Enabling Observe User Query Audit enablement

General / Other
, ,
1

If you would like to have an optional pre-release Observe user query audit logging enabled, please raise a ticket with Observe support.

This would enable events to be emitted into System Datastream for each of the queries issued via the UI for each of the users. Some of the use-case scenarios include Security auditing.

Afterwards you should be able to explore the audit events by using the following Worksheet filter against System Datastream:

filter ((string(EXTRA.schema) = "metaquery_runquery"))

some additional useful OPAL:

make_col
   //extracts all dataset IDs for all stages of the Observe Query
  datasetIds:get_jmespath(FIELDS, 'stages[].inputs[].datasetId'), 
  //extracts all input names for all stages of the Observe Query
  inputNames:get_jmespath(FIELDS, 'stages[].inputs[].inputName')
  //boils down the unique ones from above
make_col unique_datasetIds:array_distinct(datasetIds), unique_inputNames:array_distinct(inputNames)
// extracts the userId that this query was associated with
make_col userId:string(FIELDS.userId)