Policies and rules audit reports

Information about audit data for IBM® MaaS360® policies and rules.

  • Compliance logs data
  • Policy audit history
  • Compliance rules audit

Compliance logs data

The Compliance logs data provides a log of all the compliance events that were initiated in the system. Access this data from the IBM MaaS360 Portal at Security > Compliance log.

Field Description Possible values
Device name The name of the device that the compliance event was initiated on. For example, 05/04/2017 12:19
Username The name of the user.
  • Create
    Create a role.
  • Modify
    Modify the role information.
  • Delete
    Delete a role.
    Note: Click the Show all option to view deleted rules.
Rule set name The name of the set of rules. For example, Default Compliance Rule Set
Action rule name The name of the action rule.
  • OS versions
  • Encryption support
Rule action configured The administrator configured action for defined rules.
  • Alert
  • Alert user
  • Alert administrator
  • Alert user and administrator
  • Block
  • Selective wipe
  • Wipe
  • Change policy
  • Hide device
  • Remove control
Rule action status The status of the initiated rule action.
  • Executed
  • Pending
Time of execution The time that the action was taken.  

Policy audit history

The Policy audit history provides the change history of all the changes that were applied to a policy. Access this data from the IBM MaaS360 Portal at Security > Policies, select the policy name, and click History.

Field Description Possible values
Transaction date The date and time when the event was initiated to the policy setting. For example, 10/28/2020 14:45 IST
Event The name of the trigger event. The following values are displayed as events.
  • Reactivate
  • Save
  • Change name
  • Deactivate
  • Set default
  • Publish
  • Precedence change
  • Export
  • Import
Version The version of the policy that was published. The version number is incremented each time that the policy is updated. For example, 25, 26
Performed by The username that triggered the event. Administrator login username
Comments The IP address of the device of the administrator who initiated the change. An area where administrators can write comments about the policy before the policy is saved or published.
More Administrators can view order policy details, policy difference, and roll back policies to a previous version.
  • Difference from published version
  • View details
  • Rollback
Changes Administrators can view the specific changes that are made during each policy publishing action. This field highlights the differences between the current and previous versions within the report.
Note: The differences that are shown in the reports apply only to published actions for iOS, Android, Windows, macOS, and MTD policies. For all other policy types, the reports indicate that this feature is not supported.
  • Add: Add the parameter configuration to the policy.
  • Modify: Modify or change the parameter configuration to the policy.
  • Delete: Remove the parameter configuration value from the policy.
For example:
"eventType":"Modified","category":"Android Enterprise
      Settings","tab":"Passcode","fieldSet":"Passcode Settings","parameter":"Minimum
      Passcode Quality","currentValue":"Numeric","previousValue":null}

The current value is marked as NA when the dependency parameter configuration is disabled.

The previous value is marked as NA when the dependency parameter configuration is enabled.

Compliance rules audit

The Compliance rules audit provides a trail of all the rule changes that were initiated in the IBM MaaS360 Portal. Access this data from Security > Compliance Rules, select the rule set name, and click More > Audit.

Field Description Possible values
Action date The date when the compliance rule change was initiated. For example, 04/20/2018 15:42 IST
Action performed The type of action that was taken on the rule set.
  • Create
  • Update
  • Delete
    Note: Click the Show all option to view deleted rules, or select the Inactive rule in the list.
Performed by The administrator who initiated the change.  
Source IP address The IP address of the device of the administrator who logged in and initiated the change.