Skip to main content

Audit Feature Documentation

Overview​

The Auditing Feature provides comprehensive, tamper-evident monitoring and recording of all user and administrative actions across the platform. Unlike conventional logging systems, auditing is not an optional add-on—it is fundamentally embedded into the platform's architecture. Every action automatically generates an audit record.

Audit Categories​

The platform maintains two distinct audit categories to separate administrative and user actions:

CategoryScope
AdminAuditCovers successful, state-changing admin actions. Failures are not recorded.
UserAuditCovers user interactions, including failed ones.

Kafka Topic​

Audit messages are written to dedicated Kafka topics, one per audit category:

CategoryDefault Topic
UserAuditcom.kobil.audit
AdminAuditcom.kobil.audit.admin

The topic names themselves cannot be changed, but it is possible to control the prefix of the topic names. A dot (.) is inserted automatically as delimiter between the prefix and the topic name. For example, when using the prefix prod, the topic com.kobil.audit becomes prod.com.kobil.audit and com.kobil.audit.admin becomes prod.com.kobil.audit.admin.

See the KOBIL Shift configuration parameter common.datastores.kafka.external.topics.prefix in Set Kafka Topics prefix for additional details.

Audit Actions Reference​

The following table lists the key audit actions tracked by the system. This list is non-exhaustive as other components may emit additional audit actions, and the audit schema explicitly allows for new actions to be added over time.

Audit ActionCategorySystemDescription
MESSAGEUserAuditMercuryA message processed in the Mercury chat system; access-denied rejections are recorded as failures.
PREPARE_NEW_DEVICEUserAuditMercuryStored messages are prepared for a new device of the user in Mercury Backend.
KEY_PACKAGE_ADDUserAuditMercuryA key package is added for the user in Mercury Addressbook.
KEY_PACKAGE_REFRESHUserAuditMercuryA key package is refreshed for the user in Mercury Addressbook.
KEY_PACKAGE_REMOVEUserAuditMercuryA key package is removed for the user in Mercury Addressbook.
ADDRESSBOOK_ADDUserAuditMercuryA new entry is added to Mercury Addressbook.
ADDRESSBOOK_USER_ADDUserAuditMercuryA new user is added to Mercury Addressbook.
ADDRESSBOOK_UPDATEUserAuditMercuryAn entry is updated in Mercury Addressbook.
CREATEAdminAuditIDPAn administrator creates a new resource, such as a user, client, or realm.
UPDATEAdminAuditIDPAn administrator updates an existing resource's configuration or details.
DELETEAdminAuditIDPAn administrator deletes a resource.
ACTIONAdminAuditIDPAn administrator performs a specific action on a resource that is not a create, update, or delete.
LOGINUserAuditIDPA user successfully authenticates into the platform.
LOGIN_ERRORUserAuditIDPA failed login attempt; primary signal for brute-force detection.
LOGOUTUserAuditIDPA user terminates their active session.
REGISTERUserAuditIDPA new user account is created; monitor for enumeration patterns.
UPDATE_PASSWORDUserAuditIDPA user changes their password; correlate with password reset events.
SEND_RESET_PASSWORDUserAuditIDPA password reset request is initiated by a user.
UPDATE_TOTPUserAuditIDPA user enables or updates TOTP multi-factor authentication.
REMOVE_TOTPUserAuditIDPA user disables TOTP multi-factor authentication; high-value account takeover indicator.
VERIFY_EMAILUserAuditIDPA user verifies their email address.
CODE_TO_TOKEN_ERRORUserAuditIDPAn authorization code exchange fails; potential replay attack indicator.
REFRESH_TOKEN_ERRORUserAuditIDPA refresh token is expired, revoked, or being reused maliciously.
REVOKE_GRANTUserAuditIDPA user revokes consent for an OAuth grant or application access.