dke category
This category of logs contains all the business requests concerning the Microsoft Double Key Encryption module feature (DKE).
setup action 
The setup action means that the DKE configuration is checked. It generates an "info" severity log if it is configured properly, or an "err" severity log in the event of an error.
The log fields for this action are as follows:
|
Field |
Description |
Type |
Mandatory/Optional |
|---|---|---|---|
|
tenant_id |
Tenant identifier. Example: 025f02fe-bee2-444b-bf76-b5ead30327c0 |
String in uuid v4 format | Mandatory |
| enabled | Specify if the DKE module is enabled. | Boolean | Mandatory |
| cache |
Specify if the cache is enabled and its duration. Example: { enable: true, duration_in_seconds: 3600 } |
Object | Mandatory |
| directory_tenant_id | Identifier of the Azure Purview tenant. | String in uuid v4 format | Mandatory |
| errors |
If the DKE module cannot be enabled due to an incorrect configuration, this JSON object contains an error list with an error code and a message:
Example: [ { code: 2002010, message: 'Module: dke not enabled for tenantId bc337abd-0d4f-43f9-aaf6-54ef7268d2e5. Reason: Validation failed. Reasons are: [Wrong type error: <tenant>/dke/authentication property must be array]' } ] |
Object |
Mandatory if enabled is set to true
|
get_key action
The get_key action means that a dke_get_key request has been made. This is the case whenever a public key is requested to encrypt a DEK.
This action generates an "info" severity log in the event of success, or an "err" severity log in the event of an error.
The log fields for this action are as follows:
|
Field |
Description |
Type |
Mandatory/Optional |
|---|---|---|---|
|
tenant_id |
Tenant identifier. Example: 025f02fe-bee2-444b-bf76-b5ead30327c0 |
String in uuid v4 format | Mandatory |
| kid | Identifier of the DKE KEK requested. Corresponds to the keyName in Microsoft DKE documentation. | String in uuidv4 format | Mandatory |
| version_id | Identifier of the version of the KEK used. Corresponds to the kid in Microsoft DKE documentation. | String in uuid v4 format | Mandatory |
| error |
JSON object that contains an error code and a message indicating why the public key could not be obtained: Example:
error: { code: 2032002, message: 'Invalid dke get key request params: should contain keyId with valid uuidV4' } |
Object | Mandatory only if "err" severity |
decrypt action
The decrypt action means that a dke_decrypt request has been made. This is the case whenever a Microsoft client needs to decrypt a key.
This action generates an "info" severity log in the event of success, or an "err" severity log in the event of an error.
The log fields for this action are as follows:
|
Field |
Description |
Type |
Mandatory/Optional |
|---|---|---|---|
|
tenant_id |
Tenant identifier. Example: 025f02fe-bee2-444b-bf76-b5ead30327c0 |
String in uuid v4 format | Mandatory |
| kid | Identifier of the DKE KEK requested. Corresponds to the keyNamein Microsoft DKE documentation. | String in uuid v4 format | Mandatory |
| version_id | Identifier of the version of the KEK used. Corresponds to the kid in Microsoft DKE documentation. | String in uuid v4 format | Mandatory |
| error |
JSON object that contains an error code and a message indicating why the public key could not be decrypted: Example: { error: { code: 2032002, message: 'Invalid dke decrypt request params: should contain keyId with valid uuidV4' } |
Object | Mandatory only if "err" severity |