Zen Service audit log records

When the Audit Logging service is enabled for a Cloud Pak for Business Automation deployment at the shared level (shared_configuration.sc_audit_logging.enabled), then the following events are sent from the Zen service.

Log in, log out, session, and authorization

• security.users.authenticate – Success or failure when a user logs in.
• security.users.revoke – Record when users log out.
• security.accounts.authenticate – Success or failure of token authentication.
• security.authorization – Failure when any privileged action is requested.

User management

• users.user.create – Authorize a user for access to the platform.
• users.user.delete – Remove access to the platform for user.
• users.user.update – Change a user profile, including name and email address.
• users.role.add – Grant a specific privilege to a user on the platform.
• users.role.remove – Revoke a platform privilege from a user.

Service level

• services.service.create – A service is installed and enabled.
• services.service.delete – A service is uninstalled.
• services.service.update – A service is updated.

Service instances

• service_instances.instance.create – A service instance is provisioned.
• service_instances.instance.delete – Provision for a service instance is removed.
• service_instances.instance.update – A service instance is changed.
• service_instances.read – The list of service instances is retrieved.
• service_instances.instance.read – A query for the details of a service instance by ID.
• service_instances.user.add – Grant user access, with a particular role, to a service instance.
• service_instances.user.delete – Revoke user access from a service instance.
• service_instances.user.get – A query to list users with access to a service instance.
• service_instances.user.update – Change a user’s access role for a service instance.

Connections

• connections.create – Add the connection.
• connections.update – Update the connection.
• connections.delete – Delete the connection.
• connections.read – A query issued to retrieve all connections.
• connections.connection.read – A query issued to retrieve the details of a connection by ID.

Deployments

• deployments.delete – Delete service deployment.
• deployments.read – Retrieve service deployment by ID.