Access Common Audit Log data from Adlumin

Use N-query to retrieve Common Audit Log records for use in an external security platform. Combining N-able audit activity with other security information can support centralized monitoring and investigation.

Adlumin is the currently supported integration for accessing Common Audit Log data.

N-query provides query-based access to audit records. It does not provide an automatic event stream. Syslog-based delivery is planned for a future release.

Why access audit data from Adlumin

Accessing Common Audit Log data from Adlumin can help you:

  • Centralize security monitoring.
  • Combine N-able audit activity with other security data.
  • Investigate activity across systems.
  • Include audit activity in anomaly and threat investigations.
  • Reduce manual extraction of audit records.
  • Avoid developing a separate method of retrieving Common Audit Log data.

Adlumin determines how delivered events are processed, correlated, retained, and presented after ingestion.

Data held in Adlumin can have different access and retention settings from the source records in Common Audit Log.

Access Common Audit Log records through N-query

Use the N-query auditRecordSearch GraphQL query to retrieve Common Audit Log records for Adlumin. The query supports filtering, sorting, pagination, and organization or region scoping. Results are restricted to the audit records that the authenticated identity is permitted to view.

Before querying audit records, identify:

  • The identity that Adlumin uses to authenticate to N-query.
  • The organizations and resources that the identity is permitted to access.
  • The organization or region that the query must cover.
  • The audit record criteria required by the integration.

Specifying an organization or region limits the query scope. It does not grant access to records within that scope. The authenticated identity must have permission to view the requested records.

For the complete query schema and an example GraphQL operation, see N-query auditRecordSearch query.

Understand access and result scope

The records returned by N-query depend on both the query criteria and the authenticated identity's permissions.

A record is returned only when:

  • The record matches the specified query criteria.
  • The record falls within an organization or resource scope that the authenticated identity can access.

N-central users must have the audit role to access audit records. Assigned access groups determine which resource records the user can view. N-sight users must have the audit report permission. Users with this permission can access all available audit records, regardless of the underlying resource.

Verify access to audit records

Use a known audit record to verify access through N-query.

  1. Locate a known record in Common Audit Log.
  2. Note its organizational scope and identifying criteria, such as the action, occurrence time, user, target, audit record ID, or correlation ID.
  3. Run an auditRecordSearch query that includes the applicable scope and criteria.
  4. Confirm that the response contains the expected audit record.
  5. Compare the returned values with the record displayed in Common Audit Log.

Verify access to audit records

Run a query that includes the event’s organizational scope and known criteria, and confirm that the response contains the expected audit record.