Skip to content

Session Content Recording and Auditing

1. Purpose

  • The system provides and implements the capability for organization-defined users or roles to record, view, hear, or log the content of a user session under organization-defined circumstances.
  • Support STIG compliance with AU-14-00.

2. Session Auditing Activities

2.1 Session Login / Authentication

  • Record user login and logout events.
  • Record user identity information (User ID, role, permissions) in the mct_member table in PostgreSQL.
  • Record user source information such as IP address

2.2 Session Operations

  • Record activity log performed by users Activity-Log
  • Record critical in-application actions (e.g., data export/import, permission changes)
  • Record system or application configuration changes

2.3 Audit Log Management

  • Generate, store, and protect session audit logs
  • Encryption of sensitive information
  • Intend to generate an audit report and archive it

The scope covers tables mct_logs,mct_api_server_logs,mct_recovery_log,mct_recovery_log_detail

Session auditing activities are implemented in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.

When using session auditing capabilities, the organization should assess potential privacy, legal, civil rights, and civil liberties risks, especially when handling personally identifiable information (PII), and implement necessary controls and management processes to ensure auditing activities are lawful and compliant.

Reference