Seeking feedback - admin audit logs on Cloud

[Jonathon Conkey]

Hi Community,

My name is Jonathon and I am a Product Designer at Atlassian.

We are currently exploring how we might improve the Admin Hub audit logs page on Cloud.

We would love your feedback on the following:

• What do you mainly use the Audit Log page for?
  
  

• What is working well?
  
  

• What can be improved?
  
  

• What do you wish was there but isn’t?
  
  

Many thanks,

Jonathon

[Amar Khot]

Hi Jonathon,

Appreciate the approach.

We need an API to export the admin log periodically. Is there a plan to provide the APIs?

Regards

Amar Khot

[Jonas Fiener]

Hi Amar,

you can check this article, perhaps thats what you searching for:

The Organizations REST API REST API (atlassian.com)

Regards

Jonas Fiener

[Benjamin Horst]

For the rich (Enterprise plan for Jira or Confluence or Atlassian Guard Premium), there is a webhook for audit logs as well. 

https://support.atlassian.com/security-and-access-policies/docs/learn-more-about-audit-log-webhooks/

If your company requires audit log streams, the REST API as suggested by Jonas is probably not going to fit your needs.  

[Rex]

Our customers want logs of attachment uploads and downloads. Implementing a CASB to handle this would be a huge burden due to labour and cost. We look forward to your consideration.

[Steve Davis]

A recent problem we discovered is that if a status is renamed then the audit log only shows what the status was renamed 'to', not what it was renamed 'from'. This is not helpful if you need to rollback that change!

Can you please make sure that any logged information shows both a 'from' and 'to' value?

Thanks - Steve

[Gavad Khan (PS)]

I would love to have following

• Rest api to extract / feed data to external log monitoring system 
• Feed more data i.e.
  • Add-on apps data fetch/update or any interaction logs - this is needed in order to get insight about how 3rd party marketplace vendor interact with Atlassian cloud site and what type of data their apps fetch & update  
  • Product admin configuration changes - In past, I discovered several admin configuration changes which were not logged. Even some cases, author was blank

[Jonathon Conkey]

Hi @Gavad Khan (PS). Many thanks for your detailed response. I just had a couple of follow up questions.

Would webhook registration help re the quest "feed data to external log monitoring system"?

In terms of the inclusion of 3rd party app data, if the app data was made available, would you have a need to find these events using the Audit Log UI or would you mostly be using a 3rd party tool? 

Thanks,

Jonathon

[Tyler Stephens]

Hi Jonathon,

The logs could be more specific, making it difficult to understand what occurred. More information included in each entry would be very beneficial. 

[Gus_Vega]

We need parameters added so we can filter down based on the event category within the UI versus having to export to a csv and modify to filter with excel. This should be a common capability.

Also, by filtering down by parameters we would hopefully get more results based on the information we are actually looking for. 

[Jonathon Conkey]

Thanks for this @Tyler Stephens. 

Are there any workarounds or processes that you have used to address the shortfall of information provided in the events? Eg Have you had to reach out to different teams in your organisation to help provide clarity on some of the log entries?

Kind regards,

Jonathon

[Ashley]

• I wish the audit log activities included adding and removing a user as site admin
• I wish I could easily search for audit log activities by instance, whether to exclude a particular instance or only include a particular instance

[Jonathon Conkey]

Hi @Gus_Vega I just wanted to clarify your filtering comment. Would the following meet your needs? Would this help you pinpoint and return to relevant log events in the UI?

1. Select an event category
2. Subsequent filters such as 'Activities' are dynamically populated based on the chosen event category
3. Table columns are dynamic based on chosen event category in order to provide more relevant info
4. Filtered views can be saved and be easily returned to on subsequent visits

Let me know if there's anything missing there or if I have misunderstood.

Thanks,

Jonathon

[John Dunkelberg]

Not sure on Cloud's current state, but in Datacenter recently I was surprised that the the audit log shows Workflow Scheme changes, but not Issue Type Scheme changes.

[Jonathon Conkey]

Hi @John Dunkelberg. Issue Type Scheme changes should be available in the Jira System Audit Logs in Cloud.

Many thanks,

Jonathon

[Karine VANEL]

Hi Jonathon,
Have the possibility to subscribe to certain audit log et perhaps to have graphs by period to analyse action in audit log (and export this report graph) 

[kc]

• What do you mainly use the Audit Log page for?It's the only place in the event, short of a better word "incident", where we can go to, to find out what happened via the Product, Access and User audit logs. 

• What do you wish was there but isn’t?I'm not sure, say in the event of a credential compromised, are the logs "immutable"? To prevent malicious actor from deleting or locking up the logs to cover the traces of malicious activities? As the primary objective is to ensure non-repudiation. 
  If we are using our own identify provider, can we have logs on the use of the user/admin accounts that access and administer the Atlassian Cloud?

Coming from a security angle, sharing the link below which i though it a good reference point.

https://www.cyber.gov.au/sites/default/files/2024-08/best-practices-for-event-logging-and-threat-detection.pdf

My 2 cents.

Kc

[Jonathon Conkey]

I would like to thank everyone for the responses so far. Your feedback has been really valuable for the team.

I hope to reach out to this group again soon once we have some concepts ready for testing.

[Jonathon Conkey]

Hi everyone. I hope all is well.

Thanks again for your input in regards to improving the Admin Hub Audit Log page on Cloud.

If you're interested in providing feedback on some concepts the team has put together, I would love to hear from you.

Follow this link so we can ensure you are a good fit and then I can organise a time that suits.

What’s involved in the research:

• Sessions are 1 hour and conducted via Zoom, so you can participate from anywhere around the world.

• During the research, we'll start with a general chat to get to know you. Then, we’ll share some design concepts and a prototype to obtain your feedback.

• As a token of our appreciation, you'll receive an e-gift card worth $100 USD within 5 business days of completing your session.
  
  

I look forward to hearing from you.

Kind regards,

Jonathon

FYI @Gus_Vega @Amar Khot @Karine VANEL @Gavad Khan (PS) @Tyler Stephens
@John Dunkelberg @Ashley @Rex @Steve Davis

[Benjamin Horst]

Hi Jonathon, 

we mainly use the log for retrieving changes in the form of "what was changed in that project at what time" to fix changes that had a bigger effect that expected.

The log is working well when just searching one word. As soon as I add two, the search is close to unusable. Searching for short space keys brings up results can bring up whole words that don't fit to the project I needed. 

So I'd like to see a filter function for projects and for more specific types of changed to get the change of a group for example. Or even better a search that can sort by relevance and in which I can search using

• "<searchterm>" -> to only find exactly that word and not a substring 
• minus -> excluding words
• AND finding two words

And last not least: would be great to have the option to use an audit stream in non-Enterprise Environments.

Regards

Benjamin 

[Alex Hall]

We had a recent issue where the owner of several dashboards was removed/deactivated. 8 days later the system moved the dashboards to the trash. The audit log didn't list moving the dashboards to the trash nor did it connect to the two seemingly disparate activities.

Seems like system actions (like systematically deleting dashboards) should appear in the audit log.