Skip to content

[Lightning AU-14] Session Activity Auditing Response

Control Response

Global Service Status (GSS) provides an application-level auditing capability for authenticated user activity performed during a session context. For this service, a session is interpreted as a sequence of authenticated API requests made by a user identity. The implementation logs successful user-initiated write operations against in-scope business entities and allows authorized reviewers to query those audit records through administrative APIs.

The implementation is intentionally scoped to business-action auditing and should not be described as full session recording or replay. It does not capture screen content, keystrokes, audio, complete browser interaction streams, or traditional server-side HttpSession lifecycle events.

Implementation Statement

GSS uses @AuditLog annotations on in-scope write endpoints and captures audit records through ActivityLogAspect. For successful authorized requests, the application resolves the operator identity from the authorization flow, extracts action, entity type, entity id, entity name, service id, and timestamp, and persists those values into status_activity_log.

The current implementation logs authenticated write activity for the following entity categories:

  • SERVICE
  • COMPONENT
  • INCIDENT
  • INCIDENT_MESSAGE
  • ANNOUNCEMENT
  • MAINTENANCE_EVENT
  • CLUSTER
  • DATA_CENTER
  • RELEASE_NOTE
  • TEMP_NOTICE
  • STATUS_API_DOC

The implementation also includes selected post-commit logging for business-significant cascade deletes, including:

  • child components deleted with a parent component
  • incident messages deleted with an incident
  • clusters deleted with a data center

Authorized reviewers can view audit history using:

  • GET /status/admin/activity-logs
  • GET /status/admin/activity-logs/entity

Evidence

Primary implementation evidence:

  • server/src/main/java/com/cisco/gss/common/annotation/AuditLog.java
  • server/src/main/java/com/cisco/gss/aspect/ActivityLogAspect.java
  • server/src/main/java/com/cisco/gss/common/domain/audit/ActivityLog.java
  • server/src/main/java/com/cisco/gss/service/impl/ActivityLogServiceImpl.java
  • server/src/main/java/com/cisco/gss/repository/ActivityLogRepository.java
  • server/src/main/java/com/cisco/gss/controller/ActivityLogController.java
  • server/src/main/java/com/cisco/gss/Auth/AuthAspect.java
  • server/src/main/java/com/cisco/gss/common/audit/UserContextHolder.java
  • migration/postgres/scripts/v47__create_activity_log_table.sql

Representative in-scope coverage evidence:

  • server/src/main/java/com/cisco/gss/controller/ServiceController.java
  • server/src/main/java/com/cisco/gss/controller/ComponentController.java
  • server/src/main/java/com/cisco/gss/controller/IncidentController.java
  • server/src/main/java/com/cisco/gss/controller/MaintenanceController.java
  • server/src/main/java/com/cisco/gss/controller/MaintenanceAnnouncementController.java
  • server/src/main/java/com/cisco/gss/controller/ClusterController.java
  • server/src/main/java/com/cisco/gss/controller/DataCenterController.java
  • server/src/main/java/com/cisco/gss/controller/ReleaseNoteController.java
  • server/src/main/java/com/cisco/gss/controller/TempNoticeController.java
  • server/src/main/java/com/cisco/gss/controller/StatusApiDocController.java

Representative cascade side-effect evidence:

  • server/src/main/java/com/cisco/gss/service/impl/ComponentServiceImpl.java
  • server/src/main/java/com/cisco/gss/service/impl/IncidentServiceImpl.java
  • server/src/main/java/com/cisco/gss/service/impl/DataCenterServiceImpl.java