Audit Trail - Should I care about this?

Question

HI

I have a lot of these entries (+90 a day) in my audit trail.
Should I care about these.
Is someone trying to send something important or dangerous?

Received incoming request with event ID: [6e10.....ca44], but there are integration(s)/sync(s) that are turned off.

Patrick Till · Answer

Thank you for your reply, I shall look into that.

Connor_lld39i · Answer

Hi @Patrick Till within your audit log you can look up the [6e10.....ca44] event ID to see what the incoming request is. Your screenshot also shows the IDs of the two turned off integrations/syncs which that incoming request was being sent to. You can figure out which integrations/syncs those are, by opening their settings and matching the IDs from the log with the IDs found in the URL. Once you find the correct integration/syncs, you can look through their settings to get a better idea of what incoming requests they're expecting to receive. E.g. a sync with a JSM project, may have a rule to create an alert when an incident is created in the project. When the incident is created, that would send a request to operations, but if the sync is turned off nothing would happen, and you'd see that warning in your audit log.