액세스 모니터링 이벤트 참조에는 보고서에서 쿼리하고 볼 수 있는 액세스 모니터링 이벤트 목록과 각 이벤트를 쿼리하기 위해 실행할 수 있는 tctl 명령의 예시가 포함되어 있습니다.

액세스 모니터링은 비정상적인 액세스 패턴을 식별하는 데 관련된 Teleport 감사 이벤트의 하위 집합을 추적합니다. 포괄적인 이벤트 집합을 보려면 Teleport Identity Security의 조사 보기를 방문하세요. Teleport로 추적할 수 있는 모든 감사 이벤트의 참조는 감사 이벤트 참조를 참조하세요.

access_list.create#

access_list.create is emitted when an access list is created.

Example query:

$ tctl audit query exec \
  'select cluster_name,code,ei from access_list_create limit 1'

Columns:

access_list.delete#

access_list.delete is emitted when an access list is deleted.

Example query:

$ tctl audit query exec \
  'select cluster_name,code,ei from access_list_delete limit 1'

Columns:

access_list.member.create#

access_list.member.create is emitted when an access list member is created.

Example query:

$ tctl audit query exec \
  'select access_list_name,cluster_name,code from access_list_member_create limit 1'

Columns:

access_list.member.delete#

access_list.member.delete is emitted when an access list member is deleted.

Example query:

$ tctl audit query exec \
  'select access_list_name,cluster_name,code from access_list_member_delete limit 1'

Columns:

access_list.member.update#

access_list.member.update is emitted when an access list member is updated.

Example query:

$ tctl audit query exec \
  'select access_list_name,cluster_name,code from access_list_member_update limit 1'

Columns:

access_list.review#

access_list.review is emitted when an access list is reviewed.

Example query:

$ tctl audit query exec \
  'select cluster_name,code,ei from access_list_review limit 1'

Columns:

access_list.update#

access_list.update is emitted when an access list is updated.

Example query:

$ tctl audit query exec \
  'select cluster_name,code,ei from access_list_update limit 1'

Columns:

access_request.create#

access_request.create is emitted when access request has been created or updated.

Example query:

$ tctl audit query exec \
  'select access_requests,assume_start_time,aws_role_arn from access_request_create limit 1'

Columns:

access_request.review#

access_request.review is emitted when access request has been created or updated.

Example query:

$ tctl audit query exec \
  'select access_requests,assume_start_time,aws_role_arn from access_request_review limit 1'

Columns:

auth#

auth is emitted upon a failed or successfull authentication attempt.

Example query:

$ tctl audit query exec \
  'select access_requests,addr_local,addr_remote from auth limit 1'

Columns:

bot.join#

bot.join records a bot join event.

Example query:

$ tctl audit query exec \
  'select bot_name,cluster_name,code from bot_join limit 1'

Columns:

cert.create#

cert.create is emitted when a certificate is issued.

Example query:

$ tctl audit query exec \
  'select cert_type,cluster_name,code from cert_create limit 1'

Columns:

db.session.query#

db.session.query is emitted when a user executes a database query.

Example query:

$ tctl audit query exec \
  'select access_requests,aws_role_arn,azure_identity from db_session_query limit 1'

Columns:

db.session.query.failed#

db.session.query.failed is emitted when a user executes a database query.

Example query:

$ tctl audit query exec \
  'select access_requests,aws_role_arn,azure_identity from db_session_query_failed limit 1'

Columns:

db.session.start#

db.session.start is emitted when a user connects to a database.

Example query:

$ tctl audit query exec \
  'select access_requests,addr_local,addr_remote from db_session_start limit 1'

Columns:

device.authenticate#

device.authenticate is a device-related event. See the "lib/events.DeviceEvent" and "lib/events.DeviceCode" for the various event types and codes, respectively. Replaces the previous [DeviceEvent] proto, presenting a more standard event interface with various embeds.

Example query:

$ tctl audit query exec \
  'select access_requests,aws_role_arn,azure_identity from device_authenticate limit 1'

Columns:

device.enroll#

device.enroll is a device-related event. See the "lib/events.DeviceEvent" and "lib/events.DeviceCode" for the various event types and codes, respectively. Replaces the previous [DeviceEvent] proto, presenting a more standard event interface with various embeds.

Example query:

$ tctl audit query exec \
  'select access_requests,aws_role_arn,azure_identity from device_enroll limit 1'

Columns:

exec#

exec specifies command exec event.

Example query:

$ tctl audit query exec \
  'select access_requests,addr_local,addr_remote from exec limit 1'

Columns:

instance.join#

instance.join records an instance join event.

Example query:

$ tctl audit query exec \
  'select cluster_name,code,ei from instance_join limit 1'

Columns:

join_token.create#

join_token.create event is emitted when a provisioning token (a.k.a. join token) of any role is created.

Example query:

$ tctl audit query exec \
  'select access_requests,aws_role_arn,azure_identity from join_token_create limit 1'

Columns:

kube.request#

kube.request specifies a Kubernetes API request event.

Example query:

$ tctl audit query exec \
  'select access_requests,addr_local,addr_remote from kube_request limit 1'

Columns:

lock.created#

lock.created is emitted when a lock is created/updated. Locks are used to restrict access to a Teleport environment by disabling interactions involving a user, an RBAC role, a node, etc. See rfd/0009-locking.md for more details.

Example query:

$ tctl audit query exec \
  'select access_requests,aws_role_arn,azure_identity from lock_created limit 1'

Columns:

lock.deleted#

lock.deleted is emitted when a lock is deleted.

Example query:

$ tctl audit query exec \
  'select access_requests,aws_role_arn,azure_identity from lock_deleted limit 1'

Columns:

recovery_code.used#

recovery_code.used is emitted when a user's recovery code was used successfully or unsuccessfully.

Example query:

$ tctl audit query exec \
  'select access_requests,aws_role_arn,azure_identity from recovery_code_used limit 1'

Columns:

reset_password_token.create#

reset_password_token.create is emitted when a user token is created.

Example query:

$ tctl audit query exec \
  'select access_requests,aws_role_arn,azure_identity from reset_password_token_create limit 1'

Columns:

saml.idp.auth#

saml.idp.auth is emitted when a user has attempted to authorize against the SAML IdP.

Example query:

$ tctl audit query exec \
  'select access_requests,aws_role_arn,azure_identity from saml_idp_auth limit 1'

Columns:

session.command#

session.command is a session command event.

Example query:

$ tctl audit query exec \
  'select access_requests,argv,aws_role_arn from session_command limit 1'

Columns:

session.join#

session.join emitted when another user joins a session.

Example query:

$ tctl audit query exec \
  'select access_requests,addr_local,addr_remote from session_join limit 1'

Columns:

session.rejected#

session.rejected event happens when a user hits a session control restriction.

Example query:

$ tctl audit query exec \
  'select access_requests,addr_local,addr_remote from session_rejected limit 1'

Columns:

session.start#

session.start is a session start event.

Example query:

$ tctl audit query exec \
  'select access_requests,addr_local,addr_remote from session_start limit 1'

Columns:

user.create#

user.create is emitted when the user is created or upserted.

Example query:

$ tctl audit query exec \
  'select access_requests,aws_role_arn,azure_identity from user_create limit 1'

Columns:

user.login#

user.login records a successfully or failed user login event.

Example query:

$ tctl audit query exec \
  'select access_requests,addr_local,addr_remote from user_login limit 1'

Columns:

user.password_change#

user.password_change is emitted when the user changes their own password.

Example query:

$ tctl audit query exec \
  'select access_requests,aws_role_arn,azure_identity from user_password_change limit 1'

Columns:

windows.desktop.session.end#

windows.desktop.session.end is emitted when a user ends a Windows desktop session.

Example query:

$ tctl audit query exec \
  'select access_requests,aws_role_arn,azure_identity from windows_desktop_session_end limit 1'

Columns:

windows.desktop.session.start#

windows.desktop.session.start is emitted when a user connects to a desktop.

Example query:

$ tctl audit query exec \
  'select access_requests,addr_local,addr_remote from windows_desktop_session_start limit 1'

Columns: