Breakout Discussion

March 15, 2022
RFC

• RFC | Audit Log #278
• Audit Log - Beta #682
• Audit Log Support - Community #683
• Audit Log - Enterprise MVP #684
• Audit Log - Post MVP #687

User Stories

• As an ADMIN I want to view audit logs to find out what changed about the platform
• As an ADMIN I want to use audit logs to detect and respond to security incidents
• As an ADMIN I want to export audit logs to my cloud for better search-ability, monitoring, and alerts

On day 1 of MVP, the audit log on the dashboard looks exactly as it does now, except that the backend no longer stores Open, Connect, and other spammy audit logs. We have one option for exporting via slog.

• Move over the distributed diff names into the single source - BETA
• Implement ability to use the single source to generate a JSON blob of all our diffs - something that will let us generate docs - ENT
• Create generic filter system to allow us to only export some logs. - BETA
  Start with high level design documentation that we can cover in a review session.
• Investigate which backend log ingestion services are highest values for our customers so we know where to focus our support efforts first - ENT
  @tjcran
• Create list for the logs we do/not want to show on the front end (look at [Teleport] - ENT (https://goteleport.com/how-it-works/audit-logging-for-ssh-and-kubernetes/)
  We should reference what the industry in general is doing / market validation)
  @vapurrmaid @tjcran
• Frontend: components will need an overhaul/clean up to simplify and pull in a static list of keys for the filtering input fields. - ENT
  @vapurrmaid
• Investigate a Free vs Paid model. Model this off of GitHub? - ENT
  Note: it is easier for us to un-restrict than retroactively restrict things.
  @tjcran
• Create an implementation plan for the Free vs Paid model that can be discussed in a review session. - ENT
• Bring in frontend testing for diff generation - ENT
  @vapurrmaid
• Create testing that is decoupled from the HTTP API tests. How to we make sure the audit logs are created? How to we validate the logs that are generated / that the diff is correct. - BETA
• There are Storybook tests for audit logging now. Can we model this on the XState work? - ENT
• Collect any past user feedback about our logging. Summarize that info below in the "user feedback summary" section. ( @tjcran )

user feedback summary

See: https://www.notion.so/coderhq/Workspaces-v2-GTM-a317650d4b4e4770bf4925f5688e36d0