Skip to content

Access Reports

Automatic Access Reports

The Reaudit Role option in Roles Management allows marking selected roles as privileged.

When a user requests a session with a role marked as Reaudit Role, the system ensures that an access report exists for the data source from the last hour. If no recent report is available, a new access report is generated. An hourly cron job generates one access report for the entire data source and compares it with the previous report to detect permission changes based on the access reports. If changes are detected, all users with an active session during the affected period are marked as suspicious. The permission-change diff is currently set to TBD while the access-report functionality is under development.

Access reports are generated automatically in the following cases:

  • daily, as regular permission snapshots,
  • hourly, for suspicious sessions that used a Reaudit Role, but only if any permission change was detected,
  • immediately when a session with a Reaudit Role is created and approved (in started state) only if there are no reports in database or there are no fresh reports in database (the "fresh" temporarily means "since last hour").

This helps detect permission changes related to privileged access and keeps an audit trail of what changed and when.

Currently:

  • reports are generated for all enabled data sources,
  • the data can be visible under the "heimdall_audit_schema" schema in the "heimdall_access_report_snapshot" and "heimdall_access_report_session_change" tables

The audit tables store the following information:

heimdall_access_report_snapshot

  • id: unique snapshot identifier.
  • data_source_name: name of the data source for which the report was generated.
  • generation_time: time when the report was generated.
  • report_hash: hash of the generated access report.
  • access_report_json: full access report content in JSON format.

heimdall_access_report_session_change

  • id - unique session change report identifier.
  • data_source_name: name of the data source for which the report was generated.
  • generation_time: time when the report was generated.
  • report_hash: hash of the generated access report.
  • access_report_json: full access report content in JSON format.
  • difference: detected permission changes compared to the previous report. Note: The feature is in progress, temporarily always TBD
  • suspicious_users: users who had ongoing sessions during the time when the permission changes were detected.

The feature is currently in progress. The planned GUI will allow users to:

  • compare two access reports,
  • configure access report schedule intervals,
  • select report filters, for example to avoid scanning all databases,
  • choose which data sources should be included in the scan.