Skip to content

Commit 0f747ad

Browse files
PMEds28PMEds28
authored
Merge pull request #218209 from dominicbetts/central-export-audit
IoT Central: add audit logs to data export
2 parents 682fdfb + 58e2a89 commit 0f747ad

9 files changed

+74
-7
lines changed

‎articles/iot-central/core/howto-export-to-azure-data-explorer.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,8 @@ To create the Azure Data Explorer destination in IoT Central on the **Data expor
194194
195195
[!INCLUDE [iot-central-data-export-device-template](../../../includes/iot-central-data-export-device-template.md)]
196196
197+
[!INCLUDE [iot-central-data-export-audit-logs](../../../includes/iot-central-data-export-audit-logs.md)]
198+
197199
## Next steps
198200
199201
Now that you know how to export to Azure Data Explorer, a suggested next step is to learn [Export to Webhook](howto-export-to-webhook.md).

‎articles/iot-central/core/howto-export-to-blob-storage.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -266,6 +266,30 @@ The following example shows an exported device lifecycle message received in Azu
266266
}
267267
```
268268

269+
[!INCLUDE [iot-central-data-export-audit-logs](../../../includes/iot-central-data-export-audit-logs.md)]
270+
271+
The following example shows an exported audit log message received in Azure Blob Storage:
272+
273+
```json
274+
{
275+
"actor": {
276+
"id": "test-audit",
277+
"type": "apiToken"
278+
},
279+
"applicationId": "570c2d7b-1111-2222-abcd-000000000000",
280+
"enqueuedTime": "2022-07-25T21:54:40.000Z",
281+
"enrichments": {},
282+
"messageSource": "audit",
283+
"messageType": "created",
284+
"resource": {
285+
"displayName": "Sensor 1",
286+
"id": "sensor",
287+
"type": "device"
288+
},
289+
"schema": "default@v1"
290+
}
291+
```
292+
269293
## Next steps
270294

271295
Now that you know how to export to Blob Storage, a suggested next step is to learn [Export to Service Bus](howto-export-to-service-bus.md).

‎articles/iot-central/core/howto-export-to-event-hubs.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,8 @@ To create the Event Hubs destination in IoT Central on the **Data export** page:
125125

126126
[!INCLUDE [iot-central-data-export-device-template](../../../includes/iot-central-data-export-device-template.md)]
127127

128+
[!INCLUDE [iot-central-data-export-audit-logs](../../../includes/iot-central-data-export-audit-logs.md)]
129+
128130
For Event Hubs, IoT Central exports new messages data to your event hub or Service Bus queue or topic in near real time. In the user properties (also referred to as application properties) of each message, the `iotcentral-device-id`, `iotcentral-application-id`, `iotcentral-message-source`, and `iotcentral-message-type` are included automatically.
129131

130132
## Next steps

‎articles/iot-central/core/howto-export-to-service-bus.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,8 @@ To create the Service Bus destination in IoT Central on the **Data export** page
129129

130130
[!INCLUDE [iot-central-data-export-device-template](../../../includes/iot-central-data-export-device-template.md)]
131131

132+
[!INCLUDE [iot-central-data-export-audit-logs](../../../includes/iot-central-data-export-audit-logs.md)]
133+
132134
For Service Bus, IoT Central exports new messages data to your event hub or Service Bus queue or topic in near real time. In the user properties (also referred to as application properties) of each message, the `iotcentral-device-id`, `iotcentral-application-id`, `iotcentral-message-source`, and `iotcentral-message-type` are included automatically.
133135

134136
## Next steps

‎articles/iot-central/core/howto-export-to-webhook.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,4 +48,6 @@ To create the Azure Data Explorer destination in IoT Central on the **Data expor
4848

4949
[!INCLUDE [iot-central-data-export-device-lifecycle](../../../includes/iot-central-data-export-device-lifecycle.md)]
5050

51-
[!INCLUDE [iot-central-data-export-device-template](../../../includes/iot-central-data-export-device-template.md)]
51+
[!INCLUDE [iot-central-data-export-device-template](../../../includes/iot-central-data-export-device-template.md)]
52+
53+
[!INCLUDE [iot-central-data-export-audit-logs](../../../includes/iot-central-data-export-audit-logs.md)]

‎articles/iot-central/core/howto-use-audit-logs.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ This article describes how to use audit logs to track who made what changes at w
1919
- Filter the audit log.
2020
- Customize the audit log.
2121
- Manage access to the audit log.
22+
- Export the audit log records.
2223

2324
The audit log records information about who made a change, information about the modified entity, the action that made change, and when the change was made. The log tracks changes made through the UI, programatically with the REST API, and through the CLI.
2425

@@ -76,6 +77,12 @@ The built-in **App Administrator** role has access to the audit logs by default.
7677
> [!IMPORTANT]
7778
> Any user granted permission to view the audit log can see all log entries even if they don't have permission to view or modify the entities listed in the log. Therefore, any user who can view the log can view the identity of and changes made to any modified entity.
7879
80+
## Export logs
81+
82+
You can export the audit log records to various destinations for long-term storage, detailed analysis, or integration with other logs. For more information, see [Export IoT data](howto-export-to-event-hubs.md).
83+
84+
To send audit logs to [Log Analytics in Azure Monitor](../../azure-monitor/logs/log-analytics-overview.md), use IoT Central data export to send the audit logs to Event Hubs, and then use an Azure Function to add the audit log data to Log Analytics.
85+
7986
## Next steps
8087

8188
Now that you've learned how to manage users and roles in your IoT Central application, the suggested next step is to learn how to [Manage IoT Central organizations](howto-create-organizations.md).

‎includes/iot-central-data-export-audit-logs.md‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
---
2+
title: include file
3+
description: include file
4+
services: iot-central
5+
author: dominicbetts
6+
ms.service: iot-central
7+
ms.topic: include
8+
ms.date: 11/14/2022
9+
ms.author: dobett
10+
ms.custom: include file
11+
---
12+
13+
### Audit log format
14+
15+
Each audit log message represents a user-initiated change to an auditable entity inside the IoT Central application. Information in the exported message includes:
16+
17+
- `actor`: Information about the user who modified the entity.
18+
- `applicationId`: The ID of the IoT Central application.
19+
- `messageSource`: The source for the message - `audit`.
20+
- `messageType`: The type of change that occurred. One of: `updated`, `created`, `deleted`.
21+
- `updated`: Only present if `messageType` is `updated`. Provides more detail about the update.
22+
- `resource`: Details of the modified entity.
23+
- `schema`: The name and version of the payload schema.
24+
- `deviceId`: The ID of the device that was changed.
25+
- `enqueuedTime`: The time at which this change occurred in IoT Central.
26+
- `enrichments`: Any enrichments set up on the export.

‎includes/iot-central-data-export-setup.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ Now that you have a destination to export your data to, set up data export in yo
3434
| Device connectivity | Export device connected and disconnected events. | [Device connectivity message format](#device-connectivity-changes-format) |
3535
| Device lifecycle | Export device registered, deleted, provisioned, enabled, disabled, displayNameChanged, and deviceTemplateChanged events. | [Device lifecycle changes message format](#device-lifecycle-changes-format) |
3636
| Device template lifecycle | Export published device template changes including created, updated, and deleted. | [Device template lifecycle changes message format](#device-template-lifecycle-changes-format) |
37+
| Audit logs | Logs of user-initiated updates to entities in the application. To learn more, see [Use audit logs to track activity in your IoT Central application](../articles/iot-central/core/howto-use-audit-logs.md) | [Audit log message format](#audit-log-format) |
3738

3839
1. Optionally, add filters to reduce the amount of data exported. There are different types of filter available for each data export type:
3940
<a name="DataExportFilters"></a>
@@ -45,6 +46,7 @@ Now that you have a destination to export your data to, set up data export in yo
4546
|Device connectivity|<ul><li>Filter by device name, device ID, device template, organizations, and if the device is simulated</li><li>Filter stream to only contain changes from devices with properties matching the filter conditions</li></ul>|
4647
|Device lifecycle|<ul><li>Filter by device name, device ID, device template, and if the device is provisioned, enabled, or simulated</li><li>Filter stream to only contain changes from devices with properties matching the filter conditions</li></ul>|
4748
|Device template lifecycle|<ul><li>Filter by device template</li></ul>|
49+
|Audit logs|N/A|
4850

4951
1. Optionally, enrich exported messages with extra key-value pair metadata. The following enrichments are available for the telemetry, property changes, device connectivity, and device lifecycle data export types:
5052
<a name="DataExportEnrichmnents"></a>

‎includes/iot-central-data-export.md‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,26 +2,26 @@
22
title: include file
33
description: include file
44
services: iot-central
5-
author: v-krishnag
5+
author: dominicbetts
66
ms.service: iot-central
77
ms.topic: include
8-
ms.date: 04/27/2022
9-
ms.author: v-krishnag
8+
ms.date: 11/14/2022
9+
ms.author: dobett
1010
ms.custom: include file
1111
---
1212

1313
Use this feature to continuously export filtered and enriched IoT data from your IoT Central application. Data export pushes changes in near real time to other parts of your cloud solution for warm-path insights, analytics, and storage.
1414

1515
For example, you can:
1616

17-
- Continuously export telemetry, property changes, device connectivity, device lifecycle, and device template lifecycle data in JSON format in near real time.
17+
- Continuously export telemetry, property changes, device connectivity, device lifecycle, device template lifecycle, and audit log data in JSON format in near real time.
1818
- Filter the data streams to export data that matches custom conditions.
1919
- Enrich the data streams with custom values and property values from the device.
2020
- [Transform the data](../articles/iot-central/core/howto-transform-data-internally.md) streams to modify their shape and content.
2121

22-
> [!Tip]
22+
> [!TIP]
2323
> When you turn on data export, you get only the data from that moment onward. Currently, data can't be retrieved for a time when data export was off. To retain more historical data, turn on data export early.
2424
2525
## Prerequisites
2626

27-
To use data export features, you must have the [Data export](../articles/iot-central/core/howto-manage-users-roles.md) permission.
27+
To use data export features, you must have the [Data export](../articles/iot-central/core/howto-manage-users-roles.md) permission.

0 commit comments

Comments
 (0)