The Audit Log is not an actual audit log due to wrong actor names.

5 Comments

  • Dave Dyson
    Zendesk Community Manager
    Thanks for this feedback, Dave!
    -1
  • Caroline Kello
    Zendesk Product Manager

    Hi Dave, 

    You're absolutely right that Zendesk should never be used as the Actor when the event was the result of an action by a specific user. This is a blocker for any new events that we or other teams add, but unfortunately there are older events (done before the audit log was owned by the current team) where this is still the case. 

    We create stories on our backlog when we see it or, or are made aware of it by other teams and users, and we will address it as part of our ongoing work and ownership of the audit log. 

    Thanks, Caroline

    -1
  • CJ

    I regularly see triggers misattributing actions to agents, as well. For example, one scenario I figured out is that if an agent updates a ticket with a macro that adds a tag, and the tag triggers a change a requester's language, the log says the agent did it, even though they did not, and may not even have the permissions to do so. Incorrect attribution is pretty alarming thing to see in an audit log and makes it very difficult to figure out what actually happened. 

    0
  • CJ

    Caroline Kello This is a serious security issue, do you have plans to address this? 

    0
  • Caroline Kello
    Zendesk Product Manager

    Hey CJ, we don't have a dedicated or concerted project planned to update and ensure the Actor is correctly attributed across all of the Audit log event. Our approach is the same as from my comment in April, that we address it as part of our ongoing work.

    -2

Please sign in to leave a comment.

Powered by Zendesk