My organization’s audit logs for last month include a couple of project.follow actions. This isn’t documented in Audit logs - CircleCI – what does it refer to?
We do a pretty limited review of our audit logs that’s focused around the users (or automations) performing actions. These stood out because they show up with "actor":null.
Hi @akf,
Thank you for bringing this to our attention! I’ve updated our documentation to include all audit log events, including the `project.follow` action you mentioned:
Regarding the “actor”:null entries in your logs - this is unusual and requires further investigation. To properly diagnose this issue, we’ll need to review your specific audit logs.
You can either:
Please be sure to include the date and time of the audit log entries and your organization name.
Thanks @Henna , I’ve emailed you.
Hi Amy,
It’s nice to hear from you. Please allow me sometime to investigate the root cause of `“actor”:null
In the meantime, please do not hesitate to reach out if any additional questions come up.
Additionally, I did want to inform you that we will be offering Audit Log Streaming to a s3 bucket to customers on a scale plan: https://circleci.canny.io/cloud-feature-requests/p/stream-org-level-audit-logs-for-siem
I will be in touch with an update soon!
Hi Amy,
Thanks again for reporting the audit log issue. Our engineering team deployed a fix on August 22 that should resolve the “actor”:null entries you were seeing.
Could you confirm whether the issue is resolved on your end?
I’d also like to invite you to beta test our new audit log streaming feature as a thank you for your valuable feedback. If you’re interested, please share your organization ID and I’ll coordinate with our team to get you early access along with setup documentation.
Your input helps us build better products, so please don’t hesitate to reach out with any other feedback or questions.
Best,