Starburst Query Audit Logs
Public preview
This feature is currently in public preview and available to all accounts.
Starburst query audit logs is a feature that audits queries that users run natively in Starburst and presents them in a universal format as Immuta audit logs. Users can view audit records for queries made in Starburst against Immuta data sources on the audit page. Immuta audits the activity of Immuta users on Immuta data sources.
Requirements
- Starburst integration with the Starburst e438 plugin
- Starburst tables registered as Immuta data sources
- Starburst users registered as Immuta users: Note that the users' Starburst usernames must be mapped to Immuta. Without this, Immuta will not know the users are Immuta users and will not collect audit events for their data access activity.
Best practices: Store audit logs
By default Starburst (Trino) audit logs expire after 90 days. Export the universal audit model (UAM) logs to S3, and store audit logs outside of Immuta in order to retain the audit logs long-term.
Audit schema
Each audit message from the Immuta platform will be a one-line JSON object containing the properties listed below.
Property | Description | Example |
---|---|---|
action | The action associated with the audit log. | QUERY |
actor.type | The Immuta user type of the actor who made the query. | USER_ACTOR |
actor.id | The Immuta user ID of the actor who made the query. | taylor@starburst.com |
actor.name | The Immuta name of the user who made the query. | Taylor |
actor.identityProvider | The IAM the user is registered in. bim is the built-in Immuta IAM. |
bim |
actor.profileId | The profile ID of the user who made the query. | 10 |
actionStatus | Indicates whether or not the user was granted access to the data. Possible values are UNAUTHORIZED , FAILURE , or SUCCESS . Unauthorized access is not audited for Starburst (Trino), so this value will always be SUCCESS . |
SUCCESS |
eventTimestamp | The time the query occurred. | 2023-06-27T11:03:59.000Z |
id | The unique Immuta ID of the audit record. This will match the Trino query ID. | 20240221_200952_00200_qhadw |
tenantId | The Immuta SaaS tenant ID. | your-immuta.com |
targetType | The type of targets affected by the query; this value will always be DATASOURCE . |
DATASOURCE |
targets | A list of the targets affected by the query. | See the example below |
auditPayload.type | The type of audit record; this value will always be: QueryAuditPayload . |
QueryAuditPayload |
auditPayload.queryId | The unique Trino ID of the query. | 20240221_200952_00200_qhadw |
auditPayload.query | The command text of the query that was run in the integration. Immuta truncates the query text to the first 2048 characters. | select * from lineitem l join orders o on l.orderkey = o.orderkey limit 10 |
auditPayload.technologyContext.type | The technology the query was made in. | TrinoContext |
auditPayload.technologyContext.trinoUsername | The Starburst user ID for the user who made the query. | taylor@starburst.com |
auditPayload.technologyContext.immutaPluginVersion | The version of the Immuta plugin in Starburst. | 437-SNAPSHOT |
auditPayload.version | The version of the audit event schema. | 1 |
receivedTimestamp | The timestamp of when the audit event was received and stored by Immuta. | 2023-06-27T15:18:22.314Z |
Example audit record
{
"id": "20240221_200952_00200_qhadw",
"action": "QUERY",
"actionStatus": "SUCCESS",
"actor": {
"name": "Taylor",
"id": "taylor@starburst.com",
"identityProvider": "bim",
"profileId": "13",
"type": "USER_ACTOR"
},
"tenantId": "your-immuta.com",
"targetType": "DATASOURCE",
"targets": [
{
"type": "DATASOURCE",
"id": "35",
"name": "Tiny Lineitem",
"technology": "STARBURST_TRINO"
},
{
"type": "DATASOURCE",
"id": "33",
"name": "Tiny Orders",
"technology": "STARBURST_TRINO"
}
],
"relatedResources": [],
"auditPayload": {
"type": "QueryAuditPayload",
"version": 1,
"queryId": "20240221_200952_00200_qhadw",
"query": "select * from lineitem l join orders o on l.orderkey = o.orderkey limit 10",
"startTime": "2024-02-21T20:09:52.000Z",
"endTime": null,
"duration": null,
"technologyContext": {
"trinoUsername": "taylor@starburst.com",
"immutaPluginVersion": "437-SNAPSHOT",
"type": "TrinoContext"
},
"objectsAccessed": [],
"securityProfile": {
"sensitivity": {
"score": "INDETERMINATE"
}
}
},
"eventTimestamp": "2024-02-21T20:09:52.000Z",
"receivedTimestamp": "2024-02-21T20:09:53.599Z"
}