web: add desktop session ID to audit log page (#46445)

The summary of desktop session events did not include the session ID, which made it hard to search for events related to a particular session. Include the session ID in the start/end events.
gravitational · Sep 11, 2024 · 05d0888 · 05d0888
1 parent 514ad62
commit 05d0888
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 10 deletions.
diff --git a/web/packages/teleport/src/Audit/__snapshots__/Audit.story.test.tsx.snap b/web/packages/teleport/src/Audit/__snapshots__/Audit.story.test.tsx.snap
@@ -7327,7 +7327,7 @@ exports[`list of all events 1`] = `
           <td
             style="word-break: break-word;"
           >
-            User [joe] was denied access to Windows desktop [Administrator@desktop-name] on [desktopaccess.com]
+            User [joe] was denied access to Windows desktop [Administrator@desktop-name] with domain [desktopaccess.com]
           </td>
           <td
             style="min-width: 120px;"
@@ -7375,7 +7375,7 @@ exports[`list of all events 1`] = `
           <td
             style="word-break: break-word;"
           >
-            Session for Windows desktop [Administrator@desktop-name] on [desktopaccess.com] has ended for user [joe]
+            Session b7f734d8-bdc2-4996-8959-0b42a11708e7 for Windows desktop [Administrator@desktop-name] with domain [desktopaccess.com] has ended for user [joe]
           </td>
           <td
             style="min-width: 120px;"
@@ -7423,7 +7423,7 @@ exports[`list of all events 1`] = `
           <td
             style="word-break: break-word;"
           >
-            User [joe] has connected to Windows desktop [Administrator@desktop-name] on [desktopaccess.com]
+            User [joe] started session b7f734d8-bdc2-4996-8959-0b42a11708e7 on Windows desktop [Administrator@desktop-name] with domain [desktopaccess.com]
           </td>
           <td
             style="min-width: 120px;"

diff --git a/web/packages/teleport/src/services/audit/makeEvent.ts b/web/packages/teleport/src/services/audit/makeEvent.ts
@@ -1145,10 +1145,10 @@ export const formatters: Formatters = {
   [eventCodes.DESKTOP_SESSION_STARTED]: {
     type: 'windows.desktop.session.start',
     desc: 'Windows Desktop Session Started',
-    format: ({ user, windows_domain, desktop_name, windows_user }) => {
-      let message = `User [${user}] has connected to Windows desktop [${windows_user}@${desktop_name}]`;
+    format: ({ user, windows_domain, desktop_name, sid, windows_user }) => {
+      let message = `User [${user}] started session ${sid} on Windows desktop [${windows_user}@${desktop_name}]`;
       if (windows_domain) {
-        message += ` on [${windows_domain}]`;
+        message += ` with domain [${windows_domain}]`;
       }
       return message;
     },
@@ -1159,20 +1159,20 @@ export const formatters: Formatters = {
     format: ({ user, windows_domain, desktop_name, windows_user }) => {
       let message = `User [${user}] was denied access to Windows desktop [${windows_user}@${desktop_name}]`;
       if (windows_domain) {
-        message += ` on [${windows_domain}]`;
+        message += ` with domain [${windows_domain}]`;
       }
       return message;
     },
   },
   [eventCodes.DESKTOP_SESSION_ENDED]: {
     type: 'windows.desktop.session.end',
     desc: 'Windows Desktop Session Ended',
-    format: ({ user, windows_domain, desktop_name, windows_user }) => {
+    format: ({ user, windows_domain, desktop_name, sid, windows_user }) => {
       let desktopMessage = `[${windows_user}@${desktop_name}]`;
       if (windows_domain) {
-        desktopMessage += ` on [${windows_domain}]`;
+        desktopMessage += ` with domain [${windows_domain}]`;
       }
-      let message = `Session for Windows desktop ${desktopMessage} has ended for user [${user}]`;
+      let message = `Session ${sid} for Windows desktop ${desktopMessage} has ended for user [${user}]`;
       return message;
     },
   },

diff --git a/web/packages/teleport/src/services/audit/types.ts b/web/packages/teleport/src/services/audit/types.ts
@@ -1049,6 +1049,7 @@ export type RawEvents = {
     {
       desktop_addr: string;
       desktop_name: string;
+      sid: string;
       windows_user: string;
       windows_domain: string;
     }
@@ -1067,6 +1068,7 @@ export type RawEvents = {
     {
       desktop_addr: string;
       desktop_name: string;
+      sid: string;
       windows_user: string;
       windows_domain: string;
     }