Security logs: delete old user security logs

[stsewd]

Delete all logs that aren't attached to an organization, this is since those logs should be deleted according to their plan on .com.

Logs that aren't attached to an organization are logs from authentication to the dashboard, aka user security logs.

[humitos]

Looks good to me! I just want to be sure if we don't want to save audit logs for different periods of time based on the organization's plan the user belongs to.

[humitos]

Shouldn't we keep audit logs longer for users belonging to organizations with bigger plans?

[stsewd]

The logs we are deleting are related to actions of the user outside the organization, especially auth and auth failures to the dashboard. This type of information isn't visible to the organization owners currently.

We could show this type of activity to the org owners (just of members of the org), but those are outside the organization, so not sure if that makes sense to show to org owners since it isn't related to activity done on the organization.

[humitos]

I think it's important to keep this data in the database. It could be useful for organization's owners, in particular, if they think they are being attacked and trying to log in with different accounts from their employees to gain access to unauthorized documentation.

Also, if the organization wants to audit when they users logging for the last time or similar, it's data they should have access to.

So, I'd personally tie these retention days to the same day of the plan the organization is paying for.

[ericholscher]

Yea, I'd be 👍 on using the organization plan here, so users get the benefit of the organization's longer subscription time. I think this makes the most sense.

[stsewd]

I have overridden this task on .com, since there is code there that I'm using, but I'll move that code to .org soon. This PR still needs to be merged, it does the deletion for logs from .org where we don't have organizations, the other PR on .com overrides this.

[humitos]

Cool! I think we should have all the code in just one project (here) and check for RTD_ALLOW_ORGANIZATION to decide what's the logic to run on each case.

[ericholscher]

Moving to next release. @stsewd looks like this just needs a small update.

[humitos]

Cool! I think we should have all the code in just one project (here) and check for RTD_ALLOW_ORGANIZATION to decide what's the logic to run on each case.