Audit log settings

Integrations > Security > Audit Log Settings

Audit logs are essential for conducting investigations following an incident. For accountability and transparency, Medallia provides comprehensive audit logs that document user activities and system events.

Audit events

Medallia's audit framework is an engine that collects a variety of security-related events and makes them queryable via this public API.

See the list of events ingested to the audit log from Medallia Experience Cloud below:

Login module events

  • USER_LOGIN — {user} attempted to login with {method}.

  • USER_LOGOUT — {type} user {user} logout.

  • USER_SWITCH_INTO — user switched into {user}.

  • USER_SWITCH_BACK — user switched back from {user}.

Permissions module events

  • GRANT_ROLE_TO_USER — {user} was granted {role}.

  • REVOKE_ROLE_TO_USER — {user} was revoked {role}.

  • GRANT_PERMISSION_TO_ROLE — {role} was granted {permission}.

  • REVOKE_PERMISSION_TO_ROLE — {role} was revoked {permission}.

System connections module events

  • SYSTEM_CONNECTIONS_CREATE — System connection {id} was created.

  • SYSTEM_CONNECTIONS_READ — System connection {id} was read.

  • SYSTEM_CONNECTIONS_DELETE — System connection {id} was deleted.

  • SYSTEM_CONNECTIONS_UPDATE — System connection {id} was updated.

  • SYSTEM_CONNECTIONS_LIST — System connection list operation was executed.

PGP-key management module events

  • TENANT_KEY_CHANGE — The tenant key for company {company} was changed to type {keyType}.

Changelog events

  • CHANGELOG — A {changeType} was performed on an entity of {type} in the entity {field} by an {initiator} during a {transaction}, {group} and {session}.

    • type — The type of entity affected by the change {account, translation}. This value is stored in the extra_fields value of this event.

    • field — The field that was affected by the change (or database column) (field:"account.email", field:"translation.transtext"). This value is stored in the extra_fields value of this event.

    • changeType — The type of entity change: {deletion, creation, update}. This value is stored in the extra_fields value of this event.

    • Initiator — account, component.

      • component — Changes initiated (either directly or indirectly) by the given system component (component:"Express web").

    • group — Changes that were done as part of the change group with the given id (group:"6439"). This value is stored in the extra_fields value of this event.

    • session — Changes performed in the change session with the given id (session:"current"). This value is stored in the extra_fields value of this event.

Query API events

  • QUERY_API — A request of {type} was performed against the reporting query api with the following {parameters} and {request_context}.

    • type — GET, POST.

    • parameters — All the request parameters are stored in the extra_fields of this event.

    • request_context — All the request context as headers are stored in the extra_fields of this event.

Restriction: The audit framework keeps events for 120 days unless otherwise noted. Events older than 120 days no longer appear on the audit framework.

Use this screen to enable and disable Audit log configuration options.

Feature flag status

Check the status of Audit log ingestion and query tools.

Audit Log Engine (Feature Flag)
Current status of the 20cr1_MPC1795_enable_auditing feature flag. This flag controls whether Audit log ingestion is enabled at the cluster level.
Important: Changing this value requires a runtime-configuration update.
Query API Audit Log (Feature Flag)
Current status of the 23cr4_MPC6516_enable_query_api_audit_log feature flag. This flag controls whether Query API requests are audited.
Important: Changing this value requires a runtime-configuration update

Audit log configuration

Enable or disable change log and audit event logging.

Enable changelog audit
Enable or disable Change log audit logging. When enabled, changes made through the Setup user interface are captured and sent to the Audit log system.
Use Kafka queue
Enable or disable the Kafka-based audit events queue. When enabled, audit events are published to a Kafka topic first and then sent to the Audit Ingestion service.