Audit logs: missing status (#25906)

- Add missing `status` for `installed_app_store_app`
- @noahtalerman: @iansltx and I tested the `installed_app_store_app`
activity and saw that the docs are missing `status`
- Clarify that `_software` activities are for Fleet-maintained apps and
custom packages
This commit is contained in:
Noah Talerman 2025-02-03 16:16:58 -05:00 committed by GitHub
parent dcc94cd534
commit f6b06a9578
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 28 additions and 26 deletions

View file

@ -1178,7 +1178,7 @@ This activity contains the following fields:
## installed_software
Generated when a software is installed on a host.
Generated when a Fleet-maintained app or custom package is installed on a host.
This activity contains the following fields:
- "host_id": ID of the host.
@ -1210,7 +1210,7 @@ This activity contains the following fields:
## uninstalled_software
Generated when a software is uninstalled on a host.
Generated when a Fleet-maintained app or custom package is uninstalled on a host.
This activity contains the following fields:
- "host_id": ID of the host.
@ -1233,7 +1233,7 @@ This activity contains the following fields:
## added_software
Generated when a software installer is uploaded to Fleet.
Generated when a Fleet-maintained app or custom package is added to Fleet.
This activity contains the following fields:
- "software_title": Name of the software.
@ -1270,7 +1270,7 @@ This activity contains the following fields:
## edited_software
Generated when a software installer is updated in Fleet.
Generated when a Fleet-maintained app or custom package is edited in Fleet.
This activity contains the following fields:
- "software_title": Name of the software.
@ -1307,7 +1307,7 @@ This activity contains the following fields:
## deleted_software
Generated when a software installer is deleted from Fleet.
Generated when a Fleet maintained app or custom package is deleted from Fleet.
This activity contains the following fields:
- "software_title": Name of the software.
@ -1449,14 +1449,15 @@ This activity contains the following fields:
Generated when an App Store app is installed on a device.
This activity contains the following fields:
- host_id: ID of the host on which the app was installed.
- self_service: App installation was initiated by device owner.
- host_display_name: Display name of the host.
- software_title: Name of the App Store app.
- app_store_id: ID of the app on the Apple App Store.
- command_uuid: UUID of the MDM command used to install the app.
- policy_id: ID of the policy whose failure triggered the install. Null if no associated policy.
- policy_name: Name of the policy whose failure triggered the install. Null if no associated policy.
- "host_id": ID of the host on which the app was installed.
- "self_service": App installation was initiated by device owner.
- "host_display_name": Display name of the host.
- "software_title": Name of the App Store app.
- "app_store_id": ID of the app on the Apple App Store.
- "status": Status of the App Store app installation.
- "command_uuid": UUID of the MDM command used to install the app.
- "policy_id": ID of the policy whose failure triggered the install. Null if no associated policy.
- "policy_name": Name of the policy whose failure triggered the install. Null if no associated policy.
#### Example

View file

@ -1646,7 +1646,7 @@ func (a ActivityTypeInstalledSoftware) WasFromAutomation() bool {
}
func (a ActivityTypeInstalledSoftware) Documentation() (activity, details, detailsExample string) {
return `Generated when a software is installed on a host.`,
return `Generated when a Fleet-maintained app or custom package is installed on a host.`,
`This activity contains the following fields:
- "host_id": ID of the host.
- "host_display_name": Display name of the host.
@ -1687,7 +1687,7 @@ func (a ActivityTypeUninstalledSoftware) HostIDs() []uint {
}
func (a ActivityTypeUninstalledSoftware) Documentation() (activity, details, detailsExample string) {
return `Generated when a software is uninstalled on a host.`,
return `Generated when a Fleet-maintained app or custom package is uninstalled on a host.`,
`This activity contains the following fields:
- "host_id": ID of the host.
- "host_display_name": Display name of the host.
@ -1723,7 +1723,7 @@ func (a ActivityTypeAddedSoftware) ActivityName() string {
}
func (a ActivityTypeAddedSoftware) Documentation() (string, string, string) {
return `Generated when a software installer is uploaded to Fleet.`, `This activity contains the following fields:
return `Generated when a Fleet-maintained app or custom package is added to Fleet.`, `This activity contains the following fields:
- "software_title": Name of the software.
- "software_package": Filename of the installer.
- "team_name": Name of the team to which this software was added.` + " `null` " + `if it was added to no team." +
@ -1767,7 +1767,7 @@ func (a ActivityTypeEditedSoftware) ActivityName() string {
}
func (a ActivityTypeEditedSoftware) Documentation() (string, string, string) {
return `Generated when a software installer is updated in Fleet.`, `This activity contains the following fields:
return `Generated when a Fleet-maintained app or custom package is edited in Fleet.`, `This activity contains the following fields:
- "software_title": Name of the software.
- "software_package": Filename of the installer as of this update (including if unchanged).
- "team_name": Name of the team on which this software was updated.` + " `null` " + `if it was updated on no team.
@ -1810,7 +1810,7 @@ func (a ActivityTypeDeletedSoftware) ActivityName() string {
}
func (a ActivityTypeDeletedSoftware) Documentation() (string, string, string) {
return `Generated when a software installer is deleted from Fleet.`, `This activity contains the following fields:
return `Generated when a Fleet maintained app or custom package is deleted from Fleet.`, `This activity contains the following fields:
- "software_title": Name of the software.
- "software_package": Filename of the installer.
- "team_name": Name of the team to which this software was added.` + " `null` " + `if it was added to no team.
@ -2061,14 +2061,15 @@ func (a ActivityInstalledAppStoreApp) WasFromAutomation() bool {
func (a ActivityInstalledAppStoreApp) Documentation() (string, string, string) {
return "Generated when an App Store app is installed on a device.", `This activity contains the following fields:
- host_id: ID of the host on which the app was installed.
- self_service: App installation was initiated by device owner.
- host_display_name: Display name of the host.
- software_title: Name of the App Store app.
- app_store_id: ID of the app on the Apple App Store.
- command_uuid: UUID of the MDM command used to install the app.
- policy_id: ID of the policy whose failure triggered the install. Null if no associated policy.
- policy_name: Name of the policy whose failure triggered the install. Null if no associated policy.
- "host_id": ID of the host on which the app was installed.
- "self_service": App installation was initiated by device owner.
- "host_display_name": Display name of the host.
- "software_title": Name of the App Store app.
- "app_store_id": ID of the app on the Apple App Store.
- "status": Status of the App Store app installation.
- "command_uuid": UUID of the MDM command used to install the app.
- "policy_id": ID of the policy whose failure triggered the install. Null if no associated policy.
- "policy_name": Name of the policy whose failure triggered the install. Null if no associated policy.
`, `{
"host_id": 42,
"self_service": true,