How can I log the user's IP address when an attachment is downloaded?

[AJ Styles]

Hello,

I would like to create an audit log that records the user's IP address whenever an attachment is downloaded.

I am aware that ServiceNow provides the attachment.read event. However, I have not found a way to retrieve the client IP address associated with the actual download request from this event.

I tried the following approaches:

• A Display Business Rule on the sys_attachment table
• A script in the sys_attachment Read ACL
• Retrieving the IP address using:

gs.getSession().getClientIP();

However, I found that these approaches could not be implemented.

My requirements are to record:

• Downloading user
• Attachment sys_id
• File name
• Client IP address
• Download date and time

Is there a supported or recommended way to capture the client IP address when a user downloads an attachment?
Also, is there any reliable method to distinguish an actual attachment download from other sys_attachment read operations?

Thank you.

[AJ Styles]

Hello, thank you so much for your answer — your input was helpful too.

However, my goal is specifically to log the client IP address whenever an attachment is downloaded.

Do you happen to know of a good way to achieve that?

[Vasantharajan N]

@AJ Styles - You can make use of the following to trace back the IP address,

1. Business Rule - "SC - Store Export Data" triggers the event "sn_vsc.sc_security_export"

2. Event is created based on the "sys_poll" table where you have the "Session ID" column.

3. Use Session ID column value from sys_poll table as a filter on the table "syslog_transaction" for the column/ field "Session" and get the value of "IP Address".