Recently there has been a security breach incident on one of my clients' Qlik SaaS tenant, and as an aftermath auditing, they were looking for a detailed event logs on the sheet/chart accessing and download activities.
I dug through documentation on the APIs currently open on Qlik SaaS and it seems the most detailed level of accessing information was app session per user. While this is helpful, it could not really provide the information needed to narrow down the more detailed accessing activities so they could assess the situation.
I recall that Qlik Sense client-managed has very detailed engine logs that could provide such detailed information, such as excel data export activities.
Could I suggest the similar more detailed user accessing logging records (for a start, sheet/chart accessing and data export activities) also open on Qlik SaaS either through APIs or event logs in management console (user could turn on the more detailed logging feature but it's off by default)?
This would not only help with our situation and future similar incidents, but also could give more confidence to customers in empowering them with more control and monitoring over what are happening in their tenants, which has always been a pain point in general when it comes to switching from client-managed to SaaS.
