Uploaded image for project: 'Bitbucket Cloud'
  1. Bitbucket Cloud
  2. BCLOUD-9622

Add additional information to account audit log (BB-10722)

    • Our product teams collect and evaluate feedback from a number of different sources. To learn more about how we use customer feedback in the planning process, check out our new feature policy.

    • Hide

      Hello everyone,

      I am excited to announce that Bitbucket has released Bitbucket audit logs in Atlassian Access. This is Bitbucket's first release of events, which include workspace, project, and repository administration and configuration event logs. Additional events will be released over the next few weeks to provide further event coverage. The audit log feature in Atlassian Access includes an API so the logs can be exported to an SIEM tool, as well as a UI to search through and export the logs.

      In order to enable the logs in Atlassian Access, you will need to link your Bitbucket workspace to your Atlassian Organization, detailed instructions are provided here.

      More information on the audit log feature in Atlassian Access and how to enable the Bitbucket logs can be found here.

      Looking forward to your feedback.

      Cheers,

      Denise Garcia

      Show
      Hello everyone, I am excited to announce that Bitbucket has released Bitbucket audit logs in Atlassian Access. This is Bitbucket's first release of events, which include workspace, project, and repository administration and configuration event logs. Additional events will be released over the next few weeks to provide further event coverage. The audit log feature in Atlassian Access includes an API so the logs can be exported to an SIEM tool, as well as a UI to search through and export the logs. In order to enable the logs in Atlassian Access, you will need to link your Bitbucket workspace to your Atlassian Organization, detailed instructions are provided here . More information on the audit log feature in Atlassian Access and how to enable the Bitbucket logs can be found here . Looking forward to your feedback. Cheers, Denise Garcia

      The Audit log page currently doesn't log some crucial information on the shared workspaces, such as:

      1. Membership actions
      2. Clones, Pushes, and downloads along with the IP address from where it is happening.
      3. Updates in  the workspaces or repositories
      4. Fork creation
      5. Content transfer.
      6. Security features enabled/disabled

      fstefanelli@atlassian.com edit - It would be great to add project information (who created a project, when it was last updated, show any project changes.

      lmontiel@atlassian.com edit - It would be also great to add information related to branch permission changes, showing who altered/created/deleted branch permissions on any given repo.
      Please add this logging to the account Audit log.

      641e77b2eb21 edit - It would be also great to add information about changes in the environment variables on the workspace/repository and deployment levels.
      c778a0660499 edit - include branch creation/deletion log 

      cacdc2da5150  edit - It would be very interesting to also have the permissions/repository changes on all groups and projects of a workspace.

      ptrinh@atlassian.com edit - Include changes to the repository, project and workspace access tokens (created and removed)

      641e77b2eb21 edit - Include information about when a repository is imported.

      For example, when an invitation to join a workspace is sent, there is no log stating when the invitation was sent nor who sent the invitation.

          Form Name

            [BCLOUD-9622] Add additional information to account audit log (BB-10722)

            Renaming of repositories would be a great one to have! 

            A repository was moved to a different project and renamed.

            We saw the move but not the rename in the logs so we did not realise which repository was moved (as the new name was in the logs) and assumed it had been deleted

            chris-hopkins added a comment - Renaming of repositories would be a great one to have!  A repository was moved to a different project and renamed. We saw the move but not the rename in the logs so we did not realise which repository was moved (as the new name was in the logs) and assumed it had been deleted

            So the "Improved audit logs for Bitbucket" roadmap entry says it was released back in 2022 and the linked doc said the events would be rolled out incrementally.  It's been 2 year and we still don't see entries for anything related to projects, branches, merges, etc, etc.  When can we expect the events to be added for everything in this list?
            https://confluence.atlassian.com/bbkb/bitbucket-cloud-audit-log-events-1178872155.html

            We've had to investigate issue we had recently and there are no logs to support any of the actions that happened, log events that we did have in Bitbucket server.  What's the hold up?

            Nathan Curry added a comment - So the "Improved audit logs for Bitbucket" roadmap entry says it was released back in 2022 and the linked doc said the events would be rolled out incrementally.  It's been 2 year and we still don't see entries for anything related to projects, branches, merges, etc, etc.  When can we expect the events to be added for everything in this list? https://confluence.atlassian.com/bbkb/bitbucket-cloud-audit-log-events-1178872155.html We've had to investigate issue we had recently and there are no logs to support any of the actions that happened, log events that we did have in Bitbucket server.  What's the hold up?

            Rick Egli added a comment -

            I have been directed here from BBS-216751

             

            I specifically need to have more detail when BB IP restrictions are changed. Currently it shows who and from what IP - but we need to know what change was made (additions/removals, and the IP addresses affected).

            For compliance reasons, the IP restrictions act as a sort of firewall and we have to secure these changes with change management and auditing of changes.

            Rick Egli added a comment - I have been directed here from BBS-216751   I specifically need to have more detail when BB IP restrictions are changed. Currently it shows who and from what IP - but we need to know what change was made (additions/removals, and the IP addresses affected). For compliance reasons, the IP restrictions act as a sort of firewall and we have to secure these changes with change management and auditing of changes.

            Hi there,

             

            so you are saying if we do not buy Atlassian Access we wont get any improvements in audit log at all?

            Marcelo Fabricanti added a comment - Hi there,   so you are saying if we do not buy Atlassian Access we wont get any improvements in audit log at all?

            Hi everyone,

            This is Denise from the Bitbucket PM team. I’m excited to let you know that we’re starting work on improving audit logs. Our first milestone will deliver highly-requested Workspace, Project, and Repository administration and configuration events in Atlassian Access - Atlassian’s organization-wide subscription that enables enterprise-grade identity and access management and security features. Atlassian Access has a robust audit log feature complete with export and search capability, and an API for querying and retrieving events. You can get a 30-day free trial of Atlassian Access by following the instructions here.

            While we don’t yet have a specific timeline on the delivery, we plan to roll it out next quarter and will update the status here when we have additional details.

            Cheers,
            Denise

            Denise Garcia added a comment - Hi everyone, This is Denise from the Bitbucket PM team. I’m excited to let you know that we’re starting work on improving audit logs. Our first milestone will deliver highly-requested Workspace, Project, and Repository administration and configuration events in Atlassian Access - Atlassian’s organization-wide subscription that enables enterprise-grade identity and access management and security features. Atlassian Access has a robust audit log feature complete with export and search capability, and an API for querying and retrieving events. You can get a 30-day free trial of Atlassian Access by following the instructions here . While we don’t yet have a specific timeline on the delivery, we plan to roll it out next quarter and will update the status here when we have additional details. Cheers, Denise

            is there any update on this ticket?

            hemangdoshi added a comment - is there any update on this ticket?

            Ruchi Ookalkar added a comment - - edited

            Hi all,

            Thank you for your votes and comments on this suggestion.

            I am a designer on Bitbucket Cloud and will be conducting some research on audit logs. The Bitbucket Cloud team would like to invite you to take part in our upcoming customer research study to help us reimagine and improve audit logs in Bitbucket Cloud.

            Why we would like you to participate:

            • You are an admin on workspaces with 100 or more members
            • You are an admin or a security analyst who needs to access audit logs

            What’s involved in the research:

            • Sessions are one hour and conducted over video conference, so you can participate from anywhere around the globe.
            • During the research, we'll start with a general chat to get to know you, then we’ll ask some questions to guide the conversations.
            • As a token of our appreciation, you'll receive an e-gift card worth $100 USD within 5 days of completing your session.

            If you're interested in taking part, fill out this form.

            If you have any other questions at all, feel free to reply to this message. We look forward to meeting you!

            Cheers,

            Ruchi

            Ruchi Ookalkar added a comment - - edited Hi all, Thank you for your votes and comments on this suggestion. I am a designer on Bitbucket Cloud and will be conducting some research on audit logs. The Bitbucket Cloud team would like to invite you to take part in our upcoming customer research study to help us reimagine and improve audit logs in Bitbucket Cloud. Why we would like you to participate: You are an admin on workspaces with 100 or more members You are an admin or a security analyst who needs to access audit logs What’s involved in the research: Sessions are one hour and conducted over video conference, so you can participate from anywhere around the globe. During the research, we'll start with a general chat to get to know you, then we’ll ask some questions to guide the conversations. As a token of our appreciation, you'll receive an e-gift card worth $100 USD within 5 days of completing your session. If you're interested in taking part, fill out this form. If you have any other questions at all, feel free to reply to this message. We look forward to meeting you! Cheers, Ruchi

            Hello! I'm a BBC PM. My team is working on improving audit logging in Bitbucket. Thank you for providing examples of items you would like to see included in the feature - this is really helpful for us. We expect to release the improved audit logging feature in FY22 - I will update this when I have a better idea of when to expect it. 

            Gayatri Ramesh added a comment - Hello! I'm a BBC PM. My team is working on improving audit logging in Bitbucket. Thank you for providing examples of items you would like to see included in the feature - this is really helpful for us. We expect to release the improved audit logging feature in FY22 - I will update this when I have a better idea of when to expect it. 

            Josiah added a comment -

            We would also love to have this feature. It's available in github & gitlab, and it would be great if Bitbucket could reach feature parity. 

            Josiah added a comment - We would also love to have this feature. It's available in github & gitlab, and it would be great if Bitbucket could reach feature parity. 

            Still not seeing any integration with Atlassian Access. It's horrendously crude that we have to resort to copy/paste for providing compliance evidence to who has access to our source control,

            Cronje van Heerden added a comment - Still not seeing any integration with Atlassian Access. It's horrendously crude that we have to resort to copy/paste for providing compliance evidence to who has access to our source control,

              1c505570e116 Gayatri Ramesh
              ce214183770c raleighr3
              Votes:
              140 Vote for this issue
              Watchers:
              121 Start watching this issue

                Created:
                Updated: