Starburst (Trino) Query Audit Logs

Starburst (Trino) query audit logs is a feature that audits queries that users run natively in Starburst (Trino) and presents them in a universal format as Immuta audit logs. Users can view audit records for queries made in Starburst (Trino) against Immuta data sources on the audit page. Immuta audits the activity of Immuta users on Immuta data sources.

Requirements

• Starburst (Trino) integration with the Starburst or Trino plugin version 443 or newer, or Trino 435 with the Immuta Trino 435.1 plugin

• Starburst (Trino) tables registered as Immuta data sources

• Starburst (Trino) users registered as Immuta users: Note that the users' Starburst (Trino) usernames must be mapped to Immuta. Without this, Immuta will not know the users are Immuta users and will not collect audit events for their data access activity.

Store audit logs

By default Starburst (Trino) audit logs expire after 90 days. Export the universal audit model (UAM) logs to S3 or ADLS Gen 2, and store audit logs outside of Immuta in order to retain the audit logs long-term.

Audit schema

Each audit message from the Immuta platform will be a one-line JSON object containing the properties listed below.

Example audit record

{
  "id": "20240221_200952_00200_qhadw",
  "action": "QUERY",
  "actionStatus": "SUCCESS",
  "actor": {
    "name": "Taylor",
    "id": "[e-mail]",
    "identityProvider": "bim",
    "profileId": "13",
    "type": "USER_ACTOR"
  },
  "tenantId": "your-immuta.com",
  "targetType": "DATASOURCE",
  "targets": [
    {
      "type": "DATASOURCE",
      "id": "35",
      "name": "Tiny Lineitem",
      "technology": "STARBURST_TRINO"
    },
    {
      "type": "DATASOURCE",
      "id": "33",
      "name": "Tiny Orders",
      "technology": "STARBURST_TRINO"
    }
  ],
  "relatedResources": [],
  "auditPayload": {
    "type": "QueryAuditPayload",
    "version": 1,
    "queryId": "20240417_193813_00005_67mum",
    "query": "select c.name, o.clerk from tpch.tiny.customer c join tpch.tiny.orders o on c.custkey = o.custkey limit 10",
    "startTime": "2024-04-17T19:38:13.651Z",
    "endTime": "2024-04-17T19:38:14.068Z",
    "duration": 417.00005531311035,
    "objectsAccessed": [
      {
        "name": "\"tpch\".\"tiny\".\"customer\"",
        "datasourceId": "17",
        "databaseName": "tpch",
        "schemaName": "tiny",
        "type": "LOGICAL_TABLE",
        "columns": [
          {
            "name": "custkey",
            "tags": [],
            "securityProfile": {
              "sensitivity": {
                "score": "NONSENSITIVE"
              }
            },
            "inferred": true
          },
          {
            "name": "name",
            "tags": [
              {
                "type": "TAG",
                "name": "Discovered.Entity.Person Name",
                "id": "104",
                "source": "curated",
                "context": "manual",
                "deleted": false,
                "transient": false
              },
              {
                "type": "TAG",
                "name": "DSF.Control.Personal",
                "id": "116",
                "source": "curated",
                "context": "manual",
                "deleted": false,
                "transient": false
              },
              {
                "type": "TAG",
                "name": "RAF.Confidentiality.Medium",
                "id": "21882",
                "source": "curated",
                "context": "framework",
                "deleted": false,
                "transient": false,
                "framework": {
                  "id": "9144acdd-f92e-4324-bcd4-d22e49dd895e",
                  "version": "d37671bc-58ef-906f-19b0-daf7ce32e878",
                  "name": "Risk Assessment Framework",
                  "measures": {
                    "sensitivity": "SENSITIVE"
                  }
                }
              }
            ],
            "securityProfile": {
              "sensitivity": {
                "score": "SENSITIVE"
              }
            },
            "inferred": true
          }
        ],
        "tags": [],
        "securityProfile": {
          "sensitivity": {
            "score": "SENSITIVE"
          }
        },
        "directlyReferenced": true
      },
      {
        "name": "\"tpch\".\"tiny\".\"orders\"",
        "datasourceId": "13",
        "databaseName": "tpch",
        "schemaName": "tiny",
        "type": "LOGICAL_TABLE",
        "columns": [
          {
            "name": "clerk",
            "tags": [],
            "securityProfile": {
              "sensitivity": {
                "score": "NONSENSITIVE"
              }
            },
            "inferred": true
          },
          {
            "name": "custkey",
            "tags": [],
            "securityProfile": {
              "sensitivity": {
                "score": "NONSENSITIVE"
              }
            },
            "inferred": true
          }
        ],
        "tags": [],
        "securityProfile": {
          "sensitivity": {
            "score": "NONSENSITIVE"
          }
        },
        "directlyReferenced": true
      }
    ],
    "technologyContext": {
      "trinoUsername": "[e-mail]",
      "immutaPluginVersion": "444",
      "rowsProduced": 10,
      "type": "TrinoContext"
    }
  },
  "eventTimestamp": "2024-02-21T20:09:52.000Z",
  "receivedTimestamp": "2024-02-21T20:09:53.599Z"
}

Limitations

• objectsAccessed is not available with Hive or Iceberg views.

• columnsAccessed will include columns related to the query that were not actually accessed in some cases:

  • For row access policies that rely on a column in the queried table, even if that column was not a part of the query, it will be included in the columnsAccessed.

  • For conditional masking, if the policy protects a column accessed, then the conditional column will be included in the columnsAccessed.