# Security audit log URL: https://docs.valsight.ai/security-audit-log/ Description: The following page explains the different events that are logged when using the 'Security audit log'. The following page explains the different events that are logged when using the 'Security audit log'. A 'Security audit log' can be used to **track relevant activities** performed in Valsight. The relevant files to activate the security audit log are located in the Valsight settings (navigation bar) → Metric and Logs → Download 'Valsight Security Audit Log Files (ZIP)'. ## What is logged? Each event has the following aspects that are logged via the security audit log: | Header | Description | | ----------------- | ---------------------------------------------------------------------------- | | Time | When the event occurred | | User | The logged in user who caused the event | | Object type | On what object type has the vent occurred (Group. User, Project, Model, ...) | | Object key | The exact object on which the event occurred | | Project | The exact project in which the event occurred | | Action type | Which event occurred | | Action parameter1 | Additional info if all other headers aren't enough | | Action parameter2 | Additional info if all other headers aren't enough | | Action parameter3 | Additional info if all other headers aren't enough | Precise details about newly logged objects and what we log on them: | Domain Object | Action Type | Detail | | ---------------------- | --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | | AssumptionGroup | Property change | Name | | DataParameter | Deleted | Except when deleted by deleting a workspace, model or project | | DataParameter | Property change | Everything except description | | DataParameterVariant | Line-item data change | N/A | | DataParameterVariant | Delete | Except when deleted by deleting a workspace, project or data parameter | | Dimension | Created | N/A | | Dimension | Deleted | Except when deleted by deleting a project | | Dimension | Property change | Everything except description | | ExternalDataSource | Deleted | Except when deleted by deleting a project | | Level | Created | N/A | | Level | Deleted | N/A | | Level | Property change | Everything | | Model | Property change | Only modelConfig changes are logged | | Model | Deleted | Except when deleted by deleting a project | | Node | Property change | Everything except description and displayConfig | | PlanningWorkflow | Deleted | Except when deleted by deleting a project | | ProjectVariable | Created | N/A | | ProjectVariable | Property change | Both name and value | | ProjectVariable | Deleted | Except when deleted by deleting a project | | ScenarioExportTemplate | Deleted | Except when deleted by deleting a project | | SimulationRun | Property change | The values name, baseline and parentSimulationRun | | SimulationRun | Deleted | Except when deleted by deleting a project or workspace | | SimulationRunVariable | Created | N/A | | SimulationRunVariable | Property change | Includes the value of the original. This also logged when we create a variable override, to log the changes between the project’s and scenario’s values. | | SimulationRunVariable | Deleted | Except when deleted by deleting a project, model, workspace or scenario | | SimulationWorkspace | Property change | Everything in the simulationConfig | | SimulationWorkspace | Deleted | Except when deleted by deleting a project | | WorkflowStep | Deleted | Except when deleted by deleting a workflow or project | ## Logged events #### Add+Create/Remove+Delete/Change | Event | Action type | Action Parameter 1 | Action Parameter 2 | Action Parameter 3 | Added in Version | | --------------------------------------------------------------------------------------- | --------------------------- | ---------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------- | ----------------------- | ---------------- | | Adding permissions | Added permission | For which user/group is the permission added | N/A | N/A | Since beginning | | Adding a role to the user or group | Added role | name of the role | N/A | N/A | Since beginning | | Adding an user to a group | Added user to group | user | N/A | N/A | Since beginning | | Creating an user or group | Created | 'preAuth', 'SAML', 'openIdConnect' or no parameter | N/A | N/A | Since beginning | | Create project variables | Created | ‘value' | variable value | N/A | 5.8.0 | | Update project variables | Property change | parameter type either ‘name’ or ‘value’ | parameter old value | parameter new value | 5.8.0 | | Scenario variable | Created | N/A | N/A | N/A | 5.8.0 | | Update scenario variable | Property change | ‘value’ | Value of project variable the scenario variable is overriding | scenario variable value | 5.8.0 | | Delete scenario variable | Deleted | N/A | N/A | N/A | 5.8.0 | | Dimension row added | Property change | dimRowAdded | name of each level and the value added to the level (including extended levels) | N/A | 5.8.0 | | Removing permissions | Removed permission | For which user/group is the permission removed | N/A | N/A | Since beginning | | Removing a role from the user or group | Removed role | name of the role | N/A | N/A | Since beginning | | Removing user from the group | Removed user from the group | user | N/A | N/A | Since beginning | | Deleting an user or group | Deleted | N/A | N/A | N/A | Since beginning | | Node deletion | Deleted | names of the node, its model and project | N/A | N/A | 4.0.0 | | Model deleted | Deleted | name of the model, name of the project space | N/A | N/A | 5.8.0 | | Workspace deleted | Deleted | the name of the project space it belongs to | N/A | N/A | 5.8.0 | | Data source deleted | Deleted | the name of the project space it belongs to | N/A | N/A | 5.8.0 | | Workflow deleted | Deleted | the name of the project space it belongs to | N/A | N/A | 5.8.0 | | Submission deleted | Deleted | the name of the project space it belongs to | N/A | N/A | 5.8.0 | | Dimension deleted | Deleted | the name of the project space it belongs to | N/A | N/A | 5.8.0 | | Templates deleted | Deleted | the name of the project space it belongs to | N/A | N/A | 5.8.0 | | Project variable deleted | Deleted | N/A | N/A | N/A | 5.8.0 | | Scenario variable deleted | Deleted | N/A | N/A | N/A | 5.8.0 | | A line item variant is deleted | Deleted | data parameter variant's key | N/A | N/A | 5.8.0 | | Changing the project or application setting | Changed setting | A detailed description on which setting was changed, what was the previous value and what is the new value | N/A | N/A | Since beginning | | Changing password of the user | Password changed | N/A | N/A | N/A | Since beginning | | Changed data access permissions on a dimension or level (value) | Data permissions | N/A | N/A | N/A | 3.1.0 | | Moving a node | Node changed models | old model | new model | N/A | 4.0.0 | | A line item variant is updated | Line-item data change | N/A | N/A | N/A | 5.0.0 | | A line item was selected or unselected from a scenario | Line item selection | 'selected' or 'unselected' | parameter's key | N/A | 3.1.0 | | A line item variant is ‘selected’ or 'unselected' from being associated with a scenario | Line-item selection | 'selected' or 'unselected' | data parameter variants's key | N/A | 5.0.0 | | User enabled or disabled | Property change | 'enabled' | old value | new value | 3.7.0 | #### Actions by users | Event | Action type | Action Parameter 1 | Action Parameter 2 | Action Parameter 3 | Added in Version | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------- | ------------------------------------------------------------------ | -------------------------------------------------------------------------- | ----------------------------------------------- | ---------------- | | User creates, deletes or reverts a version | Versioning action | 'versioned', 'shared', 'unshared', 'deleted version' or 'reverted' | optional: the created version or version you are reverting from | optional: workflow's key if it was a submission | 3.1.0 | | User links or unlinks levels | Object linking | 'extended' or 'extension removed' | the key of the level that we extending by or removing extension to | N/A | 3.1.0 | | User removes a value from a level | Property change | 'levelValueRemove' | the value | N/A | 3.1.0 | | User changes a value of a level | Property change | 'levelValueChange' | the value | N/A | 3.1.0 | | User change a parent value of a value | Property change | 'levelValueParentChange' | the value | \ → \ | 3.1.0 | | User renames an object | Property change | 'name' | old name | new name | 3.1.0 | | User changes a property on an object | Property change | name of the property | new value | N/A | 3.1.0 | | User moves a line item from one group to another | Property change | 'movedFromGroup' or 'movedToGroup' | the group | N/A | 3.1.0 | | User does an action on a debug page | Special admin action | action name | HTTP method used | N/A | 3.1.0 | | User logged in | User logged in | 'preAuth', 'SAML', ' openIdConnect' or no parameter | N/A | N/A | Since beginning | | User failed to login | Failed login | User that failed to login | empty or ''credentials OK - user blocked' or 'credentials OK - IP blocked' | N/A | Since beginning | | User uploads a file that may change a DS or dimension table | File upload | N/A | N/A | N/A | 3.1.0 | | User downloaded log files | Log download | 'server.log' or 'securityAudit.csv' | N/A | N/A | 3.1.0 | | User was denied access to modify data | Data permissions write denied | Level value | Data permission class name | N/A | 3.8.8 | | User performed an action that caused time dimension data to be regenerated | Time dimension change | \[\...\]...Q\ | N/A | N/A | 3.1.0 | | User saved or discarded the workspace | Workspace save action | 'save', 'discard', 'saveAs' | N/A | N/A | 3.1.0 | | User changed data of a line item | Line item data change | N/A | N/A | N/A | 3.1.0 | | User changed data of a line item variant | Line item data change | N/A | N/A | N/A | 5.0.0 | | User changes line item name | Property change | ‘name’ | old name | new name | 5.0.0 | | User changes line item slider minimum | Property change | ‘sliderMin’ | old value | new value | 5.8.0 | | User changes line item slider maximum | Property change | ‘sliderMax’ | old value | new value | 5.8.0 | | User changes line item slider step | Property change | ‘sliderStep’ | old value | new value | 5.8.0 | | User created new API key | API key created | N/A | N/A | N/A | 3.6.0 | | A user’s session ends either through an explicit logout or an inactivity timeout. **NOTE:** If the session ends to an inactivity logout it can take 30 - 40 minutes for it to be registered as having expired in the log. Thus the time of the log entry can not be seen as the time the session actually expired. | User logged out | Username of the user associated with the session | N/A | N/A | 5.8.0 | | User changed the dimension table from a data source table | Property change | ‘dimensionTable’ | ‘autoDim’ | Audit key of the data source table | 5.8.0 | #### Block events | Event | Action type | Action Parameter 1 | Action Parameter 2 | Action Parameter 3 | Added in Version | | ----------------------------------------------------------------------------- | -------------- | ------------------------- | ------------------ | ------------------ | ---------------- | | User blocked, due to too many unsuccessful consecutive logins | User blocked | 'unsuccessful logins' | N/A | N/A | Since beginning | | Blocked user manually unblocked | User unblocked | 'on boot' or no parameter | N/A | N/A | Since beginning | | Blocking IPs due to too many unsuccessful consecutive logins from the same IP | IP blocked | The blocked IP | N/A | N/A | Since beginning | #### File export/import | Event | Action type | Action Parameter 1 | Action Parameter 2 | Action Parameter 3 | Added in Version | | -------------------------------------------------------------------------------------------------------------------------- | ----------------------- | ----------------------------------------------------------------------------------------------- | ------------------------- | ------------------ | ---------------- | | Chart exported | File export | 'Formatted export' or 'Raw export' | N/A | N/A | 5.8.0 | | Workspace Export | File export | 'Formatted export' or 'Raw export' | N/A | N/A | 5.8.0 | | Line item Download Excel | File Export | 'Data parameter download' | DataParameter audit key | N/A | 5.8.0 | | Assumption group Download Excel (a separate log line is made for each line item in the assumption group) | File Export | 'Assumption group download' | AssumptionGroup audit key | N/A | 5.8.0 | | Download excel for all assumption groups (a separate log line is made for each line item in each of the assumption groups) | File Export | 'Bulk workspace download' | Workspace audit key | N/A | 5.8.0 | | Node data preview download | File Export | Audit key of either the Baseline or SimulationRun associated with the data preview | N/A | N/A | 5.8.0 | | Project export | File Export | N/A | N/A | N/A | 5.8.0 | | Tampered project import | Tampered project import | Detailed reason, one of: Missing signature; Signature does not match content; Invalid signature | N/A | N/A | 6.0.0 | #### Others | Event | Action type | Action Parameter 1 | Action Parameter 2 | Action Parameter 3 | Added in Version | | --------------------------------------------------------------------------------- | -------------------------- | --------------------- | ------------------ | ------------------ | ---------------- | | host header poisoning - The supplied host header is not included in the allowlist | Bad Host Header | Actual host header | N/A | N/A | 3.3.0 | | Jdbc / Odata table import | External Datasource import | imported tables names | N/A | N/A | 4.0.0 |