Posted in Marketing Cloud, Salesforce

Audit Trail in Marketing Cloud

Audit Trail is required in various scenarios even as part of compliance. Tracking user logins, changes made by the users to the roles and permissions and security settings is available as an additional feature (optional) in Salesforce Marketing Cloud. You can enable Audit Trail in Setup > Security > Security Settings. You can find “Enable Audit Logging Data Collection” – Enable it.

Marketing Cloud has two types of Audit Log – Access and Activity Log

Audit Trail Access Log

Gives the information about who tried to login to the system, number of attempts made, IP address of the login attempt and following information:

ColumnDescription
UserUser Identification
UserNameUsername of the user
AccessDateDate of Access
FromIPIP Address
SecurityEventTypeIDIdentified code for the below types
SecurityEventTypeLogin Attempted
Logout
Security Question Answered
Password Changed
Administrator Access
Administrator Unlock
Redirect
Security Setting Changed Impersonation
Request Authorization Code
Request Token
LoginStatusIDIdentifier code for the below status
LoginStatusNameSuccessful
Logout
AccountDisabled
Failed
MustChangePassword
NotSet
UserAccountDisabled
InMaintenance
UsernamePasswordLock
SecurityQuestionAnswerLock
BusinessUnitDisabled
SystemDBUnavailable
AccountLocked
FailedNotOnWhitelist
FailedInvalidActivationLink
FailedDeviceNotActivated
FailedDeviceNotActivateNeedMobile
FailedSsoOnlyLogin
SecurityActivationCodeLock
MustChangePasswordNoIDV
InvalidCasApplication
AppNotAuthorized
Session IDThe session ID associated with the access event. This is represented by a unique GUID. This column is only available to Advanced Audit Trail users.
UserAgentThe session ID associated with the access event. This is represented by a unique GUID. This column is only available to Advanced Audit Trail users.
Event SourceThe source of the access event. This column is only available to Advanced Audit Trail users.
Source: Security Action Audit Log

Audit Trail Activity Log

Lists the changes made in the system with the data about who has done it. It has the following information:

ColumnDescription
CreatedDateDate and time of the security action.
EIDThe Enterprise ID that represents the top-level account or business unit ID.
MIDThe Member ID that represents the account or business unit ID.
UserIDThe ID of the user performing the security action.
EmployeeIDThe ID of the employee performing the security action.
EmployeeNameThe name associated with the employee.
ObjectTypeIDThe ID of the Marketing Cloud object.
ObjectTypeNameThe name of the Marketing Cloud object associated to the ObjectTypeID.
OperationIDThe ID of the Marketing Cloud operation being performed against the Marketing Cloud object.
OperationNameThe name of the Marketing Cloud operation being performed against the Marketing Cloud object associated to the OperationID.
ObjectIDThe specific ID of the object that is the subject of the security action.
ObjectNameThe name of the object that is the subject of the security action associated with the ObjectID.
TransactionIDAn ID to represent related security actions.
Source: Security Event Audit Log

Marketing Cloud offers two types of Audit Trail – Basic and Advanced:

Basic Audit TrailAdvanced Audit Trail
AvailabilityEnable in SetupAvailable on request
AuditsUser Logins
Changes to Roles & Permissions
Changes to Security Settings
User Logins
Changes to Roles & Permissions
Changes to Security Settings
Data Extension (Import & Export)
Cloud Pages – Publish History
Group Connect Message Changes
Retention Period30 days60 days
CostAvailable generally to all
(From April 2019)
Paid
(From May 2019)

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s