Skip to main content

Mission: Operational Auditing, System Health, and Maintenance

Rohit Kalbag
Updated
Abstract

Use the Copilot Intent Bar to ask questions about system state or use the logs, sessions, and overview metrics.

Overview

Cipherscale transforms operational, system health, and maintenance tasks into an active conversation. In traditional systems, finding out specific status and operational data requires manually filtering through rows of log and session data. In Cipherscale, you use the Intent Bar to ask natural language questions about the state of your network or use the UI Detail Pane to glance at the latest information.

Executing System Health and Other Operational Tasks

You can query the real-time status of users, gateways and resources to gain immediate situational awareness. You can ask any questions that get captured in logs. For example, audit logs. Some interaction examples are below.

Interaction Flow For Online User Status 

Step

Participant

Action/Content

1. The Prompt

Admin

“how many users are online”

2. The Insight

AI Copilot

"Let me check the current online users for you.

Here's the current user status overview:

  • Total Users: 27

  • 🟢 Online: 1

  • 🔴 Offline: 25

  • ⚠️ Expired: 1

Currently online user:

Email

user1@cipherscale.com

3. Follow Up

AI Copilot

"Let me know if you'd like more details about any specific user!"
Interaction Flow For Last Configuration Check

Step

Participant

Action/Content

1. The Prompt

Admin

“what was the last configuration change made and by whom”

2. The Insight

AI Copilot

Let me check the audit logs for the most recent configuration change.

Here's the most recent configuration change:

🕐 Last Configuration Change

  • What: Policy reordering — the priority/execution order of 3 SaaS policies was modified

  • Who:John Smith(js@cipherscale.com)

  • When:April 24, 2026 at 00:53:03 UTC

Policies reordered:

#

Policy ID

1

64fcf709-f0e3-481d-b4e8-b335fbf990d7

2

c35f4311-33c6-4a0c-a948-d31819c6d33e

3

546e951e-b6fa-4dba-82f0-5fd7e09ba0e5

3. Follow Up

AI Copilot

"Would you like more details about any of these policies or other recent changes?"
Interaction Flow For Error Investigation 

Step

Participant

Action/Content

1. The Prompt

Admin

“are there any error logs or unusual session logs”

2. The Insight

AI Copilot

Let me check for error logs and unusual session activity across your gateways.

Here's a comprehensive summary of the error and unusual session logs:

🔍 Error & Unusual Session Log Report
⚠️ Device Connectivity Issues

User

Device

Date

Issue

Pattern

User 1

macOS

Apr 9, 2026

Device unreachable (~54 min)

Extended outage

User 2

Android

Mar 16, 2026

Device unreachable / disconnected

3 failures in 35 seconds

User 3

macOS

Mar 3, 2026

Device disconnected

3 disconnections

User 3

Windows

Feb 24, 2026

Device disconnected

4 disconnections

User 4

Windows

Various

Device disconnected

2 disconnections

🔴 User 2's Android shows the most unusual pattern — 3 rapid reconnection attempts within 35 seconds, suggesting network instability or a device configuration issue.

🚫 Access Denial Events

User

Resource Denied

Date

User 1

CIDR Test Resource, File Server, Stas test SaaS

Apr 9, 2026

User 11

CIDR Test Resource

Apr 8, 2026

User 11

File Server

Apr 8, 2026

User 11

Test SAAS IP Address (later deleted)

Apr 10, 2026

User 2

Stas test SaaS

Mar 16, 2026

✅ All denials are policy-enforced — no unauthorized access attempts detected.

🌐 Gateway Status

Status

Count

✅ Online

1

⚠️ Offline

2

⏳ Pending Deployment

2

❌ Error State

0
✅ Overall Security Assessment

  • No critical security threats — no failed authentications or unauthorized access

  • All access denials are expected policy enforcement behavior

  • Connectivity issues appear network-related, not security-related

  • Audit trail is clean and properly logged

📋 Recommendations

  1. Investigate the 2 offline gateways — they may be impacting user connectivity

  2. Follow up with User 2 regarding repeated rapid disconnections on their Android device

  3. Review why User 1 is denied access to CIDR Test Resource and File Server — they may need updated policy permissions

3. Follow Up

AI Copilot

“Would you like me to dig deeper into any of these findings or take any action?”

System Health Example Prompts

Gateways & Connectivity

  • "How many gateways are online right now?"

  • "Show me the status of all gateways"

  • "Are there any gateways in an error state?"

  • "Which gateways are offline or pending deployment?"

  • "Analyze the event logs for gateway [name]"

Users & Devices

  • "How many users are currently online?"

  • "Show me all users and their connection status"

  • "Which devices are inactive or unreachable?"

  • "Are there any users with expired accounts?"

  • "Show me the last connection time for all users"

Resources & Policies

  • "List all resources and their assigned gateways"

  • "Are there any resources with no gateway assigned?"

  • "Show me all policies and their current status"

  • "Are there any policies with no admission rules?"

Operational Auditing Example Prompts

Access & Session Logs

  • "Are there any error logs or unusual session logs?"

  • "Show me all access denial events from the last week"

  • "Which users have had repeated connection failures?"

  • "Show me all sessions for [user email]"

  • "Analyze logs for any rapid reconnection attempts"

Configuration Changes

  • "What was the last configuration change made and by whom?"

  • "Show me all recent audit log events"

  • "Who created or deleted a policy recently?"

  • "Have any resources been deleted recently?"

  • "Show me all changes made by [user email]"

Access Control Review

  • "Which users have access to [resource name]?"

  • "What policies apply to the [group name] group?"

  • "Are there any users with no group assigned?"

  • "Which groups have Admin or Owner roles?"

  • "What admission rules are currently active?"

Maintenance Example Prompts

User & Group Management

  • "List all users who haven't connected in the last 30 days"

  • "Show me users who are not part of any group"

  • "Invite [email] to group [name]"

  • "Remove [email] from group [name]"

  • "Update the max device limit for [user email]"

Gateway Maintenance

  • "Deploy gateway [name] to [GCP/AWS/Azure]"

  • "Shut down gateway [name]"

  • "Assign gateway [name] to resource [name]"

  • "Unassign gateway [name] from resource [name]"

  • "Generate a deployment script for gateway [name]"

Policy & Resource Cleanup

  • "List all policies that have no source group or user assigned"

  • "Show me all resources with no associated policies"

  • "Delete resource [name]"

  • "Update the admission rule on policy [name] to [rule name]"

  • "Reorder policies for [PRIVATE/SAAS/INTERNET] type"

Device Management

  • "Show me all devices for [user email]"

  • "Deactivate device [device name]"

  • "List all inactive devices across all users"

System State & Verification

You can use the dashboard and detail pane views to quickly look at the status and recent log entries as an alternative to use of prompts.

The Overview tab provides high-level status widgets. The Seats card, Users card, Gateways card, and Resources card visually display status metrics for various entities configured in your space. Instructions to view logs are below:

  • To view the logs for a specific gateway, navigate to Gateways, click the row of the specific gateway you want to investigate, and select the Sessions tab.

  • To find User and Gateway session logs, navigate to Overview and select Sessions from the Detail Ribbon. You can view the User and Gateway session logs by clicking the appropriate tab.

  • To view the audit logs that automatically track all configuration changes, navigate to Overview and select Logs from the Detail Ribbon.

Comments

0 comments

Article is closed for comments.