Income Media: CRM Security Log and Audit

What this solution does

The CRM Security Log module maintains a complete audit trail of employee actions on system data, helping to detect customer base theft attempts in a timely manner.

The component records operations with contacts, deals, leads, and companies: creation, modification with logging of changed fields and their previous and new values, deletion, as well as bulk views and exports.

For each event, context is preserved: employee, role, IP address, device, source (web interface, REST API, or mobile application), action time, and record ownership status.

The system evaluates the risk of each action on a scale from 0 to 100 points and assigns a threat level: normal, suspicious, high, or critical, accompanied by a clear explanation of the reasons.

The anomaly detection mechanism operates based on each employee's individual baseline profile: atypical spikes in views or exports, work outside business hours, access from new IP addresses, and actions on records not owned by the user.

When incidents are detected, the system sends notifications to the responsible person via email and, if configured, to the portal, including an incident description and recommended actions.

The agent automatically removes old logs according to a configurable retention period.

The module is designed for business owners and managers to control access to the client database and detect signs of data exfiltration preparation. It identifies mass data exports prior to resignation, night-time operations, and access from unauthorized devices.

The Security section interface features a dashboard for activity overview and risk assessment. The event log records all operations with filters for employee, action type, entity, risk level, period, and IP address. Security alerts display suspicious activity with a counter for unread notifications. A user search function allows viewing the complete activity history of a specific employee.

Settings allow configuration of working hours, log retention period, notification channels (email or portal), and the risk level threshold for generating alerts.

Technical requirements:

Platform: 1C-Bitrix24 on-premise or Bitrix24 with the CRM module (crm).

Language: PHP 7.4 or higher.

Permissions: Administrator rights.

The module creates tables b_security_crm_log, b_security_crm_alert, b_security_crm_user_baseline, and a log rotation agent.

General iT can install and configure this module and check how it works on your website.