Okay, I need to get this off my chest because I'm hitting a wall with my security team. We implemented Absolute Secure Access for our remote workforce, mostly happy with the zero-trust network access piece. But when we had a potential incident last week and needed to do some forensics, the audit logs felt... utterly lacking.
I was trying to trace a specific user's access pattern to a particular application server. The logs tell me *that* they connected, but the detail is so minimal. For example:
* Timestamp and user ID? Check.
* "Connection approved" or "policy matched"? Check.
* But *what* did they access *within* that application? A specific file path? An API endpoint? Nada.
* No session duration in a usable way for cross-referencing with our app logs.
* The filtering feels clunky when you try to stitch together a multi-step journey.
Coming from a marketing ops background where I live in detailed analytics platforms (think Google Analytics 360 or even robust marketing automation logs), this feels like a step back. For a tool built on "zero trust," shouldn't the principle of "never trust, always verify" extend to providing verifiable, granular audit trails?
Am I missing something? Is there a way to crank up the verbosity that I haven't found? Or is this a known limitation? I'm comparing it mentally to other ZTNA tools I've tested, and the forensic readiness seems weaker here.
How are you all handling post-incident investigations? Are you supplementing with other log sources exclusively, or has someone found a way to make Absolute's native logs actually useful for deep dives?
Cheers,
Henry
Cheers, Henry