extract url integration and audit logs

[AnasBdeir]

hi, 

Internal Audit team in my organization need audit log and URL integration for all SA users, how can I extract these files and where is the location. 

appreciate your help

[JohnKisner]

Anas,

The audit log can be found on the UI server at /var/lib/netwitness/uax/logs/audit/audit.log. What are you referencing when you are talking about URL integration?

[AnasBdeir]

Hi John, 

Url integration: the investigation query for each analyst shown on  GUI under this path. 

System >> url integration   

regards

Anas Bdeir

[JohnKisner · Accepted solution]

Anas,

The only way I know to extract the URL integrations is to copy them down manually from the UI. I believe these are actually stored in the H2 database on the UI head. If they are in there it is not an easy thing and if you don't know what you are doing you can seriously break your installation (think UI doesn't come up). 

By looking over the documentation it appears that the URL Integration area represents the query bread crumbs which can be used for third party integration. In other words the queries found in this area should be represented elsewhere in the system. These other location should be the logs on the brokers and concentrators as you can see the user that ran the query and what the query was. It does not look like the URL Integration was designed to be an audit tool.

My suggestion would be to limit analysts to brokers within your environment and then collect the query information from these brokers. This would provide your auditors with the query information they are looking for.

[AnasBdeir]

thanks john