0
Pending Review
Auditing remove note and persistent auditing.
In the auditing section, I can use the session event type filter and choose Added Note. I would like to have removed note as well.
But while looking for a way to see if a note was removed I found that Audit logs are not persistent. For example.
Add a note, query the audit log and see that X machine has added a note. Remove that same note then query the audit log and the event is missing, like I never added the note.
Note auditing needs to be improved as we are using it for account control for SSO
Customer support service by UserEcho
Hi JasonJCT,
Sounds like you might be using an older version of the product. In a recent release, we now retain the AddedNote event, even if the note is deleted. If the note is deleted, we add EventAttributes: UserDeleted to the entry.
Just upgraded to 20.2.27450.7387 from 19.6.26378.7317 and still have same issue. I will contact support for assistance.
At first, this feature was included in the release notes for v20.2, but when I upgraded my instance to v20.2 I saw that it wasn't in fact available.
So, I contacted support and I was told that it was included in the release notes by mistake, that it was now moved to v20.3.
Sure enough, when I upgraded to the preview version of v20.3 it was indeed available. I think the stable version will be released soon. I suggest you hold on just a while longer.