Track impersonations with just a new table and two Script Actions

[CapaJC]

After reading a recent post, I realized how easy it would be to track impersonations.

Create a custom table: u_impersonation
Add the following fields: u_impersonator (String), u_impersonated (String), u_when (date/time), u_type (choice)
Add two choices to u_type: start, end

Import the attached Script Actions. I'll include the script contents below. That's it! You'll get an easy to read list of subsequent impersonations.

You *could* make u_impersonated and u_impersonator reference fields, doing a GlideRecord lookup of the user with the user_name in the parm1 and parm2 of the event, but you'd lose visibility of impersonations by users who aren't in your database (specifically if someone from ServiceNow is accessing your instance and impersonating one of your users to help troubleshoot an issue). Better to use the user_name as a String.

Script Action 1:
Name: Impersonation Start
Event name: impersonation.start
Script:

auditImpersonationStart();

function auditImpersonationStart() {
var gr = new GlideRecord("u_impersonation");
gr.u_impersonator = event.parm1;
gr.u_impersonated = event.parm2;
gr.u_when = event.sys_created_on;
gr.u_type = "start";
gr.insert();
}

Script Action 2:
Name: Impersonation End
Event name: impersonation.end
Script:

auditImpersonationEnd();

function auditImpersonationEnd() {
var gr = new GlideRecord("u_impersonation");
gr.u_impersonator = event.parm1;
gr.u_impersonated = event.parm2;
gr.u_when = event.sys_created_on;
gr.u_type = "end";
gr.insert();
}

impersonation audit script actions.zip