How can I log the user's IP address when an attachment is downloaded?

[AJ Styles]

Hello,

I would like to create an audit log that records the user's IP address whenever an attachment is downloaded.

I am aware that ServiceNow provides the attachment.read event. However, I have not found a way to retrieve the client IP address associated with the actual download request from this event.

I tried the following approaches:

• A Display Business Rule on the sys_attachment table
• A script in the sys_attachment Read ACL
• Retrieving the IP address using:

gs.getSession().getClientIP();

However, I found that these approaches could not be implemented.

My requirements are to record:

• Downloading user
• Attachment sys_id
• File name
• Client IP address
• Download date and time

Is there a supported or recommended way to capture the client IP address when a user downloads an attachment?
Also, is there any reliable method to distinguish an actual attachment download from other sys_attachment read operations?

Thank you.

[Ankur Bawiskar]

@AJ Styles 

I know there are challenges when BR is written on event table and it doesn't fire at all

Business rule on sysevent table -> this confirms this

Another workaround

-> run a scheduled job periodically every 1 hour or so and query event table with that attachment.read event and then handle your logic

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏

[Ankur Bawiskar]

@AJ Styles 

Just following up to see whether my suggested solution worked for you.

If you're still facing any issues, I'd be happy to help further.

[Tanushree Maiti]

Hi @AJ Styles 

Refer:

Retrieving the Originating Client IP Address in ServiceNow

How to get the IP Address from Transaction Log Entry and add it to a field in User Table 

I want to prevent users from downloading case attachments if they are not using a specific IP addres... 

How can we get the session IP address in Script action ? getclientip() is not working in script acti... 

[AJ Styles]

Hello,

Is it possible to capture the client IP address by referencing the transaction associated with an attachment download, and then log it that way?

[Vasantharajan N]

@AJ Styles - You can make use of the Security Center event "sn_vsc.sc_security_export" that helps you log the data export details. Data Export details are stored in table  Export Events[sn_vsc_export_event].