0
Pending Review
Auditing remove note and persistent auditing.
In the auditing section, I can use the session event type filter and choose Added Note. I would like to have removed note as well.
But while looking for a way to see if a note was removed I found that Audit logs are not persistent. For example.
Add a note, query the audit log and see that X machine has added a note. Remove that same note then query the audit log and the event is missing, like I never added the note.
Note auditing needs to be improved as we are using it for account control for SSO
Available in Version:
Customer support service by UserEcho
Hi JasonJCT,
Sounds like you might be using an older version of the product. In a recent release, we now retain the AddedNote event, even if the note is deleted. If the note is deleted, we add EventAttributes: UserDeleted to the entry.
Just upgraded to 20.2.27450.7387 from 19.6.26378.7317 and still have same issue. I will contact support for assistance.
At first, this feature was included in the release notes for v20.2, but when I upgraded my instance to v20.2 I saw that it wasn't in fact available.
So, I contacted support and I was told that it was included in the release notes by mistake, that it was now moved to v20.3.
Sure enough, when I upgraded to the preview version of v20.3 it was indeed available. I think the stable version will be released soon. I suggest you hold on just a while longer.