The Common Audit Log provides a centralized view of audit activity across supported N-able products and platform services. Use the Common Audit Log to investigate administrative actions, identify changes to managed resources, review user activity, and collect evidence for security and compliance reviews.
Currently, the Common Audit Log (CAL) contains audit events from Ecoverse only. Over time, it will include audit events from additional N-able products.
An audit record is an immutable, time-stamped record of a critical event. Audit records combine information about the event, the user or process that initiated it, and the customer, site, or resource affected by it. Audit records support forensic investigation and regulatory evidence by maintaining a verifiable history of user, system, and resource activity.
The Common Audit Log provides a consistent format, query interface, and retention approach for audit records generated by supported N-able products and services.
The Common Audit Log supports investigations and evidence collection. It does not determine whether an action was appropriate, malicious, or compliant. Interpret audit activity in the context of your organization’s security policies and operational procedures.
Identify what happened in your environment
Use the Common Audit Log to answer questions such as:
- Who performed an action?
- When did the action occur?
- Did a user or an automated process initiate the action??
- Which customer, site, or resource was affected?
- Which product feature generated the event?
- Are multiple audit records associated with the same operation?
For example, you can identify who modified a policy, determine which devices an administrative action affected, or trace a sequence of related events.
Benefits of the Common Audit Log
The Common Audit Log helps you:
- Review activity from multiple N-able products in a single location.
- Investigate configuration changes and user actions.
- Search and filter large volumes of audit records.
- Support compliance, governance, and security investigations through a verifiable chain of events.
Availability
The Common Audit Log is available at the Service Organization level.
The Common Audit Log is intended to provide a consistent location for audit data from supported N-able products and platform services. The available audit events can differ by product and service.The available audit events vary by product and service.
Permissions
Permissions configured in the source platform control access to the Common Audit Log.
Administrators can view audit logs by default. To grant access to another user, configure the appropriate permission in User Management
Audit records are retained for 90 days.
Recorded activity
The Common Audit Log can contain records for:
- Administrative and configuration changes
- Actions from N-zo
Available events depend on the product or service.
How Common Audit Log organizes activity
Common Audit Log groups audit information into three main areas:
- Event: Describes what occurred, when it occurred, how it was initiated, and which product feature generated the record.
- User: Identifies the user, service, or organizational context associated with the action.
- Target: Identifies the partner, service organization, customer, site, or resource affected by the action.
Identifiers and correlation data help distinguish objects with similar names and link records that belong to the same operation.
Audit event lifecycle
Audit events follow this lifecycle:
- Generation: A supported product or service creates an event after an auditable action.
- Ingestion: Common Audit Log receives the event.
- Processing: The service associates the event with event, user, target, and organizational information.
- Storage: The event is stored as an immutable audit record.
- Retrieval: An authorized user searches for or reviews the record.
- Retention: The record remains available for the applicable retention period.
- Deletion: The record is removed according to the applicable retention and deletion policies.
Common Audit Log security and data integrity
Common Audit Log protects audit data through immutable records, permission-aware access, secure storage, and protected transmission. These controls support investigation, governance, and compliance evidence requirements.
- Immutable audit records: An immutable audit record cannot be changed after it has been stored. Immutability helps preserve the integrity of the historical record. For example, an administrator cannot change a product configuration to rewrite the original audit record with the revised action.Additionally, an audit record is separate from the operational object it describes. For example, if a resource is renamed or deleted, the change to the operational resource does not rewrite the original audit record.
- Secure audit data: Audit data can contain user, organization, network, and resource information, which is security-sensitive data. Common Audit Log protects audit data by controlling:
- Which users can access records
- Which organizational records a user can view
- How records are stored
- How records are transmitted
- Which systems can receive audit data
-
Permission-aware record access: Common Audit Log uses role and permission controls to restrict access to audit information. A user must have the required permission to open the Common Audit Log. The records displayed must also fall within the user’s permitted organizational or resource scope.