Core features
Activity monitoring
Security Auditor observes selected activity available through the Gateway, including:
-
Classic client sessions, including Vision Client and Designer sessions visible to the Gateway.
-
Perspective sessions and authentication-related changes.
-
Authenticated Gateway web-session activity.
-
Project resource and project-save changes.
Observed information becomes available in the reporting interface after the relevant activity occurs. The module does not claim to be a complete replacement for platform audit history.
User access review
The reporting interface provides a user-focused view of access information assembled from observed activity. It can help administrators identify recent activity associated with a user and review available session and project-change context.
Privileged access monitoring
Administrators can configure:
-
Excluded Users: users permitted to hold a monitored privileged role.
-
Privileged Roles: roles that should be monitored.
-
Automated response: the action to take when the configured policy detects a violation.
-
Notification Methods: destinations for operational notifications.
Available responses include notification only, session termination, privileged-role removal where supported by the configured user source, or both actions. Because these actions can affect active users, notification-only operation should be validated before automated enforcement is enabled.
Reporting
Security Auditor provides reports for session activity, project-resource changes, user access, and combined activity. Administrators can review current information in the Gateway and use browser export where available.
The Report Builder can configure scheduled or manually initiated delivery through supported channels, including existing Gateway email profiles and configured external destinations.
Retention and archive export
The module can apply retention to selected audit records. When Export Before Pruning is enabled, it creates a protected archive before removing eligible records. If the archive cannot be produced, removal does not proceed.
Retention does not necessarily apply to every category of retained module information. Review the current retention policy and archive requirements before enabling pruning.
Privacy-oriented display
The Anonymize Personally Identifiable Information option reduces exposure of usernames and IP addresses in module displays, logs, and reports. It affects how information is presented; administrators should continue to protect the underlying Gateway, backups, and exported material according to their security policy.
Ignition integration
Security Auditor integrates with the Gateway scope and uses the standard Gateway administration experience. It provides a Security Auditor Services category with Configuration and Reports pages.
The module observes activity from existing Gateway-managed resources. It does not add a custom tag provider, OPC connection, device driver, scripting API, or custom Perspective/Vision component.
Operational behavior
The module starts its monitoring and operational services when enabled in the Gateway. Configuration and retained information are intended to remain available across ordinary module or Gateway restarts, while current in-memory observation state is rebuilt as activity resumes.
Delivery, external connectivity, and user-source operations depend on the Gateway environment and the destinations/configuration supplied by the administrator.