I found that when someone put Youtube link in a board, both “File downloaded from a board” and “File uploaded to a board” log were recorded in the audit log as below;
- File uploaded to a board: "type": "url", "object": "https://youtu.be/..." (youtube link)
- File downloaded from a board: "object": "hqdefault.jpg" (which seems youtube thumbnail image).
Since neither file uploads nor downloads are actually performed, I think it is preferable that neither be recorded.
Thank you!
FYI:
Our customer frequently check audit log (especially download and upload file log) in order to ensure miro is used safely. They believe that detecting file uploads and downloads helps reduce the risk of sensitive information leaks.
However, due to the above problems, they are confusing which download/upload log should be detected or not.
