Tracking all workflow additions to an Alteryx collection

[SBK]

Hi team,

For audit reasons, I need to extract all records of users who added a workflow to a given collection, sort of an audit log to ensure developers are not adding unapproved apps to prod collections. I'm using MongoDB but I'm not sure where to find this data.

I am able to locate collections on one hand, and all revisions of a an application on the other, but I can't link the two. Can you please advise? 

Thanks!

[fmvizcaino · Accepted solution]

Hi @SBK ,

You have the option to use the Gallery APIs or MongoDB. In both cases, you will access the AuditEvents collection.

https://help.alteryx.com/20221/en/server/configure/mongodb-management/mongodb-schema-reference/alter...

The entity you are looking for is Collection.

You would see something like this as a result.

{
"entity": "Collection",
"entityId": "65fc3ce5771b145bea8afa0b",
"userId": "654b029b2d7ab4a3518621ad",
"timestamp": "2024-03-21T13:58:16.362Z",
"event": "update",
"oldValues": "{\"apps\":[]}",
"newValues": "{\"apps\":[{\"appId\":\"654b041f2d7ab4a35186222f\",\"dateAdded\":\"2024-03-21T13:58:16.3581254Z\",\"addedById\":\"654b029b2d7ab4a3518621ad\"}]}",
"id": "65fc3cf8771b145bea8afa10"
}

The appId is the workflowId.

Additional references:

https://help.alteryx.com/current/en/server/api-overview/alteryx-server-api-v1/auditlog-endpoint.html

https://knowledge.alteryx.com/index/s/article/How-to-determine-which-User-deleted-a-Gallery-applicat...

Best,

Fernando Vizcaino

[SBK]

Thank you so much, @fmvizcaino, this is perfect!

Just to make sure, for my audit requirement, I only need the entries where the NewValues starts with {"apps" and the audit event is either "Insert" or "Update", correct? 

[fmvizcaino]

That`s exactly right!

[SBK]

Thank you. I'm looking at the logs, and I see some "Update "entries have Newvalues as "{"@@ Count":2}}". 

Would those be deletions? If not, any idea what they mean please?

[fmvizcaino]

Hi @SBK ,

I did some tests and all inserts and deletions of workflows from collections generate an update log. So we are learning together here :)

What I have noticed is that you need to pay attention to both old and new values and the difference between both means that a workflow was added or deleted.

For example, here I deleted the workflowID 654b04432d7ab4a35186226b

{
"entity": "Collection",
"entityId": "65fc3ce5771b145bea8afa0b",
"userId": "654b029b2d7ab4a3518621ad",
"timestamp": "2024-03-21T15:37:34.735Z",
"event": "update",
"oldValues": "{\"apps\":{\"1\":{\"appId\":\"654b04432d7ab4a35186226b\",\"dateAdded\":\"2024-03-21T15:37:13.122Z\",\"addedById\":\"654b029b2d7ab4a3518621ad\"},\"@@ Count\":2}}",
"newValues": "{\"apps\":{\"@@ Count\":1}}",
"id": "65fc543e771b145bea8b0257"
}

Here I also deleted a workflow. WorkflowID 654b041f2d7ab4a35186222f

{
"entity": "Collection",
"entityId": "65fc5843771b145bea8b03e1",
"userId": "654b029b2d7ab4a3518621ad",
"timestamp": "2024-03-21T15:55:34.293Z",
"event": "update",
"oldValues": "{\"apps\":{\"0\":{\"appId\":\"654b041f2d7ab4a35186222f\",\"dateAdded\":\"2024-03-21T15:54:48.877Z\"},\"1\":{\"appId\":\"654b04372d7ab4a35186225e\",\"dateAdded\":\"2024-03-21T15:54:52.763Z\",\"addedById\":\"654b029b2d7ab4a3518621ad\"},\"@@ Count\":2}}",
"newValues": "{\"apps\":{\"0\":{\"appId\":\"654b04372d7ab4a35186225e\",\"dateAdded\":\"2024-03-21T15:54:52.763Z\"},\"@@ Count\":1}}",
"id": "65fc5876771b145bea8b03ee"
}

Here I added the workflowID 654b04372d7ab4a35186225e

{
"entity": "Collection",
"entityId": "65fc5843771b145bea8b03e1",
"userId": "654b029b2d7ab4a3518621ad",
"timestamp": "2024-03-21T15:54:52.763Z",
"event": "update",
"oldValues": "{\"apps\":{\"@@ Count\":1}}",
"newValues": "{\"apps\":{\"1\":{\"appId\":\"654b04372d7ab4a35186225e\",\"dateAdded\":\"2024-03-21T15:54:52.7636707Z\",\"addedById\":\"654b029b2d7ab4a3518621ad\"},\"@@ Count\":2}}",
"id": "65fc584c771b145bea8b03ea"
}

The bottom line is that you always have to check the count in both new and old values to know if a workflow is being added or deleted. I`m not sure why sometimes Alteryx shows all IDs and sometimes it doesn`t, but I`d say you will always have to compare the Ids to see what is missing/deleted.

Best,

Fernando Vizcaino

[SBK]

Thank you, this really helped. It also inspired me to do my own bit of testing, and I came to the below conclusions:

- The insert/delete event only shows if a new collection is added or deleted. Everything else that is workflow related is an update.

- Adding or removing workflows to a collection results in a count change between the old and the new value.

Example: If you delete a workflow, "@@ Count":2} becomes "@@ Count":1}

I still have to decode the Newvalues field to extract the different columns, but sharing in case it helps someone. 

Thanks again for your help @fmvizcaino