Skip to content

Audit event for event type filter deletion

Harsimar Sandhu requested to merge 344848-audit-event-for-filter-delete into master

What does this MR do and why?

Creates audit event when event type filter is deleted.

How to set up and validate locally

  1. create event type filters https://docs.gitlab.com/ee/administration/audit_event_streaming.html#event-type-filters
mutation createEventTypeFilter {
  auditEventsStreamingDestinationEventsAdd(input: {
    destinationId: "GID",
    eventTypeFilters: ["filter_1", "filter_2"]
  }){
    errors
    eventTypeFilters
  }
}
  1. remove the created event type filters
mutation removeEventTypeFilter {
  auditEventsStreamingDestinationEventsRemove(input: {
    destinationId: "GID",
    eventTypeFilters: ["filter_1", "filter_2"]
  }){
    errors
  }
}
  1. Check gdk_host/admin/audit_logs for audit events created.
  2. verify audit event is created with correct attributes.
Sample audit event
{
                :id => 564388,
         :author_id => 1,
         :entity_id => 31,
       :entity_type => "Group",
           :details => {
           :author_name => "Administrator",
          :author_class => "User",
             :target_id => 1,
           :target_type => "AuditEvents::ExternalAuditEventDestination",
        :target_details => "https://hsandhu.requestcatcher.com/",
        :custom_message => "Deleted audit event type filter(s): repository_download_operation",
            :ip_address => "127.0.0.1",
           :entity_path => "flightjs"
    },
        :ip_address => "127.0.0.1",
       :author_name => "Administrator",
       :entity_path => "flightjs",
    :target_details => "https://hsandhu.requestcatcher.com/",
        :created_at => Mon, 06 Mar 2023 13:47:49.393773000 UTC +00:00,
       :target_type => "AuditEvents::ExternalAuditEventDestination",
         :target_id => 1
}

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #344848 (closed)

Edited by Harsimar Sandhu

Merge request reports