||
create_user |
User was created. | |
create_users_via_import |
Users were created while importing a user list | 10.3 |
update_user_roles |
Roles of a user were changed. | |
update_user_groups |
Groups of a user were changed. | |
reset_password |
Password of a user was reset. | |
reset_users_password_via_import |
Some user passwords were reset while importing a user list | 10.3 |
update_user_details |
Details about a user were updated. | |
delete user |
A user was deleted | 10.3 |
delete_users_via_import |
Users were deleted while importing a user list | 10.3 |
switch_tenant |
The user has switched to a different tenant. | |