Policy Violation Log
The policy violation log is located at ./log/policy-violation.log
. Each line is an independent unformatted JSON message representing a policy violation.
The policy violation log can be customized in your IQ Server configuration.
Note
For each policy violation log entry, each optional attribute will either be present with its name and value, or will not be present at all i.e. no name or value.
Policy Violation Event Attributes
Attribute name | Description | Example |
---|---|---|
| Why a policy violation event was generated:
| |
| When the policy violation event occurred formatted as an ISO 8601 date and time | |
| The id for the policy that the policy violation refers to | |
| The name of the policy that the policy violation refers to | |
| The threat category of the policy that the policy violation refers to being one of | |
| The threat level of the policy that the policy violation refers to is between 1 and 10 inclusive | |
| An array list detailing which properties of the component violated the policy. The reasons for the policy violation are expressed in natural language and subject to rewording in future versions. | |
| The stage that the policy violation occurred on i.e. one of | |
| (Optional - only if the policy violation is created ( | |
| (Optional - excluded if for a repository) The id of the organization that is the parent of the application that caused the policy violation event | |
| (Optional - excluded if for a repository) The name of the organization that is the parent of the application that caused the policy violation event | |
| (Optional - excluded if for a repository) The internal id of the application that caused the policy violation event | |
| (Optional - excluded if for a repository) The public id of the application that caused the policy violation event | |
| (Optional - excluded if for a repository) The name of the application that caused the policy violation event | |
| (Optional - excluded if for an application) The internal id of the repository that caused the policy violation event | |
| (Optional - excluded if for an application) The public id of the repository that caused the policy violation event | |
| (Optional) The coordinates of the component that originally caused the policy violation | |
| The hash of the component that originally caused the policy violation | |