Regarding recording the executing account in AdminEvents

Hi ​@KeyYasusW,
 

You will see the entry when someone performs any of the activities listed below. For example, if an IAM client user is created, updated, deleted, if you set temp password for a user or Expire Password…..etc, this action will be recorded in the Admin Events screen, as described in the IFS technical documentation.

Admin Event types:

• CLIENT_DELETE
• CLIENT_INFO
• CLIENT_INITIATED_ACCOUNT_LINKING
• CLIENT_LOGIN
• CLIENT_REGISTER
• CLIENT_UPDATE
• CUSTOM_REQUIRED_ACTION
• DELETE_ACCOUNT
• EXECUTE_ACTIONS
• EXECUTE_ACTION_TOKEN
• FEDERATED_IDENTITY_LINK
• GRANT_CONSENT
• INVALID_SIGNATURE
• REMOVE_FEDERATED_IDENTITY
• REVOKE_GRANT

I hope this information is helpful. Thank you!


Best Regards,
Dharmendra

Thank you for sharing this information.

I understand that logs are recorded when these events occur, as described in the manual.

However, I still do not understand because [Confirmation Point 1] through [Confirmation Point 3] remain unclear.
Please share information regarding [Confirmation Point 1] through [Confirmation Point 3].

Best Regards.

Hi ​@KeyYasusW 

Admin Events are an audit trail of administrative actions performed inside the IAM and They record what kind of IAM operation occurred.

The term Administrator refers to an actor performing IAM administration, but does not define this as a specific user account or permission set.
Admin Events are therefore best interpreted as IAM activity tracking, not a full Who did what security audit comparable to database or application audit logs.

Thank you for the information.

However, it’s disappointing that I haven’t received a clear answer.
I would really appreciate a response.

AdminEvents:
 Records of events that have occurred, as listed in the manual and treated as administrative events.

[Points to Confirm]
>AdminEvents does not record which account executed the event. Is this correct? YES or NO?
>There is no way to track which account executed the event. Is this correct? YES or NO?

Best Regards.

Thank you for providing such clear confirmation.

Now that we understand the specifications of IFSCloud’s AdminEvents,
we will discuss the operational procedures regarding logs with the customer based on this information.

Thank you very much for your assistance with these detailed clarifications.