docs(audit): Dev Portal Audit Logging #7816

alexgervais · 2024-08-29T18:03:02Z

Description

Resolving conflicts from #7803
Adds documentation for dev portal audit logging

DOCU-4044

Testing instructions

Preview link:

Dev Portal audit log overview
Dev Portal set up audit log webhook
Dev Portal audit log replay job
Verify audit log signatures: moved this to the reference section and revised since it applies to both Dev Portal and org-wide audit logs
Audit Log reference: moved this to the reference sections since it applies to both
Made some formatting/grammar/etc. changes to the org-wide audit log pages:

Checklist

Review label added
Conditional version tags added, if applicable.

netlify · 2024-08-29T18:03:18Z

✅ Deploy Preview for kongdocs ready!

Name	Link
🔨 Latest commit	`61b1d05`
🔍 Latest deploy log	https://app.netlify.com/sites/kongdocs/deploys/66fb127a6e1eca000817d185
😎 Deploy Preview	https://deploy-preview-7816--kongdocs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	9 paths audited Performance: 94 (🟢 up 3 from production) Accessibility: 92 (no change from production) Best Practices: 98 (🟢 up 8 from production) SEO: 91 (no change from production) PWA: - View the detailed breakdown and full score reports

To edit notification comments on pull requests, go to your Netlify site configuration.

…l overview use case table, add link to audit log on create dev portal, start revising some of the content Signed-off-by: Diana <[email protected]>

Signed-off-by: Diana <[email protected]>

…inks to the new redirects Signed-off-by: Diana <[email protected]>

Signed-off-by: Diana <[email protected]>

…g audit log UI Signed-off-by: Diana <[email protected]>

Signed-off-by: Diana <[email protected]>

smritikjaggi

Looks good! Left some comments...

smritikjaggi · 2024-09-23T23:33:42Z

app/konnect/dev-portal/audit-logging/index.md

+content_type: concept
+---
+
+{% include_cached /md/konnect/audit-logging/audit-log-overview.md %}


I think this line inherits the text from Audit Logs for Enterprise. However, can we modify this line from By tracking Konnect audit logs, you gain the following benefits to By tracking Dev Portal audit logs, you gain the following benefit?

I edited this so it's a bit more generic, like "By tracking audit logs..." so it would apply to both. Currently, I don't know of a way to make that bit specific to the feature area and still reuse for both pages. I wanted to reuse it because 99% of the content was the exact same, so it helps us keep both up-to-date and reduce translation costs in the future.

smritikjaggi · 2024-09-23T23:37:35Z

app/konnect/dev-portal/audit-logging/index.md

+{% include_cached /md/konnect/audit-logging/audit-log-overview.md %}
+
+{:.note}
+> **Note:** Dev Portal audit logs are set up and managed separately from org-wide {{site.konnect_short_name}} audit logs. For more information about how to configure audit logging for a {{site.konnect_short_name}}, see [Set up an audit log webhook for Dev Portal](/konnect/dev-portal/audit-logging/webhook/).


Is the intent here to navigate users looking to configure audit logging for Konnect to https://docs.konghq.com/konnect/org-management/audit-logging/?

@smritikjaggi Yep! I added one to the org management audit logging page as well. This is just to help users who maybe landed here on a search accidentally know that the configurations are different and direct them to the correct doc.

smritikjaggi · 2024-09-23T23:38:30Z

app/konnect/dev-portal/audit-logging/webhook.md

+You can use the {{site.konnect_short_name}} UI or the Audit Logs API to configure webhooks for [audit logging](/konnect/dev-portal/audit-logging/). 
+
+{:.note}
+> **Note:** Currently, Dev Portal audit logs only support authorization logs, which are triggered when a user logs in to Dev Portal.


Currently, Dev Portal audit logs only support authentication logs. Authorization logs are in scope for future milestones.

smritikjaggi · 2024-09-23T23:39:47Z

app/konnect/dev-portal/audit-logging/webhook.md

+{:.note}
+> **Note:** Currently, Dev Portal audit logs only support authorization logs, which are triggered when a user logs in to Dev Portal.
+
+{% include_cached /md/konnect/audit-logging/webhook-overview-prereq-siem-config.md %}


can we modify the sentence Before you can push Konnect audit logs to an external service to Before you can push Dev Portal audit logs to an external service.

Do you think users will get confused by the term "external service"? We could say - "Before you can push Dev Portal Audit Logs to a SEIM system of choice"

I edited it so it's a bit more generic so it applies to both Dev Portal and Konnect and changes "external service" to SIEM provider.

smritikjaggi · 2024-09-23T23:43:11Z

app/konnect/dev-portal/audit-logging/webhook.md

+ * **Skip SSL Verification**: Skip SSL verification of the host endpoint when delivering payloads.
+
+ {:.note}
+ > We strongly recommend not setting this to `true` as you are subject to man-in-the-middle and other attacks. This option should be considered only when using self-signed SSL certificates in a non-production environment.


Can we replace "this" to "skip SSL verification":
We strongly recommend not setting "skip SSL Verification" to true

smritikjaggi · 2024-09-23T23:51:37Z

app/konnect/dev-portal/audit-logging/webhook.md

+
+Now that you have an external endpoint and authorization credentials, you can set up an audit log destination in {{site.konnect_short_name}}. The `/audit_log_destinations` endpoint allows you to set your audit log destination, which includes the endpoint URL and access key for your SIEM provider, and reuse it. 
+
+The {{site.konnect_short_name}} API uses [Personal Access Token (PAT)](/konnect/api/#authentication) authentication. You can obtain your PAT from the [personal access token page](https://cloud.konghq.com/global/account/tokens). The PAT must be passed in the `Authorization` header of all requests.


I do not see this section in the deploy preview - am I missing something?

@smritikjaggi This will be under the API tab

smritikjaggi · 2024-09-23T23:54:30Z

app/konnect/dev-portal/audit-logging/replay-job.md

+
+## Prerequisites
+
+* [**Org Admin** or **Portal Admin** permissions](/konnect/org-management/teams-and-roles/teams-reference/)


@neethi-shashidhar-kong - can you confirm if we would have Portal Admin role set up audit logs for Dev Portal based on the perm sync conversations this morning? I think only Org Admin will have permissions.

smritikjaggi · 2024-09-23T23:55:15Z

app/konnect/dev-portal/audit-logging/replay-job.md

+{% navtabs %}
+{% navtab Konnect UI %}
+
+1. From the navigation menu, open {% konnect_icon Dev-Portal %} **Settings**, then **Audit Logs Setup**.


The first time I read this, I did not realize we are looking at Settings under Dev Portal menu. Would it be helpful to clarify that?

smritikjaggi · 2024-09-23T23:56:28Z

app/konnect/dev-portal/audit-logging/replay-job.md

+{% navtabs %}
+{% navtab Konnect UI %}
+
+1. From the navigation menu, open {% konnect_icon Dev-Portal %} **Settings**, then **Audit Logs Setup**.


The first time I read this, I did not realize we are looking at Settings under Dev Portal menu. Would it be helpful to clarify that?

smritikjaggi · 2024-09-24T00:00:32Z

app/konnect/reference/audit-logs.md

@@ -35,7 +90,7 @@ Timestamp | Time and date of the event in UTC.
 `user_agent` | The user agent of the request: application, operating system, vendor, and version.
 `sig` | An ED25519 signature.

-## Authentication logs
+### Authentication logs

 Authentication attempts and their outcomes are logged whenever a user logs in to the Konnect application or uses the Konnect API.


Authentication attempts and their outcomes are logged whenever a user logs in to the Konnect application or a Dev Portal either through the UI or the API.

Thanks! Fixed this in my revision.

alexgervais

This is great! 🙌

alexgervais · 2024-09-24T15:57:33Z

app/konnect/dev-portal/audit-logging/webhook.md

+1. Create a webhook by sending a PATCH request to the `/audit-log-webhook` endpoint with your configured audit log destination:
+
+ ```sh
+ curl -i -X PATCH https://{region}.api.konghq.com/v2/portals/{portalId}/audit-log-webhook \


The {portalId} placeholder is not documented bellow. For other requests it appears to be documented (example). I feel we should be consistent, even if repetitive

Thanks! I added it now

alexgervais · 2024-09-24T16:01:03Z

app/konnect/reference/audit-logs.md

+{% navtabs codeblock %}
+{% navtab CEF %}
+```
+Apr 14 05:39:08 konghq.com CEF:0|KongInc|Konnect|1.0|konnect|Authz.usage|1|rt=1681450748406 src=127.0.0.6 action=retrieve granted=true org_id=b065b594-6afc-4658-9101-5d9cf3f36b7b principal_id=87655c36-8d63-48fe-9a1e-53b28dfbc19b trace_id=3895213347334635099 user_agent=grpc-node/1.24.11 grpc-c/8.0.0 (linux; chttp2; ganges)


The format differs slightly for DevPortal audit logs. This example represents what one might expect from a Konnect Org audit log, but I feel we should have example of DevPortal logs too and document the extra portal_id field.

I tried to capture the difference in a previous commit: b6d3aa9#diff-6c4dc5b26f5a4395618ddcf396cfbad8ceb081df139f65907ad604e85b52b519R104-R134

Good call! I added them back in the revision with a tab for the Konnect logs and a tab for the Dev Portal logs

Signed-off-by: Diana <[email protected]>

cloudjumpercat · 2024-09-25T14:52:06Z

@smritikjaggi @alexgervais Thanks for the feedback! I responded to any questions/comments you had and implemented your feedback. I still haven't revised the Dev Portal audit log UI instructions since I'm waiting for internal release for those.

Feel free to look things over again or I'll reach out after I've revised the UI instructions after internal release so you can review everything. I'll be sending this out for a writer review for either the end of this week or early next week.

Signed-off-by: Diana <[email protected]>

cloudjumpercat · 2024-10-02T20:50:42Z

app/konnect/dev-portal/audit-logging/webhook.md

+You can view the status of your webhook through the **Audit Logs Setup** page under
+{% konnect_icon organizations %} **Organization**. A badge will display next to the title of the webhook with the status of the webhook.
+
+To see the last attempt timestamp and the last response code, use the audit log API.


For Team Docs writers: UI instructions need an update here

cloudjumpercat · 2024-10-02T20:51:15Z

app/konnect/dev-portal/audit-logging/replay-job.md

+1. In {% konnect_icon dev-portal %} [**Dev Portal**](https://cloud.konghq.com/portal), click **Settings**, and then click **Audit Logs Setup**.
+1. Switch to the **Replay** tab.
+1. Choose a timeframe for which you want to replay the logs. 
+
+ You can choose one of the preset relative increments for up to 24 hours, or 
+ set a custom timeframe for up to 7 days.
+
+1. Apply the timeframe, then click **Send Replay**.


For Team Docs writers: UI instructions need an update here

cloudjumpercat · 2024-10-02T20:51:32Z

app/konnect/dev-portal/audit-logging/replay-job.md

+1. In {% konnect_icon dev-portal %} [**Dev Portal**](https://cloud.konghq.com/portal), click **Settings**, then **Audit Logs Setup**.
+1. Switch to the **Replay** tab.
+1. Check the status table below the configuration field.
+
+![Audit log replay](/assets/images/products/konnect/audit-logs/konnect-audit-log-replay.png)
+


For Team Docs writers: UI instructions need an update here

cloudjumpercat · 2024-10-03T18:48:25Z

Items left for a writer to do:

Several Dev Portal audit log UI flows need to be revised and tested. I've marked them with comments in the PR.
The whole thing need a copyedit/writer review.

docs(audit): Dev Portal Audit Logging

ae210a3

alexgervais requested a review from a team as a code owner August 29, 2024 18:03

alexgervais added 4 commits August 29, 2024 14:15

docs(audit): fixing destination tags

3318984

docs(audit): updated cef format reference

b6d3aa9

docs(audit): fixing links and added navigation

693493f

docs(audit): rollback link

357b2d3

cloudjumpercat self-assigned this Sep 6, 2024

cloudjumpercat added do not merge Issues/ PRs whose changes should not be merged at this time review:copyedit Request for writer review. labels Sep 13, 2024

cloudjumpercat marked this pull request as draft September 13, 2024 19:31

cloudjumpercat and others added 2 commits September 13, 2024 15:50

Start making includes for audit log pages, add audit log to dev porta…

987ba26

…l overview use case table, add link to audit log on create dev portal, start revising some of the content Signed-off-by: Diana <[email protected]>

docs(audit): updated docs from verifying curl requests

2c16a7e

cloudjumpercat mentioned this pull request Sep 18, 2024

Dev Portal Audit Logging #7803

Closed

2 tasks

cloudjumpercat added 5 commits September 19, 2024 15:37

move reference to reference section, apply some formatting and grammar

a9b0f7a

Signed-off-by: Diana <[email protected]>

Move verify signatures to reference section, change some of the old l…

08e6e35

…inks to the new redirects Signed-off-by: Diana <[email protected]>

Fix replay job requests after testing

c6c51bb

Signed-off-by: Diana <[email protected]>

Fix broken links, grammar and formatting fixes, fixes from testing or…

1bed9e9

…g audit log UI Signed-off-by: Diana <[email protected]>

Fix remaining broken links

672f7e5

Signed-off-by: Diana <[email protected]>

smritikjaggi reviewed Sep 24, 2024

View reviewed changes

alexgervais commented Sep 24, 2024

View reviewed changes

Apply SME feedback

fe90068

Signed-off-by: Diana <[email protected]>

Revise the webhook UI instructions

61b1d05

Signed-off-by: Diana <[email protected]>

cloudjumpercat reviewed Oct 2, 2024

View reviewed changes

cloudjumpercat assigned Guaris and unassigned cloudjumpercat Oct 3, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

docs(audit): Dev Portal Audit Logging #7816

docs(audit): Dev Portal Audit Logging #7816

alexgervais commented Aug 29, 2024 •

edited by cloudjumpercat

Loading

netlify bot commented Aug 29, 2024 •

edited

Loading

smritikjaggi left a comment

smritikjaggi Sep 23, 2024

cloudjumpercat Sep 25, 2024

smritikjaggi Sep 23, 2024

cloudjumpercat Sep 24, 2024

smritikjaggi Sep 23, 2024

smritikjaggi Sep 23, 2024

smritikjaggi Sep 23, 2024

cloudjumpercat Sep 25, 2024

smritikjaggi Sep 23, 2024

smritikjaggi Sep 23, 2024

cloudjumpercat Sep 24, 2024

smritikjaggi Sep 23, 2024

smritikjaggi Sep 23, 2024

smritikjaggi Sep 23, 2024

smritikjaggi Sep 24, 2024

cloudjumpercat Sep 25, 2024

alexgervais left a comment

alexgervais Sep 24, 2024

cloudjumpercat Sep 25, 2024

alexgervais Sep 24, 2024 •

edited

Loading

cloudjumpercat Sep 25, 2024

cloudjumpercat commented Sep 25, 2024

cloudjumpercat Oct 2, 2024 •

edited

Loading

cloudjumpercat Oct 2, 2024

cloudjumpercat Oct 2, 2024

cloudjumpercat commented Oct 3, 2024


		Now that you have an external endpoint and authorization credentials, you can set up an audit log destination in {{site.konnect_short_name}}. The `/audit_log_destinations` endpoint allows you to set your audit log destination, which includes the endpoint URL and access key for your SIEM provider, and reuse it.

		The {{site.konnect_short_name}} API uses [Personal Access Token (PAT)](/konnect/api/#authentication) authentication. You can obtain your PAT from the [personal access token page](https://cloud.konghq.com/global/account/tokens). The PAT must be passed in the `Authorization` header of all requests.


		## Prerequisites

		* [Org Admin or Portal Admin permissions](/konnect/org-management/teams-and-roles/teams-reference/)

docs(audit): Dev Portal Audit Logging #7816

Are you sure you want to change the base?

docs(audit): Dev Portal Audit Logging #7816

Conversation

alexgervais commented Aug 29, 2024 • edited by cloudjumpercat Loading

Description

Testing instructions

Checklist

netlify bot commented Aug 29, 2024 • edited Loading

✅ Deploy Preview for kongdocs ready!

smritikjaggi left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

alexgervais left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

alexgervais Sep 24, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cloudjumpercat commented Sep 25, 2024

cloudjumpercat Oct 2, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cloudjumpercat commented Oct 3, 2024

alexgervais commented Aug 29, 2024 •

edited by cloudjumpercat

Loading

netlify bot commented Aug 29, 2024 •

edited

Loading

alexgervais Sep 24, 2024 •

edited

Loading

cloudjumpercat Oct 2, 2024 •

edited

Loading