Cognos Analytics (CA) with Unified and Granular Security Audit Logging for Compliance with QRADAR

Business Context:

As an enterprise customer operating in a regulated industry, we are required to meet strict IT security audit standards (e.g., ISO 27001, SOC2, GDPR). Currently, auditing capability across the IBM Cognos Analytics is fragmented. Logs are scattered across SQL Audit Tables, text files and container logs, with inconsistent formats. Crucial security events—specifically regarding configuration changes and failed access attempts—are often missing or difficult to extract.

Proposed Solution:

We request a unified, structured audit mechanism (accessible via REST API or a dedicated Audit Database) that explicitly captures the security events for Cognos Analytics (CA). The goal is to access these logs from QRADAR.

There is already a separate RFE created with wider scope of IBM software including CA, TM1, PAW https://ideas.ibm.com/ideas/PAOC-I-1931 and assigned to Planning Analytics (PA) team.

This idea is created explicitly for Cognos Analytics (CA) to make sure it will be supported by CA team.

Detailed Requirements:

The system must generate immutable audit log entries for the following specific scenarios:

1. Session & Token Errors:
   • Requirement: Log events for invalid/expired tokens, non-existent accounts, or attempts to access non-existent resources (404/401 errors).
   • Current Gap: Often buried in debug logs or transient container logs, not in the Audit Store.
2. Authorization Failures:
   • Requirement: Explicit logging of "Access Denied" events – attempts to access resources (cubes, reports, folders) without sufficient permissions.
   • Current Gap: TM1 often hides read-access failures; CA audit logs focus on successful runs.
3. Authentication Events:
   • Requirement: structured entries for all successful/failed logins and explicit logouts.
4. Group & Role Management:
   • Requirement: Audit trails for adding/removing users from groups, renaming groups, and changing role capabilities.
   • Context: Needs to cover both Cognos Namespace changes and TM1 }ClientGroups changes in a unified view.
5. User Account Modification:
   • Requirement: Logging of changes to user metadata (email, locale), password changes (if native), and account deletion.
6. User Administration:
   • Requirement: Full audit trail of user creation, modification, and deletion by administrators.
7. System Configuration Changes (Critical):
   • Requirement: Log ANY change to system configuration files (e.g., tm1s.cfg, PAW Administration Tool settings, Cognos Configuration dispatcher settings).
   • Current Gap: Currently, changing a tm1s.cfg parameter is rarely audited within the application logs itself.
8. Logging Configuration Changes:
   • Requirement: Audit events when logging levels are changed (e.g., stopping logging, clearing event logs, changing verbosity).
   • Why: To prevent "covering tracks" by disabling logs before malicious actions.
9. Critical System Actions:
   • Requirement: Logs for module/service shutdowns, mass data deletion (Clear Cube / Clear Database), factory resets, or firmware/patch updates.
10. Encryption & Key Management:
    • Requirement: Log changes to encryption configurations, SSL certificate renewals/replacements, and cryptographic key rotations.
11. Log Integrity:
    • Requirement: An alert/log entry generated if audit logs are manually deleted or purged (Audit the Auditor).

Business Value:

Implementing these requirements will allow customers to easily integrate IBM Cognos Analytics with SIEM tools (QRadar) and pass security audits without custom workarounds.