Audit Logs Enterprise

Audit logs provide a complete record of all actions performed in your workspace, enabling compliance tracking, security monitoring, and forensic investigation.

Overview

MongoDash automatically captures detailed audit logs for all workspace activities, including:

• User authentication - Sign-ins, sign-outs, failed login attempts
• Data operations - Document reads, writes, updates, and deletions
• Administrative actions - User invitations, role changes, workspace settings
• API activity - REST API calls, webhook triggers, scheduled query executions
• Permission changes - Role assignments, access grants, security policy updates

Accessing Audit Logs

Understanding Log Entries

Each audit log entry contains:

• Timestamp - Exact date and time (UTC) when the action occurred
• User - Email address or API key identifier of the actor
• Action - Specific operation performed (e.g., document.update, user.invite)
• Resource - Target resource (collection name, user ID, setting name)
• IP Address - Source IP address of the request
• Status - Success or failure indicator
• Details - Additional context including query parameters, affected document counts

Example Log Entry

{
  "id": "log_2024_abc123",
  "timestamp": "2024-02-24T14:32:10.523Z",
  "actor": {
    "type": "user",
    "email": "admin@company.com",
    "id": "usr_xyz789"
  },
  "action": "collection.documents.delete",
  "resource": {
    "type": "collection",
    "database": "production_db",
    "collection": "users",
    "connection": "conn_main_prod"
  },
  "metadata": {
    "documentsAffected": 3,
    "filter": "{\"status\": \"inactive\"}",
    "ipAddress": "203.0.113.42",
    "userAgent": "Mozilla/5.0..."
  },
  "status": "success"
}

Filtering and Searching

Quick Filters

Use the filter bar to narrow down logs by common criteria:

• Date Range - Last 24 hours, 7 days, 30 days, or custom range
• User - Filter by specific user or API key
• Action Type - Authentication, data operations, administrative actions
• Status - Success, failure, or both
• Resource - Specific database, collection, or connection

Advanced Query Syntax

For complex filtering, use the advanced search mode with MongoDB-style query syntax:

// Find all failed login attempts in the last 7 days
{
  "action": "auth.login.failed",
  "timestamp": { "$gte": "2024-02-17T00:00:00Z" }
}

// Find all deletions by a specific user
{
  "action": { "$regex": "^.*\\.delete$" },
  "actor.email": "admin@company.com"
}

// Find all actions from suspicious IP range
{
  "metadata.ipAddress": { "$regex": "^192\\.168\\.1\\." }
}

Exporting Logs

Export Formats

Export audit logs in multiple formats for external analysis:

1. CSV - For spreadsheet analysis in Excel or Google Sheets
2. JSON - For programmatic processing and SIEM integration
3. PDF - For compliance documentation and reporting

Automated Exports

Schedule regular audit log exports for compliance archival:

// Example: Daily export configuration
{
  "frequency": "daily",
  "time": "03:00 UTC",
  "format": "json",
  "filter": {
    "timestamp": { "$gte": "yesterday" }
  },
  "destination": {
    "type": "s3",
    "bucket": "company-audit-logs",
    "path": "/mongodash/{{year}}/{{month}}/{{day}}.json.gz"
  }
}

Retention Policies

Default Retention

Enterprise plans include:

• Standard retention: 90 days of audit logs
• Extended retention: Up to 7 years for compliance requirements
• Archival options: Long-term cold storage with on-demand retrieval

Configuring Retention

Compliance Considerations

Retention periods for common compliance frameworks:

Framework	Minimum Retention	Recommended
SOC 2	1 year	2 years
GDPR	30 days	90 days
HIPAA	6 years	7 years
PCI DSS	1 year	3 years

Real-Time Monitoring

Audit Log Streaming

Stream audit logs to external SIEM systems for real-time monitoring:

Supported integrations:

• Splunk
• Datadog
• Sumo Logic
• Elastic Stack
• AWS CloudWatch

Configure streaming in Audit & Compliance > Integrations.

Alert Rules

Create alerts for suspicious activities:

// Example: Alert on multiple failed login attempts
{
  "name": "Multiple Failed Logins",
  "condition": {
    "action": "auth.login.failed",
    "count": { "$gte": 5 },
    "timeWindow": "5 minutes",
    "groupBy": "actor.email"
  },
  "notification": {
    "channels": ["email", "slack"],
    "recipients": ["security@company.com"],
    "severity": "high"
  }
}

API Access

Access audit logs programmatically via the REST API:

# Fetch recent audit logs
curl -X GET https://api.mongodash.com/v1/audit-logs \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "filter": {
      "timestamp": { "$gte": "2024-02-20T00:00:00Z" }
    },
    "limit": 100,
    "sort": { "timestamp": -1 }
  }'

# Export audit logs
curl -X POST https://api.mongodash.com/v1/audit-logs/export \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "format": "json",
    "filter": {
      "action": { "$regex": "^collection\\." }
    },
    "destination": {
      "type": "email",
      "email": "admin@company.com"
    }
  }'

Best Practices

Security Monitoring

1. Review regularly - Check audit logs weekly for unusual patterns
2. Set up alerts - Configure real-time alerts for critical events
3. Investigate anomalies - Follow up on suspicious IP addresses or unusual access patterns
4. Document procedures - Maintain runbooks for incident response

Compliance Audits

1. Establish baselines - Document normal activity patterns
2. Automate reporting - Schedule regular compliance report generation
3. Maintain evidence - Export and archive logs according to compliance requirements
4. Test retrieval - Periodically verify archived logs are accessible

Performance Optimization

1. Use specific filters - Narrow queries to reduce processing time
2. Archive old logs - Move historical data to cold storage
3. Batch exports - Schedule large exports during off-peak hours
4. Limit retention - Only retain what's required for compliance

Troubleshooting

Missing Log Entries

If expected log entries are missing:

1. Verify the action occurred within your retention period
2. Check that audit logging is enabled for the resource type
3. Ensure your user role has permission to view audit logs
4. Contact support if logs are missing for recent activities

Slow Search Performance

To improve search performance:

1. Use narrower date ranges
2. Add specific filters (user, action type, resource)
3. Avoid broad regex patterns when possible
4. Consider exporting and analyzing locally for complex queries

What's Next?

• Compliance Reports - Generate SOC 2, GDPR, and HIPAA reports
• Data Retention - Configure data lifecycle policies
• API Integration - Automate audit log analysis