Avoid log tampering
-
- UpdatedAug 1, 2024
- 2 minutes to read
- Xanadu
- Now Platform Security
Configure system log table protection rules to limit the scope of modification and deletion of application log records. The rules enable you to determine the logging of changes or attempts to changes in these tables.
If you are a security_admin, activate the Protected Tables plugin
(com.glide.protected_tables) that allows the platform to restrict update, insert and delete
operations on the following system log tables:
- syslog
- syslog_transaction
- sys_outbound_http_log
- sysevent
- sys_audit
- sys_push_notification
- syslog_app_scope
- protected_table_configuration (config not modifiable)
Note: The com.glide.protected_tables plugin gives protection only to the system log
tables mentioned above. Any attempt to update, insert or delete a record logs a message in
the protected_table_log table.
See Installing and configuring the log protection plugin for more details.
You can specify one of the following log protection levels for each of the system log
table.
- Block and log the attempt: Blocks any modification and logs the attempt
- Only block the attempt: Blocks any modification and doesn't log the attempt
- Only log the attempt: Doesn't block the modification but logs the attempt
- Don't block and don't log the attempt: Doesn't block the modification and doesn't log the attempt
Platform uses the log protection levels specified for each of the system log tables to
block and/or log any attempts to modify a record after being initially created.
Note: If you
are a security_admin, you have the ability to override the default log protection levels
in each of the system log tables to adapt to the customizations on your
instance.
If there have been any attempts to modify the system log tables, they are logged into the
protected_table_log table.
Note: If the protection level is not specified for a table, any
attempts of modification are not logged into the protected_table_log table.
In order to disable the plugin operations on tables in the Admin Panel, set the com.glide.security.protected_table.enabled property to false. See Create log protection property for more information.