Audit Logs
The eGuardian dashboard provides access to real-time audit logs, which include detailed data on the context and results of authentication and workstation events.
Log Summary View#
A list of the most recent authentication events can be found on the eGuardian Dashboard home page. Each user can see their own activity by selecting Show Logs for Current User; users who are administrators can view all events for users within their organization by selecting Show Logs for Organization. The default summary view includes the time, type of event, user, application, and result.
Types of Audit Log Events#
- Authentication: Login requests via web apps, Credential Provider, RADIUS, etc
- Continuous Authentication: Logins to additional resources during an authenticated SSO session
- Workstation Log: Workstation events such as locked, unlocked, paired, logged out, etc
Types of Result#
- MFA Approved: Successful login, approved by the user or automatically via policy
- Automatically Approve: Continuous authentication approved by the policy engine
- MFA Expired: Login request expired without being approved
- MFA Rejected: Login request rejected by the user or due to policy
Audit Log Details#
Details for each authentication event can be viewed by clicking on it in the summary list. Different types of information are displayed for different events.
Authentication and Continuous Auth#
- LOA Score: Composite Level of Assurance score
- LOA Breakdown: LOA component scores
- Applied Policies: Policies applied to this authentication request
- Description: Detailed context information
Workstation#
- Description: Workstation event (locked, unlocked, paired, etc)
- Workstation: Device and user information
- Current State: Current session state
- Paired: Workstation pairing status
- Workstation System Attributes: Detailed information on the workstation and configured settings
