Jira Audit Log - anonymous user

[Robert Lee]

I am new to Atlassian administration of Jira and Confluence.  Over the holiday week a new Jira app, Risk Register, was installed.  When I viewed the Jira Audit Log, the "By" user information indicates "anonymous", please see below:

Installed app Risk Register (com.projectbalm.riskregister.riskregister-jira version 1.1.39-AC)

anonymous

Dec 28 2020 12:12:18 AM

How can I get more information?

[Prince Nyeche]

Hi @Robert Lee 

Welcome to Community! Ah this is a tricky mystery! Most times, when an Add-on is being installed it fires some event which goes to the lifecycle of the App, in most cases it should return a response and details of the app stored. In rare cases, this occurs and you get an indication of anonymous user. This is problematic to debug, but if you really want to know who installed the App or more info, you can get in touch with Atlassian Support, although they have a time limit on how long such information is kept.

[Tara L Conklin]

Afternoon, 

I just discovered the same problem occurring with nearly all of our Confluence Cloud extensions. I attached a screenshot of the audit log and you can see the mysterious 'anonymous' installation is occurring after an attempted automatic update. 

Any ideas why this is happening? 

[Daniel Ebers]

That would not be something I would worry much about. Like you said there was an attemped automatic update, a few second after that the log reads "installed", however by anonymous.

I think the alternative would be to read "installed by an automatic updater" instead of "anonymous".

[Craig Schwarze _ProjectBalm_]

Hi Robert, I'm from ProjectBalm, the company that makes Risk Register. If you email your query to support@projectbalm.atlassian.net, we can have a look at our backend logs and see if there is any further information.

kind regards,
Craig

[Daniel Ebers]

Hi @Robert Lee

Apart from asking who actually installed the App (referring to what Prince Nyeche already explained very well) there should be a Suggestion on jira.atlassian.com from my point of view to further improve the logging. "Anonymous" looks suspicious and you are not the first user who said "was my password hacked? Who is this "anonymous" user who installed an App"?

I found something but this is probably aiming towards automatic upgrades:
https://jira.atlassian.com/browse/CONFCLOUD-67532

Question left:

• Is there any chance the App was already present in your instance and this was "just" an upgrade?
• Can you get on hold of all your admins asking if they erolled "Risk Register"?
  • ==> If nobody tells that he was it then it is a great mystery.

Regards,
Daniel

[Matt Doar]

There is also an audit log on the Manage Apps page itself that might show more info

[Matt Doar]

Or ask all your Jira admins

[Robert Lee]

Thanks that is all the information that can be gleaned from the Audit Log.