v2.7 (latest)
Audit Log ​
Rulecube records security- and change-relevant events to an audit log. This page describes what is logged and which events also trigger an email notification to administrators.
Audit log entry structure ​
Each audit log entry contains:
| Field | Description |
|---|---|
| Timestamp | Date and time the event occurred (UTC) |
| User | The user who performed the action |
| IP address | Remote IP address of the request |
| Object type | The type of object that was affected (see table below) |
| Action | What happened to the object (see table below) |
| Affected object ID | The ID (GUID) of the affected object |
| Affected object name | The name of the affected object |
| Description | Human-readable summary of the event |
| Tenant | The tenant context of the event (if applicable) |
The audit log is available in the Rulecube UI:
- System admins can view all audit log entries across all tenants.
- Tenant admins can view audit log entries for their own tenant only.
Logged events ​
The table below lists all events that are written to the audit log, organized by object type.
User events ​
| Action | Description | Email notification sent |
|---|---|---|
| Create | A new user account was created | No |
| Invite | A user was invited (or re-invited) to a tenant or as an admin | Yes - see Email notifications |
| Activate | A user activated their account | No |
| Login | A user logged in successfully | No |
| Login (2FA) | A user completed two-factor authentication | No |
| LoginFailed | A login attempt failed | No |
| Logout | A user logged out | No |
| PasswordChange | A user changed or reset their password | No |
| PasswordResetRequested | A password reset was requested via "Forgot password" | No |
| RoleChange | A user's role was updated | Yes - when promoted to Tenant Admin |
| Enable2FA | Two-factor authentication was enabled or 2FA setup was initiated | No |
| Disable2FA | Two-factor authentication was disabled, or the authenticator key was reset | No |
| Unlock | A locked-out user account was unlocked by an admin | Yes - system admins are notified |
| Delete | A user was deleted from a tenant or the system | Yes - see Email notifications |
Tenant events ​
| Action | Description | Email notification sent |
|---|---|---|
| Create | A new tenant was created | Yes - all system admins are notified |
| Update | Tenant settings were updated | No |
| Delete | A tenant was deleted | Yes - all system admins are notified |
Ruleset events ​
| Action | Description | Email notification sent |
|---|---|---|
| Create | A ruleset was created | No |
| Update | A ruleset was saved/updated | No |
| Delete | A ruleset was deleted | Yes - tenant admins of the affected tenant are notified |
Role events ​
| Action | Description | Email notification sent |
|---|---|---|
| Create | A role was created | Yes - system admins (or tenant admins for tenant roles) are notified |
| Update | A role was updated | Yes - system admins (or tenant admins for tenant roles) are notified |
| Delete | A role was deleted | Yes - system admins (or tenant admins for tenant roles) are notified |
Persisted Entity events ​
| Action | Description | Email notification sent |
|---|---|---|
| Create | One or more persisted entities were created | No |
| Update | One or more persisted entities were updated, assigned, or unassigned | No |
| Delete | One or more persisted entities were deleted | No |
| OwnershipTransfer | The owner of a persisted entity was changed | No |
API Key events ​
| Action | Description | Email notification sent |
|---|---|---|
| Create | An API key was created | No |
| Update | An API key was updated | No |
| Delete | An API key was deleted | No |
Environment Variables events ​
| Action | Description | Email notification sent |
|---|---|---|
| Update | Environment variables for a tenant were updated | No |
Triggered Action events ​
| Action | Description | Email notification sent |
|---|---|---|
| Create | A triggered action (scheduled action) was created | Yes - tenant admins are notified |
| Update | A triggered action was updated | Yes - tenant admins are notified |
| Delete | A triggered action was deleted | Yes - tenant admins are notified |
System events ​
| Action | Description | Email notification sent |
|---|---|---|
| Login | A successful login or email OTP request was recorded at the system level | No |
| IpLockedOut | An IP address was locked out due to too many failed login attempts | Yes - all system admins are notified |
| IpReleased | A locked IP address was released by an admin | Yes - all system admins are notified |
| CriticalLogResolved | A critical system log entry was marked as resolved | Yes - all system admins are notified |
Email notifications ​
The table below summarizes which events trigger an email notification and who receives it.
| Event | Recipients |
|---|---|
| User invited as system admin (no tenant) | All system admins |
| User invited to a tenant with Tenant Admin role | Tenant admins of that tenant |
| User role updated to Tenant Admin | Tenant admins of that tenant |
| User deleted (tenant user) | Tenant admins of that tenant |
| User deleted (system user) | All system admins |
| User unlocked | All system admins |
| Tenant created | All system admins |
| Tenant deleted | All system admins |
| Ruleset deleted | Tenant admins of the affected tenant |
| Role created/updated/deleted (no tenant) | All system admins |
| Role created/updated/deleted (tenant role) | Tenant admins of that tenant |
| Triggered action created/updated/deleted | Tenant admins of the affected tenant |
| IP locked out | All system admins |
| IP released | All system admins |
| Critical log resolved | All system admins |