Audit access to tables

Giuseppe Mastro
Tera Contributor

‎01-16-2024 03:28 AM

Hi All

 

Our security team ask me audit tables and record access. I need to know when a user read records from tables in some scoped application. 

 

Where I can find this information? Only in syslog_transaction or there are other tables. 

 

Regards

 

Giuseppe M

0 Helpfuls
  • 760 Views
2 REPLIES 2

Maik Skoddow
Tera Patron
Tera Patron

‎01-16-2024 06:17 AM

Hi @Giuseppe Mastro 

 

the audit tables only store changes to records, but not whether a user reads any records. This a completely different type of data and OOTB the transaction log is the only place where this is logged anyhow.

 

Maik

juliancoira
Tera Contributor

‎06-28-2024 07:14 AM

Hi Guiseppe,

I needed to do something similar and found that the sysevent table stores the event 'user.view' and the userID that fired the event (and of course the table and sysID of the record that was viewed). 

 

https://www.servicenow.com/community/itsm-forum/audit-if-someone-just-opens-a-ticket/m-p/806875/page...