Skip to content

Advanced audit event filtering #7724

Open

Description

What

Currently the event type session.end returns 3 types of session:

  1. interactive: true
  2. interactive: false
  3. interactive: true but session_recording: off

In the UI, we have a Session Recording screen where we retrieve session.end only events, and do additional filtering in the front to display only interactive session. With pagination this can cause confusion to the user.

If there are a lot of session.end events for a given date range, there is this edge case where my first fetch returns me only non-interactive or session recording off sessions. In cases like this, the user will not see anything in the list, but they will see fetch more button. When a user clicks fetch more there may or may not be any interactive sessions and so on.

And if only 1 result returns from the first fetch (and there is fetch more), users might think "there is only 1 result" and miss the fetch more altogether.

We need to allow for advanced filtering where the backend in addition to filtering for session.end, also filters for interactive: true and no presence of session_recording: off when requested.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

No one assigned

    Labels

    audit-logIssues related to Teleports Audit Logc-mdInternal Customer Referencec-sleInternal Customer Referencefeature-requestUsed for new features in Teleport, improvements to current should be #enhancements

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions