Audit logging
Introduction
Logging in the operation of IBM Financial Services Workbench means the creation of records from which the following questions can be answered:
Who initiated what or accessed what by what means and when?
Who had what access rights from when to when (derive system statuses)?
The aim of logging is to be able to trace significant changes in the product and applications in order to understand their security. The audit logging includes the selective event types monitor / activity / control.
Prerequisite
The audit logging in IBM Financial Services Workbench requires a pre-installed instance of Fluentd service before enabling. Please check the prerequisites for more information.
Audit data format
IBM Financial Services Workbench follows CADF format to record audit events.
This standard provides all round information about the occurred event such as,
initiator (who),
target (on what),
observer (from/to where),
action (what),
outcome (result),
timestamp (when), etc.
Audit Common Service
Deployment and binding
The Audit Common Service creates a custom binding k5-auditlog-settings. This Audit binding contains an auditEnabled field to enable/disable the audit logging and a connectionString which should contain the internal URL of the deployed Fluentd service as mentioned in prerequisites.
The secret can be read/updated by using the K5 Configurator Controller API.
Implementation
The internal components which need to register audit events make HTTP calls to the Audit Common Service. The Audit Common Service receives the audit log within the API request body and validates it.
The configured Fluentd service URL is invoked with the CADF audit payload for log collection and forwarded to the configured visualizer.