Audit logging

Audit logging records each tool call on an Epicor instance: who called which tool, when, the outcome, how long it took and how much data came back. It is off by default and available on the Enterprise plan. Ask Cutova to enable it for your organization.

It never records tool inputs or results. A record holds the Epicor user, the tool name and type, the outcome, the Epicor status code on a failure, the duration, the result size and record count, a correlation id, and the time.

Turn it on for an instance

Open the instance and select the Audit logging tab. You see it once logging is enabled for your organization, and you need an Admin role.

• Logging level. Choose Basic to start recording. Off records nothing. Levels above your organization’s limit are shown but cannot be chosen. In this release Basic, Advanced and Full record the same information.
• Keep records for (days). From 0 to 30. Records older than this are deleted by a cleanup that runs about every six hours, so 0 means a record lasts until the next cleanup.
• Strict audit. When on, a tool call is refused if its record cannot be written. Leave it off unless an unrecorded call is worse for you than a refused one. It has no effect while the level is Off.

Click Save. Each change is written to your organization’s audit log.

When your organization limit is lowered

If Cutova lowers your organization’s limit below an instance’s saved level, the instance runs at the limit, and the tab says so. The saved level applies again if the limit is raised. To make the lower level permanent, click Use (level) as the saved level and save.

Register your SIEM

The Audit logging tab starts with a status line (logging level, retention, strict audit, SIEM) and three panels: Logging settings, SIEM destination and Activity. Open a panel to change it.

1. Open SIEM destination and click Add destination.
2. Pick your Service: SolarWinds (also Papertrail and Loggly), Sumo Logic, Better Stack, Datadog, New Relic, or Other syslog receiver for Splunk, Sentinel, QRadar, rsyslog and similar. Cutova fills in the port and the message format the service expects.
3. Enter a Name and the receiver’s Host. Change the Port if your service gives another.
4. Paste the service’s token or key. Paste only the token: Cutova adds the wrapper the service expects (for SolarWinds, [TOKEN@41058]).
5. Click Test connection. Cutova connects, checks the receiver’s certificate and sends one cutova.audit.test event. Confirm that your SIEM received it.
6. Click Save.

Advanced holds the TLS server name, a private CA certificate (when a public certificate authority does not sign the receiver’s certificate) and the source label, and the framing for Other syslog receiver. Custom as the service shows the raw structured-data, message-prefix and framing fields for a collector not in the list.

Your firewall must accept connections from Cutova. The receiver must have a public address: Cutova refuses private, loopback and link-local addresses, also when a DNS name resolves to one.

Event delivery

In this release, Cutova sends only the test event. Delivery of tool-call events to the destination arrives in a later release.

Collector settings

Most hosted collectors need a token in every message. The table shows what Cutova sends for each service; with Custom, enter these values yourself. Cutova stores tokens encrypted and never shows them again. If you change the host, port or TLS server name, enter the token again: Cutova does not send a saved token to a different receiver.

Collector	Host and port	Framing	Token field
SolarWinds Observability, Papertrail, Loggly	syslog.collector.<region>.cloud.solarwinds.com:6514 (from your setup page)	Octet counting	Structured data: [TOKEN@41058]
Sumo Logic (Cloud Syslog source)	syslog.collection.<deployment>.sumologic.com:6514	Octet counting	Structured data: [TOKEN] (the token already ends in @41123)
Better Stack	the ingesting host from your source, port 6514	Octet counting	Structured data: [logtail@11993 source_token="TOKEN"]
Datadog	intake.logs.datadoghq.com:10516 (US1; other sites differ)	Newline	Message prefix: your API key
New Relic	newrelic.syslog.nr-data.net:6514 (US)	Newline	Message prefix: your license key
Splunk, Microsoft Sentinel, QRadar, Graylog, Elastic, rsyslog, syslog-ng	your receiver	Octet counting. If events arrive joined together, set Framing to Newline under Advanced.	None

The vendor formats in this table come from each vendor’s own setup guide. If yours differs, follow the vendor’s guide; Test connection shows whether Cutova can reach the receiver, and your collector’s search shows whether it accepted the event.

Review and export the activity

The Activity section lists the newest 1,000 calls on the instance. Search by tool, Epicor user, outcome or entry point, and page through the results. Times are in your browser’s time zone.

Export CSV downloads the calls that match your search, with times in UTC. The file opens directly in Excel and Google Sheets.

An outcome of pending appears only with strict audit on: the call was admitted and its result has not been written yet, because it is still running or the result write failed.

If logging is turned off for your organization

Nothing new is recorded and the settings are hidden. The calls already recorded stay readable on the tab until they are older than the instance’s retention, then the cleanup deletes them.