How can I log the user's IP address when an attachment is downloaded?

[AJ Styles]

Hello,

I would like to create an audit log that records the user's IP address whenever an attachment is downloaded.

I am aware that ServiceNow provides the attachment.read event. However, I have not found a way to retrieve the client IP address associated with the actual download request from this event.

I tried the following approaches:

• A Display Business Rule on the sys_attachment table
• A script in the sys_attachment Read ACL
• Retrieving the IP address using:

gs.getSession().getClientIP();

However, I found that these approaches could not be implemented.

My requirements are to record:

• Downloading user
• Attachment sys_id
• File name
• Client IP address
• Download date and time

Is there a supported or recommended way to capture the client IP address when a user downloads an attachment?
Also, is there any reliable method to distinguish an actual attachment download from other sys_attachment read operations?

Thank you.

[Ankur Bawiskar]

@AJ Styles 

did you try creating business rule on event table for event "attachment.read"?

it shows which attachment sysId was viewed and downloaded, file name and by which user

Example below

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏

[AJ Styles]

Hello,

Thank you for your answer. I'm already aware of that approach, but what I'm trying to do is log the client IP address whenever an attachment is downloaded, and the attachment.read event does not capture the IP address.

Would you happen to know of any other reliable way to achieve this?

[Ankur Bawiskar]

@AJ Styles 

this should help you in BR script -> gs.getSession().getClientIP();

Did you try that?

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏

[AJ Styles]

Hello, thank you for your answer.

Do you mean that I should create a Business Rule on the sysevent table?

I actually tried creating a Business Rule on the sysevent table, but it didn't work.

If you know of any other approach, could you let me know?