Skip to content

Logging all activity for ingestion in SIEM #5481

@michaje-gsc

Description

@michaje-gsc

Is your feature request related to a problem? Please describe.

We use the audit module but only partial information is found there. In particular, nothing can be found when user privileges are affected by actions: creating, modifying or deleting users, groups, roles, etc.

Describe the solution you'd like

I want the possibility to log all actions taken, by users or by api. This relates to all components of Icinga, not only icingaweb: icinga2, icingadb, icingaweb2, icingadbweb, Director, Business Processes, etc.
The actual consultation of the logs within icingaweb2 is not necessary.

Describe alternatives you've considered

n/a

Additional context

The availability of logs is a critical aspect of Icinga for us, because our cybersecurity unit needs to ingest in their SIEM logs of all actions taken, and design scenarios to detect suspicious activity.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions