CB Response: When a user logs into the Web UI, where is this action logged?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

When a user logs into the Web UI, where is this action logged?

Environment

• CB Response Web UI: All versions
• CB Response Server: All versions
• CB Response Sensors: All versions

Resolution

This activity gets dynamically logged in the file /var/log/cb/audit/useractivity.log

2019-08-29 07:37:08: username='None' userid='None' ip='::ffff:192.168.1.85' status='403' method='GET' path='/api/auth' 
2019-08-29 07:37:08: username='None' userid='1' ip='::ffff:192.168.1.85' status='200' method='GET' path='/api/auth' 
2019-08-29 07:37:08: username='admin' userid='1' ip='::ffff:192.168.1.85' status='200' method='GET' path='/api/concurrent_license_info/20190730/20190829' 
2019-08-29 07:37:09: username='admin' userid='1' ip='::ffff:192.168.1.85' status='200' method='GET' path='/api/v1/user/preferences