Audit logging

Audit logging allows you to record both user driven and automated activity relating to your Rapid7 solutions. For every auditable action, you can see what the action was, the time that the action occurred, and who completed the action. By enabling audit logging, you have the ability track activity for investigative purposes. Audit logging will also help you fulfill compliance requirements if these details are requested by an external auditor.

You must have Administrator permissions to enable audit logging and to view audit log events.

To use the audit logging feature in the Command Platform:

1. Enable audit logging
2. View your audit log events
3. Query your audit logs

Enable audit logging

To enable audit logging:

1. From the left menu of the Rapid7 Command Platform Home page, click the Administration link.
2. On the Settings page, go to Audit Logs.
3. Set the toggle to Enabled.
4. Select the region where you want to store your audit log data.

View your audit log events

You can view your audit Log events in the Command Platform by going to the top navigation menu and clicking Settings > Audit Log.

To view your events, you can use the Audit Source log selector drop down to filter the table to show specific audit logs. You can also choose to view All Audit Logs. For each event on the table, you can see the time that the action occurred, details (Name and Email) of who completed the action and the product that the action occurred within.

You can filter to view actions taken by a specific user by searching for their username in the search bar. You also have the ability to search for any string within this search bar, such as an email or action.

You can also confine your search to specific date ranges using the date selector component as part of the search bar. You can either type in the date range manually using the date/time box provided or you can click on the calendar to select the date range.

You can export your log search results to a CSV file directly from the Audit Table using the Export to CSV function beside the search bar. Once the CSV file has been exported, a green bar will appear and you will have the option to download it.

To view more details about an audit log Event, click View More in the More Details column. A window with additional details about the specific audit log event will appear.

InsightIDR audit log events

To see the InsightIDR audit log messages, read the audit logging documentation on the InsightIDR documentation site.

InsightAppSec audit log events

For information about InsightAppSec audit log messages, see audit logging in the InsightAppSec documentation site.

Custom Policy Builder

Within InsightVM's Custom Policy Builder, you can use audit logging to capture every policy update implemented by users. Audit logs record who, when, and what changes were made to a policy so a user or an auditor can view the change history of any policy at a later date. For more information, see the audit logs topic of the Custom Policy Builder InsightVM documentation.

Platform audit log events

This section outlines audit log events currently generated by Command Platform Services. The events are sorted into the following categories:

• API Key
• External Identity Provider (IDP)
• Key Contacts
• Multi-Factor Authentication (MFA)
• Organization
• Password Policy
• Organization Product
• User
• User Role
• User Access
• Customer
• Role Based Access Control (RBAC)
• Audit Log

API key events

When scheduled reports generate, they automatically create and delete API keys. These API key events (specifically the Create and Delete events) appear in your audit log. This is expected behavior and indicates that the reports have generated correctly.

External identity provider (IDP) events

Key contact events

Multi-factor authentication (MFA) events

Organization events

Password policy events

Organization product events

User events

User role events

User access events

Customer events

Audit log events