When something goes wrong
A full audit trail
When somebody asks who allowed that package, the answer should take seconds and not an afternoon.
The audit trail records every sign in attempt and every change made in the portal: when, who (and who they were acting as, if an admin was impersonating), from which address, the action, what it was done to, and whether it worked, failed or was refused.
Changes to settings, rules, registries, users, integrations, allow lists, tokens, requests, waivers, quarantine holds, integrity alerts, the kill switch and the registry mode also record what the thing was before and after, side by side. Passwords, secrets, tokens and keys are never written, one that changed shows as stars.
A signed in user whose role does not allow something is recorded as access.denied, throttled so a stuck page does not flood it. Exports write every row the filter matches, and taking an export is itself on the trail.
In short
- Every sign in, every change, before and after
- worked, failed or refused on every row
- Impersonation shown as
admin as jsmith - No secrets ever written
- CSV and JSON export, itself audited
In the documentation
- Traffic, resolutions and the audit trail Administrator Guide
Goes well with
- SSO, roles and allow lists OpenID Connect, five roles checked on every request, IP allow lists and break glass keys.
- SIEM and email Signed webhooks, Splunk HEC and syslog in JSON or CEF. Digests instead of a mail per event.
- Kill switch Take a package, a version range, one file hash or a whole advisory away from everyone, at once.
One container, about two minutes
A Linux box with Docker, or one without it, and a reverse proxy for TLS. The installer does the rest and it is safe to run twice. Free, MIT licensed, nothing to sign up for.