Auditing remove note and persistent auditing.
In the auditing section, I can use the session event type filter and choose Added Note. I would like to have removed note as well.
But while looking for a way to see if a note was removed I found that Audit logs are not persistent. For example.
Add a note, query the audit log and see that X machine has added a note. Remove that same note then query the audit log and the event is missing, like I never added the note.
Note auditing needs to be improved as we are using it for account control for SSO
Hi JasonJCT,
Sounds like you might be using an older version of the product. In a recent release, we now retain the AddedNote event, even if the note is deleted. If the note is deleted, we add EventAttributes: UserDeleted to the entry.