Hi Folks,
We are a number of administrators managing Rapid7. There have been events when an administrator (unknown) has created a site/asset group that was not required. Would it be possible to trace the admin who did that?
Regards
You can log into the console and navigate to [install directory]/nexpose/nsc/logs/audit.log and there should be a line in there for the creation of those objects.
1 Like
Thank you so much, John. I did not receive a notification on my email that someone had replied, hence the late response 
Also, would I be able to grab the same information on SQL queries? Like, who created the scheduled SQL query that runs every month?
For that you can just go to the actual report itself in the reports tab and edit the report. Expand out the advanced settings and expand the Access section. It will list the report owner.
1 Like