Coralogix Audit

Open in ChatGPTOpen in Claude

Overview

Users with audit permissions can utilize Coralogix audit logs to monitor organizational activity within Coralogix, including all user actions and API operations. This tool empowers you to track actions, ensure compliance, and maintain transparency across your team or organization.

Use Coralogix Audit to:

• Audit data access: every log and metric read or search (via Logs Explorer, DataPrime, Lucene, templates, dashboards, alerts, or API) generates an audit event carrying the query, actor identity, auth type, and source IP.
• Track logins and authentication: user login events (user-account.login) and SSO verification steps are recorded, including the auth type used.
• Monitor team and account associations: attach and detach events are recorded whenever a team or account is linked to or removed from your tenant.
• Identify internal and service access: access by internal Coralogix services, OAuth apps, integrations, and API keys is captured with full attribution, including authType so you can distinguish interactive users from automated processes.
• Track configuration changes: before-and-after states are recorded for create, update, and delete operations on every supported resource.
• Create compliance analytics: query and visualize activity across your account by actor, feature group, auth type, and time range.

How it works

Audit events from your teams (the source teams) are routed to a single designated destination team (the audit team) where they're centralized for querying and analysis. With Audit v2, events are logged and delivered to the audit team in real time as they occur (e.g., when a query is executed or an API operation takes place). These events follow a standardized structure, ensuring efficient querying and compliance-focused analysis.

This page describes Audit v2, the current audit log structure. The earlier structure is covered in Deprecation of Audit v1 schema.

Note

Data ingestion events (sending logs, metrics, or traces to Coralogix) are not audited due to the volume of requests. Audit coverage applies to read, query, and configuration operations.

Permissions

To view or manage audit team settings, users must have the required permissions:

Resource	Description	System roles	API presets
TEAM-AUDITING:READCONFIG	View team audit settings.	Data Admin, Platform Admin	Auditing
TEAM-AUDITING:UPDATECONFIG	Manage your team audit settings.	Data Admin, Platform Admin	Auditing

Membership in the audit team allows you to view audit events.

Setup

Access audit settings

In the main menu, select Settings, then Audit. The page opens with the title Team audit log.

Audit log destination card

The Audit log destination card shows where audit logs from the current team are sent. A badge on the card indicates the current state:

Badge	Meaning
Active	Audit logs from this team are sent to the destination shown on the card.
Inactive	A destination is set, but audit logs from this team aren't being sent to it.
Not configured	No destination has been set yet.

Note

The audit log destination only controls where audit logs are routed, not whether audit data is collected. Audit data collection and datasets are configured in Dataspace Management.

To configure a destination:

1. Select Configure audit destination (first-time setup) or Change destination (to swap an existing destination).
2. In the Change audit log destination drawer, search for the team you want to use as the destination and select Set as destination.
3. In the confirmation dialog, select Change destination.

Use the toggle on the card to activate or deactivate sending audit logs without changing the destination.

Select View audit history on the card to open the destination team filtered to events from the current team. You are redirected to Explore.

Team members card

The Team members card lists members of the current team (the source team whose actions are being audited) not members of the destination audit team.

For each member you can:

• Filter by role or search by name and email.
• Select View user audit logs to open the destination team filtered to that user's events.

If no destination is configured, View user audit logs is unavailable.

Billing & usage

The audit team has a daily quota of up to 25 MB and a retention period of 7 days.

This quota should generally be sufficient for audit purposes. However, using the quota management CLI, you can increase it or reallocate it between teams if needed.

Configure your S3 archive to retain audit logs for longer periods. You can query these logs in Explore or use Background Queries for long-running queries.

Audit events structure

Events follow a unified structure, comprising an audit envelope and an audit payload. Payloads are standardized per event type (e.g., after for create, before/after for update, etc.).

Audit envelope

The envelope structure consists of the following fields:

Field	Description
auditVersion	Audit log structure version (e.g., v2, v3, etc.).
eventName	The name of the event reflects its related features and functionality.
cxFeature	The specific Coralogix feature the event data is related to.
cxFeatureGroup	Stable Coralogix feature groups, used as the subsystem name of each audit event.
eventKind	The type of the event (Action/Update/Delete/Create/Get/List). eventData payload structure is determined by this key.
endpointInfo	Provides connection information, like the protocol used to connect to the system, the IP address that sent the request, and the request protocol.
authDetails	Authentication details including the authType field (see below) and, depending on auth type, additional fields such as apiKeyId or apiKeyName.
actorDetails	Details about the actor responsible for the action (organization, user, or team).
eventData	The event payload, which contains details about the resources affected by the event and/or the resources themselves.
outcome	The logical outcome of the actions. Contains the outcome status and failure type if relevant.

Example

 {
    "endpointInfo":{
        "clientInfo":{
            "ipAddress": <ip_address>,
            "userAgent": <user_agent>
        },
        "protocol": "HTTP",
        "httpDetails": {
            "statusCode": 200
        }
    },
    "cxFeatureGroup": "metrics",
    "actorDetails": {
        "actorType": "User",
        "username": <username>,
        "teamId": <team_id>,
        "teamName": <team_name>,
        "orgName": <org_name>
    },
    "auditVersion": "v2",
    "eventData": { 
        ...
    },
    "eventKind": "Action",
    "eventName": "logs-data-api.ReadData",
    "authDetails": {
        "authType": <auth_type>,
        "apiKeyId": <api_key_id>,
        "apiKeyName": <api_key_name>,
        "apiKeyOwnerType": <api_key_owner_type>
    },
    "outcome": {
        "status": "Success",
        "statusMessage": "200 OK"
    },
    "cxFeature": "metrics.data-api"
}

Authentication types

The authDetails.authType field identifies how the actor authenticated. Use this field to distinguish interactive users from automated processes when querying audit logs.

authType value	Description
User Login	Interactive user session authenticated via the Coralogix UI or SSO.
Api Key	Request authenticated with a Coralogix API key. Additional fields: apiKeyId, apiKeyName, apiKeyOwnerType.
Oauth2Token	OAuth 2.0 token issued to a connected app or service-to-service integration.
Integration Token	Token used by a Coralogix-native integration (for example, a Slack app or internal notification job).
Internal Context	Internal Coralogix background service or scheduled job acting on behalf of a team. No user or API key is associated.

Audit payload

Event type

Each event type has a common payload structure, which is contained in the eventData field and is determined by the event type (eventKind field).

Note

Large payloads are converted to strings and contained in the stringifiedEventData field for increased indexing efficiency.

• Action

  Contains complex event data with varying structure.

• List

  Contains a filter field with the resource request.

  "eventData": {
    "filter": <query>
  }

• Get

  Contains an identifier of the received resource.

  "eventData":{
    "identifier": <resource_id>
  }

• Delete

  Contains the deleted resource.

  "eventData": {
    "data": {
      "displayName": <display_name>,
      "description": <description>,
      "filters": [
        ...
      ],
      "id": <resource_id>
    }
  }

• Create

  Contains the created resource.

  "eventData": {
    "data": {
      "data": { ... },
      "name": <created_resource_name>,
      "id": <resource_id>
    }
  }

• Update

  Contains the original and new versions of a resource.

  "eventData": {
    "before": { ... },
    "after": { ... }
  }

Event type per feature

The following tables list the audit events emitted by each Coralogix feature. For every feature, they show the eventName, its corresponding eventType, and the field type (eventKind) that determines the payload structure. Expand a feature to see the events it produces.

Coralogix custom actions

Event Name	Event Type	Field Type
actions.order	ACTION_EVENT_TYPE_ACTION_ORDER	Action
actions.list	LIST_EVENT_TYPE_ACTION_LIST	List
actions.get	GET_EVENT_TYPE_ACTION_GET	Get
actions.delete	DELETE_EVENT_TYPE_ACTION_DELETE	Delete
actions.create	CREATE_EVENT_TYPE_ACTION_CREATE	Create
actions.update	UPDATE_EVENT_TYPE_ACTION_REPLACE	Update

Access Policies

Event Name	Event Type	Field Type
access-policy.create	CREATE_EVENT_TYPE_ACCESS_POLICY	Create
access-policy.delete	DELETE_EVENT_TYPE_ACCESS_POLICY	Delete
access-policy.update	UPDATE_EVENT_TYPE_ACCESS_POLICY	Update
access-policy.list	LIST_EVENT_TYPE_ACCESS_POLICY	List
access-policy-targets.list	LIST_EVENT_TYPE_ACCESS_POLICY_TARGET	List

Alerts

Event Name	Event Type	Field Type
alert.snooze	ACTION_EVENT_TYPE_ALERT_SNOOZE	Action

alerts.list	LIST_EVENT_TYPE_ALERT	List
alerts.get	GET_EVENT_TYPE_ALERT	Get
alerts.delete	DELETE_EVENT_TYPE_ALERT	Delete
alerts.create	CREATE_EVENT_TYPE_ALERT	Create
alerts.update	UPDATE_EVENT_TYPE_ALERT	Update

Alert Scheduler

Event Name	Event Type	Field Type
alert_scheduler.list	LIST_EVENT_TYPE_ALERT_SCHEDULER	List
alert_scheduler.get	GET_EVENT_TYPE_ALERT_SCHEDULER	Get
alert_scheduler.delete	DELETE_EVENT_TYPE_ALERT_SCHEDULER	Delete
alert_scheduler.create	CREATE_EVENT_TYPE_ALERT_SCHEDULER	Create
alert_scheduler.update	UPDATE_EVENT_TYPE_ALERT_SCHEDULER	Update

API Keys

Event Name	Event Type	Field Type
api-key.get	GET_EVENT_TYPE_API_KEY	Get
api-key.delete	DELETE_EVENT_TYPE_API_KEY	Delete
api-key.create	CREATE_EVENT_TYPE_API_KEY	Create
api-key.update	UPDATE_EVENT_TYPE_API_KEY	Update
api-keys.list	LIST_EVENT_TYPE_API_KEY	List
team-api-keys-security-settings.update	UPDATE_EVENT_TYPE_API_KEY_SECURITY_SETTING	Update
api-key-roles.list	LIST_EVENT_TYPE_API_KEY_ROLE	List

APM

Event Name	Event Type	Field Type
apm.entity.action	ACTION_EVENT_TYPE_APM_ENTITY	Action
apm.entity.list	LIST_EVENT_TYPE_APM_ENTITY	List
apm.entity.get	GET_EVENT_TYPE_APM_ENTITY	Get
apm.entity.delete	DELETE_EVENT_TYPE_APM_ENTITY	Delete
apm.entity.create	CREATE_EVENT_TYPE_APM_ENTITY	Create
apm.settings.update	UPDATE_EVENT_TYPE_APM_SETTINGS	Update
apm.entity.update	UPDATE_EVENT_TYPE_APM_ENTITY	Update

Archive Setup

Event Name	Event Type	Field Type
archive-setup.get	GET_EVENT_TYPE_ARCHIVE_SETUP	Get
archive-setup.update	UPDATE_EVENT_TYPE_ARCHIVE_SETUP	Update
retentions.get	GET_EVENT_TYPE_RETENTIONS	Get
archive-setup.historical-targets.list	LIST_EVENT_TYPE_ARCHIVE_HISTORICAL_TARGETS	List
archive-setup.historical-targets.update	UPDATE_EVENT_TYPE_ARCHIVE_HISTORICAL_TARGETS	Update
retentions.activate	ACTION_EVENT_TYPE_ACTIVATE_ARCHIVE_RETENTION	Action
retentions.update	UPDATE_EVENT_TYPE_RETENTIONS	Update

Audit Teams

Event Name	Event Type	Field Type
auditing.attach-team	ACTION_EVENT_TYPE_AUDITING_ATTACH_TEAM	Action
auditing.audit-team.create	CREATE_EVENT_TYPE_AUDITING_AUDIT_TEAM	Create
auditing.audit-team.deactivate	ACTION_EVENT_TYPE_AUDITING_DEACTIVATE_AUDIT_TEAM	Action
auditing.audit-team.is-configured	ACTION_EVENT_TYPE_AUDITING_IS_TEAM_CONFIGURES	Action
auditing.audit-teams.list	LIST_EVENT_TYPE_AUDITING_AUDIT_TEAMS	List
auditing.detach-team	ACTION_EVENT_TYPE_AUDITING_DETACH_TEAM	Action

Background Queries

Event Name	Event Type	Field Type
background-queries.submit	ACTION_EVENT_TYPE_BACKGROUND_QUERIES_SUBMIT	Action
background-queries.status	ACTION_EVENT_TYPE_BACKGROUND_QUERIES_STATUS	Action
background-queries.get-data	ACTION_EVENT_TYPE_BACKGROUND_QUERIES_GET_DATA	Action
background-queries.cancel	ACTION_EVENT_TYPE_BACKGROUND_QUERIES_CANCEL	Action

Cases

Event Name	Event Type	Field Type
case.acknowledge	ACTION_EVENT_TYPE_CASE_ACKNOWLEDGE	Action
case.ai-summary.generate	ACTION_EVENT_TYPE_CASE_AI_SUMMARY_GENERATE	Action
case.alert-events.get-cases	ACTION_EVENT_TYPE_CASE_ALERT_EVENTS_GET_CASES	Action
case.alert-events.get-ids	ACTION_EVENT_TYPE_CASE_ALERT_EVENTS_GET_IDS	Action
case.analytics.get-available-filters	ACTION_EVENT_TYPE_CASE_ANALYTICS_GET_AVAILABLE_FILTERS	Action
case.analytics.get-metrics	ACTION_EVENT_TYPE_CASE_ANALYTICS_GET_METRICS	Action
case.analytics.get-overview	ACTION_EVENT_TYPE_CASE_ANALYTICS_GET_OVERVIEW	Action
case.assign	ACTION_EVENT_TYPE_CASE_ASSIGN	Action
case.bulk-acknowledge	ACTION_EVENT_TYPE_CASE_BULK_ACKNOWLEDGE	Action
case.bulk-assign	ACTION_EVENT_TYPE_CASE_BULK_ASSIGN	Action
case.bulk-close	ACTION_EVENT_TYPE_CASE_BULK_CLOSE	Action
case.bulk-priority-override.clear	ACTION_EVENT_TYPE_CASE_BULK_CLEAR_PRIORITY_OVERRIDE	Action
case.bulk-priority-override.set	ACTION_EVENT_TYPE_CASE_BULK_SET_PRIORITY_OVERRIDE	Action
case.bulk-resolve	ACTION_EVENT_TYPE_CASE_BULK_RESOLVE	Action
case.bulk-unassign	ACTION_EVENT_TYPE_CASE_BULK_UNASSIGN	Action
case.close	ACTION_EVENT_TYPE_CASE_CLOSE	Action
case.comments.create	ACTION_EVENT_TYPE_CASE_COMMENTS_CREATE	Action
case.comments.delete	ACTION_EVENT_TYPE_CASE_COMMENTS_DELETE	Action
case.comments.update	ACTION_EVENT_TYPE_CASE_COMMENTS_UPDATE	Action
case.deep-links.get	ACTION_EVENT_TYPE_CASE_GET_DEEP_LINKS	Action
case.events.get	ACTION_EVENT_TYPE_CASE_EVENTS_GET	Action
case.events.list	ACTION_EVENT_TYPE_CASE_EVENTS_LIST	Action
case.events.sync-external	ACTION_EVENT_TYPE_CASE_SYNC_EXTERNAL_EVENTS	Action
case.external-references.get	ACTION_EVENT_TYPE_CASE_GET_EXTERNAL_REFERENCES	Action
case.filter-values.get	ACTION_EVENT_TYPE_CASE_GET_FILTER_VALUES	Action
case.get	GET_EVENT_TYPE_CASE	Get
case.grouping-keys.get	ACTION_EVENT_TYPE_CASE_GET_GROUPING_KEYS	Action
case.list	LIST_EVENT_TYPE_CASE	List
case.notification-delivery.list	LIST_EVENT_TYPE_CASE_NOTIFICATION_DELIVERY	List
case.priority-override.clear	ACTION_EVENT_TYPE_CASE_CLEAR_PRIORITY_OVERRIDE	Action
case.priority-override.set	ACTION_EVENT_TYPE_CASE_SET_PRIORITY_OVERRIDE	Action
case.resolve	ACTION_EVENT_TYPE_CASE_RESOLVE	Action
case.system-defaults.get	ACTION_EVENT_TYPE_CASE_GET_SYSTEM_DEFAULTS	Action
case.unacknowledge	ACTION_EVENT_TYPE_CASE_UNACKNOWLEDGE	Action
case.unassign	ACTION_EVENT_TYPE_CASE_UNASSIGN	Action
case.update	UPDATE_EVENT_TYPE_CASE	Update
case.create	CREATE_EVENT_TYPE_CASE	Create
case.bulk-get	LIST_EVENT_TYPE_CASE_BULK_GET	List
case.link	ACTION_EVENT_TYPE_CASE_LINK	Action
case.links.get	GET_EVENT_TYPE_CASE_LINKS	Get
case.mute	ACTION_EVENT_TYPE_CASE_MUTE	Action
case.unmute	ACTION_EVENT_TYPE_CASE_UNMUTE	Action
case.unlink	ACTION_EVENT_TYPE_CASE_UNLINK	Action

Case team configuration

Event Name	Event Type	Field Type
case-team-config.create	CREATE_EVENT_TYPE_CASE_TEAM_CONFIG	Create
case-team-config.delete	DELETE_EVENT_TYPE_CASE_TEAM_CONFIG	Delete
case-team-config.get	GET_EVENT_TYPE_CASE_TEAM_CONFIG	Get
case-team-config.get-active	ACTION_EVENT_TYPE_CASE_TEAM_CONFIG_GET_ACTIVE	Action
case-team-config.update	UPDATE_EVENT_TYPE_CASE_TEAM_CONFIG	Update

Cloud Metadata Enrichment

Event Name	Event Type	Field Type
cloud-metadata-enrichment.delete	DELETE_EVENT_TYPE_CLOUD_METADATA_ENRICHMENT	Delete
cloud-metadata-enrichment.create	CREATE_EVENT_TYPE_CLOUD_METADATA_ENRICHMENT	Create
cloud-metadata-enrichment.update	UPDATE_EVENT_TYPE_CLOUD_METADATA_ENRICHMENT	Update

Continuous Profiling

Event Name	Event Type	Field Type
profiles.symbols.upload	ACTION_EVENT_TYPE_PROFILES_SYMBOLS_UPLOAD	Action
profiles.query	ACTION_EVENT_TYPE_PROFILES_QUERY	Action
profiles.query.graph	ACTION_EVENT_TYPE_PROFILES_QUERY_GRAPH	Action
profiles.service.overview.query	ACTION_EVENT_TYPE_PROFILES_SERVICE_OVERVIEW_QUERY	Action

Cora Settings

Event Name	Event Type	Field Type
cora.settings.update	UPDATE_EVENT_TYPE_CORA_SETTINGS	Update

Custom Enrichment

Event Name	Event Type	Field Type
custom-enrichment.overwrite	ACTION_EVENT_TYPE_OVERWRITE_CUSTOM_ENRICHMENTS	Action
custom-enrichment.delete	DELETE_EVENT_TYPE_CUSTOM_ENRICHMENT	Delete
custom-enrichment.create	CREATE_EVENT_TYPE_CUSTOM_ENRICHMENT	Create
custom-enrichment.update	UPDATE_EVENT_TYPE_CUSTOM_ENRICHMENT	Update
custom-enrichment-data.list	LIST_EVENT_TYPE_CUSTOM_ENRICHMENT_DATA	List
custom-enrichment-data.get	GET_EVENT_TYPE_CUSTOM_ENRICHMENT_DATA	Get
custom-enrichment-data.delete	DELETE_EVENT_TYPE_CUSTOM_ENRICHMENT_DATA	Delete
custom-enrichment-data.create	CREATE_EVENT_TYPE_CUSTOM_ENRICHMENT_DATA	Create
custom-enrichment-data.update	UPDATE_EVENT_TYPE_CUSTOM_ENRICHMENT_DATA	Update

Dashboard Reports

Event Name	Event Type	Field Type
dashboard-report.get	GET_EVENT_TYPE_DASHBOARD_REPORT	Get
dashboard-report-schedule.list	LIST_EVENT_TYPE_DASHBOARD_REPORT_SCHEDULE	List
dashboard-report-schedule.get	GET_EVENT_TYPE_DASHBOARD_REPORT_SCHEDULE	Get
dashboard-report-schedule.delete	DELETE_EVENT_TYPE_DASHBOARD_REPORT_SCHEDULE	Delete
dashboard-report-schedule.create	CREATE_EVENT_TYPE_DASHBOARD_REPORT_SCHEDULE	Create
dashboard-report-schedule.update	UPDATE_EVENT_TYPE_DASHBOARD_REPORT_SCHEDULE	Update

Dashboards

Event Name	Event Type	Field Type
dashboards.list	LIST_EVENT_TYPE_DASHBOARD	List
dashboards.get	GET_EVENT_TYPE_DASHBOARD	Get
dashboards.delete	DELETE_EVENT_TYPE_DASHBOARD	Delete
dashboards.create	CREATE_EVENT_TYPE_DASHBOARD	Create
dashboards.update	UPDATE_EVENT_TYPE_DASHBOARD	Update
dashboards.pin	ACTION_EVENT_TYPE_DASHBOARD_PIN	Action
dashboards.set-as-default	ACTION_EVENT_TYPE_DASHBOARD_DEFAULT	Action
dashboards.archive	ACTION_EVENT_TYPE_DASHBOARD_ARCHIVE	Action
dashboards.archived.list	LIST_EVENT_TYPE_ARCHIVED_DASHBOARD	List
dashboards.list-highlighted-widgets	LIST_EVENT_TYPE_DASHBOARD_HIGHLIGHTED_WIDGETS	List
dashboards.restore	ACTION_EVENT_TYPE_DASHBOARD_RESTORE	Action
dashboards.set-highlighted-widgets	ACTION_EVENT_TYPE_DASHBOARD_SET_HIGHLIGHTED_WIDGETS	Action
dashboards.unpin	ACTION_EVENT_TYPE_DASHBOARD_UNPIN	Action
dashboards.unset-highlighted-widgets	ACTION_EVENT_TYPE_DASHBOARD_UNSET_HIGHLIGHTED_WIDGETS	Action
dashboards.export	ACTION_EVENT_TYPE_DASHBOARD_EXPORT	Action
dashboards.move	ACTION_EVENT_TYPE_DASHBOARD_MOVE	Action

Data Usage

Event Name	Event Type	Field Type
datausage.get-daily	ACTION_EVENT_TYPE_GET_DAILY_DATA_USAGE	Action
datausage.export	ACTION_EVENT_TYPE_EXPORT_DETAILED_DATA_USAGE	Action
datausage.data-usage-to-metrics-enable	ACTION_EVENT_TYPE_DATA_USAGE_TO_METRICS_ENABLE	Action

Email Filter

Event Name	Event Type	Field Type
email_filter.update	UPDATE_EVENT_TYPE_EMAIL_FILTER	Update
email_filter.create	CREATE_EVENT_TYPE_EMAIL_FILTER	Create
email_filter.list	LIST_EVENT_TYPE_EMAIL_FILTER	List

Enrichment

Event Name	Event Type	Field Type
enrichment.list	LIST_EVENT_TYPE_ENRICHMENT	List
enrichment.get	GET_EVENT_TYPE_ENRICHMENT	Get

Events2Metrics

events-2-metrics.list	LIST_EVENT_TYPE_EVENTS_2_METRICS	List
events-2-metrics.get	GET_EVENT_TYPE_EVENTS_2_METRICS	Get
events-2-metrics.delete	DELETE_EVENT_TYPE_EVENTS_2_METRICS	Delete
events-2-metrics.create	CREATE_EVENT_TYPE_EVENTS_2_METRICS	Create
events-2-metrics.update	UPDATE_EVENT_TYPE_EVENTS_2_METRICS	Update

Extensions

Event Name	Event Type	Field Type
extensions.undeploy	ACTION_EVENT_TYPE_EXTENSION_UNDEPLOY	Action
extensions.update	ACTION_EVENT_TYPE_EXTENSION_UPDATE	Action
extensions.deploy	ACTION_EVENT_TYPE_EXTENSION_DEPLOY	Action
extensions.list	LIST_EVENT_TYPE_EXTENSION	List
extensions.get	GET_EVENT_TYPE_EXTENSION	Get
extension-testing.initialize	ACTION_EVENT_TYPE_EXTENSION_TESTING_INITIALIZE	Action
extension-testing.cleanup	ACTION_EVENT_TYPE_EXTENSION_TESTING_CLEANUP	Action
extension-testing.test	ACTION_EVENT_TYPE_EXTENSION_TESTING_TEST	Action
integration-extensions.deploy	ACTION_EVENT_TYPE_INTEGRATION_EXTENSIONS_DEPLOY	Action

External Events

Event Name	Event Type	Field Type
external-events.submit	ACTION_EVENT_TYPE_EXTERNAL_EVENT_SUBMIT	Action

Folders

Event Name	Event Type	Field Type
folder.update	UPDATE_EVENT_TYPE_FOLDER	Update
folder.create	CREATE_EVENT_TYPE_FOLDER	Create
folder.delete	DELETE_EVENT_TYPE_FOLDER	Delete
folder.get	GET_EVENT_TYPE_FOLDER	Get
folder.list	LIST_EVENT_TYPE_FOLDER	List
folder.content-policy.create	CREATE_EVENT_TYPE_FOLDER_CONTENT_POLICY	Create
folder.content-policy.delete	DELETE_EVENT_TYPE_FOLDER_CONTENT_POLICY	Delete
folder.content-policy.update	UPDATE_EVENT_TYPE_FOLDER_CONTENT_POLICY	Update

Forwarders

Event Name	Event Type	Field Type
forwarders.test	ACTION_EVENT_TYPE_FORWARDERS_TEST	Action
forwarders.list	LIST_EVENT_TYPE_FORWARDERS	List
forwarders.get	GET_EVENT_TYPE_FORWARDERS	Get
forwarders.delete	DELETE_EVENT_TYPE_FORWARDERS	Delete
forwarders.create	CREATE_EVENT_TYPE_FORWARDERS	Create
forwarders.update	UPDATE_EVENT_TYPE_FORWARDERS	Update

Frequent Search Mapping Statistics

Event Name	Event Type	Field Type
frequent-search-mapping-statistics.get	GET_EVENT_TYPE_FREQUENT_SEARCH_MAPPING_STATISTICS	Get

Geo Enrichment

Event Name	Event Type	Field Type
geo-enrichment.delete	DELETE_EVENT_TYPE_GEO_ENRICHMENT	Delete
geo-enrichment.create	CREATE_EVENT_TYPE_GEO_ENRICHMENT	Create
geo-enrichment.update	UPDATE_EVENT_TYPE_GEO_ENRICHMENT	Update

Group

Event Name	Event Type	Field Type
group.delete	DELETE_EVENT_TYPE_GROUP	Delete
group.create	CREATE_EVENT_TYPE_GROUP	Create
group.update	UPDATE_EVENT_TYPE_GROUP	Update
group.get	GET_EVENT_TYPE_GROUP	Get
group.list	LIST_EVENT_TYPE_GROUP	List
group.members.list	LIST_EVENT_TYPE_GROUP_MEMBERS	List
group.roles.list	LIST_EVENT_TYPE_GROUP_ROLES	List
group.scope.get	GET_EVENT_TYPE_GROUP_SCOPE	Get

Heroku App Attachment

Event Name	Event Type	Field Type
heroku-app-attachment.create	CREATE_EVENT_TYPE_HEROKU_APP_ATTACHMENT	Create
heroku-app-attachment.delete	DELETE_EVENT_TYPE_HEROKU_APP_ATTACHMENT	Delete

Identity & Login History

Event Name	Event Type	Field Type
identity.get	GET_EVENT_TYPE_IDENTITY	Get
login-history.get	GET_EVENT_TYPE_LOGIN_HISTORY	Get

Incidents

Event Name	Event Type	Field Type
incidents.close	ACTION_EVENT_TYPE_INCIDENTS_CLOSE	Action
incidents.assign	ACTION_EVENT_TYPE_INCIDENTS_ASSIGN	Action
incidents.unassign	ACTION_EVENT_TYPE_INCIDENTS_UNASSIGN	Action
incidents.acknowledge	ACTION_EVENT_TYPE_INCIDENTS_ACKNOWLEDGE	Action
incidents.list	LIST_EVENT_TYPE_INCIDENTS	List
incidents.get	GET_EVENT_TYPE_INCIDENTS	Get

Infrastructure Monitoring

Event Name	Event Type	Field Type
infrastructure.health-rule.update	UPDATE_EVENT_TYPE_HEALTH_RULE	Update
infrastructure.health-policy.update	UPDATE_EVENT_TYPE_HEALTH_POLICY	Update
infrastructure.saved-view.update	UPDATE_EVENT_TYPE_SAVED_VIEW	Update
infrastructure.health-rule.create	CREATE_EVENT_TYPE_HEALTH_RULE	Create
infrastructure.saved-view.create	CREATE_EVENT_TYPE_SAVED_VIEW	Create
infrastructure.health-rule.delete	DELETE_EVENT_TYPE_HEALTH_RULE	Delete
infrastructure.saved-view.delete	DELETE_EVENT_TYPE_SAVED_VIEW	Delete

Investigations

Event Name	Event Type	Field Type
investigation.list	LIST_EVENT_TYPE_INVESTIGATION	List
investigation.update	UPDATE_EVENT_TYPE_INVESTIGATION	Update
investigation.create	CREATE_EVENT_TYPE_INVESTIGATION	Create
investigation.delete	DELETE_EVENT_TYPE_INVESTIGATION	Delete
investigation.get	GET_EVENT_TYPE_INVESTIGATION	Get
investigation.events.create	ACTION_EVENT_TYPE_INVESTIGATION_EVENTS_CREATE	Action
investigation.events.update	ACTION_EVENT_TYPE_INVESTIGATION_EVENTS_UPDATE	Action
investigation.events.delete	ACTION_EVENT_TYPE_INVESTIGATION_EVENTS_DELETE	Action
investigation.events.list	ACTION_EVENT_TYPE_INVESTIGATION_EVENTS_LIST	Action
investigation.participants.add	ACTION_EVENT_TYPE_INVESTIGATION_PARTICIPANTS_ADD	Action
investigation.participants.remove	ACTION_EVENT_TYPE_INVESTIGATION_PARTICIPANTS_REMOVE	Action
investigation.participants.list	ACTION_EVENT_TYPE_INVESTIGATION_PARTICIPANTS_LIST	Action
investigation.postmortem.create	ACTION_EVENT_TYPE_INVESTIGATION_POSTMORTEM_CREATE	Action
investigation.postmortem.patch	ACTION_EVENT_TYPE_INVESTIGATION_POSTMORTEM_PATCH	Action
investigation.postmortem.search	ACTION_EVENT_TYPE_INVESTIGATION_POSTMORTEM_SEARCH	Action

Integrations

Event Name	Event Type	Field Type
integration.check-api-key-permission	ACTION_EVENT_TYPE_CHECK_API_KEY_PERMISSION	Action
integration.create	CREATE_EVENT_TYPE_INTEGRATION	Create
integration.definition.get	GET_EVENT_TYPE_INTEGRATION_DEFINITION	Get
integration.delete	DELETE_EVENT_TYPE_INTEGRATION	Delete
integration.details.get	GET_EVENT_TYPE_INTEGRATION_DETAILS	Get
integration.generate-token	ACTION_EVENT_TYPE_INTEGRATION_GENERATE_TOKEN	Action
integration.get	GET_EVENT_TYPE_INTEGRATION	Get
integration.list	LIST_EVENT_TYPE_INTEGRATION	List
integration.quotas.get	GET_EVENT_TYPE_INTEGRATION_QUOTAS	Get
integration.rotate-token	ACTION_EVENT_TYPE_INTEGRATION_ROTATE_TOKEN	Action
integration.rum-app-version.get	GET_EVENT_TYPE_RUM_APPLICATION_VERSION_DATA	Get
integration.sync-rum-data	ACTION_EVENT_TYPE_INTEGRATION_SYNC_RUM_DATA	Action
integration.template.get	GET_EVENT_TYPE_INTEGRATION_TEMPLATE	Get
integration.test	ACTION_EVENT_TYPE_INTEGRATION_TEST	Action
integration.update	UPDATE_EVENT_TYPE_INTEGRATION	Update

Contextual Data Integrations

Event Name	Event Type	Field Type
contextual-data-integration.create	CREATE_EVENT_TYPE_CONTEXTUAL_DATA_INTEGRATION	Create
contextual-data-integration.definition.get	GET_EVENT_TYPE_CONTEXTUAL_DATA_INTEGRATION_DEFINITION	Get
contextual-data-integration.delete	DELETE_EVENT_TYPE_CONTEXTUAL_DATA_INTEGRATION	Delete
contextual-data-integration.details.get	GET_EVENT_TYPE_CONTEXTUAL_DATA_INTEGRATION_DETAILS	Get
contextual-data-integration.list	LIST_EVENT_TYPE_CONTEXTUAL_DATA_INTEGRATION	List
contextual-data-integration.test	ACTION_EVENT_TYPE_CONTEXTUAL_DATA_INTEGRATION_TEST	Action
contextual-data-integration.update	UPDATE_EVENT_TYPE_CONTEXTUAL_DATA_INTEGRATION	Update

Push-based contextual data integration

Event Name	Event Type	Field Type
push-based-contextual-data-integration.update	UPDATE_EVENT_TYPE_PUSH_BASED_CONTEXTUAL_DATA_INTEGRATION	Update
push-based-contextual-data-integration.create	CREATE_EVENT_TYPE_PUSH_BASED_CONTEXTUAL_DATA_INTEGRATION	Create
push-based-contextual-data-integration.delete	DELETE_EVENT_TYPE_PUSH_BASED_CONTEXTUAL_DATA_INTEGRATION	Delete
push-based-contextual-data-integration.list	LIST_EVENT_TYPE_PUSH_BASED_CONTEXTUAL_DATA_INTEGRATION	List

Livetail

Event Name	Event Type	Field Type
livetail.subscribe	ACTION_EVENT_TYPE_LIVETAIL_SUBSCRIBE	Action

Logs TCO

Event Name	Event Type	Field Type
logs.tco.test	ACTION_EVENT_TYPE_LOGS_TCO_TEST	Action
logs.tco.order	ACTION_EVENT_TYPE_LOGS_TCO_ORDER	Action
logs.tco.list	LIST_EVENT_TYPE_LOGS_TCO	List
logs.tco.get	GET_EVENT_TYPE_LOGS_TCO	Get
logs.tco.delete	DELETE_EVENT_TYPE_LOGS_TCO	Delete
logs.tco.create	CREATE_EVENT_TYPE_LOGS_TCO	Create
logs.tco.update	UPDATE_EVENT_TYPE_LOGS_TCO	Update

Logs TCO Override

Event Name	Event Type	Field Type
logs.tco-override.update	UPDATE_EVENT_TYPE_LOGS_TCO_OVERRIDE	Update
logs.tco-override.create	CREATE_EVENT_TYPE_LOGS_TCO_OVERRIDE	Create
logs.tco-override.delete	DELETE_EVENT_TYPE_LOGS_TCO_OVERRIDE	Delete
logs.tco-override.get	GET_EVENT_TYPE_LOGS_TCO_OVERRIDE	Get
logs.tco-override.list	LIST_EVENT_TYPE_LOGS_TCO_OVERRIDE	List

Logs Parsing Rules

Event Name	Event Type	Field Type
logs.parsing-rules.order	ACTION_EVENT_TYPE_LOGS_RULES_GROPS_ORDER	Action
logs.parsing-rules.list	LIST_EVENT_TYPE_LOGS_RULES_GROUP	List
logs.parsing-rules.get	GET_EVENT_TYPE_LOGS_RULES_GROUP	Get
logs.parsing-rules.delete	DELETE_EVENT_TYPE_LOGS_RULES_GROUP	Delete
logs.parsing-rules.create	CREATE_EVENT_TYPE_LOGS_RULES_GROUP	Create
logs.parsing-rules.update	UPDATE_EVENT_TYPE_LOGS_RULES_GROUP	Update

Logs Data API

Event Name	Event Type	Field Type
logs-data-api.ReadData	ACTION_EVENT_TYPE_DATA_API_READ_DATA	Action
logs-data-api.query-results-export	ACTION_EVENT_TYPE_DATA_API_QUERY_RESULTS_EXPORT	Action

Managed Integrations

Event Name	Event Type	Field Type
managed-integration.status.get	GET_EVENT_TYPE_MANAGED_INTEGRATION_STATUS	Get
managed-integration-key.list	LIST_EVENT_TYPE_MANAGED_INTEGRATION_KEYS	List

Metrics

Event Name	Event Type	Field Type
metrics.data-api.read	ACTION_EVENT_TYPE_METRICS_READ_DATA	Action
metrics.apm-service-priority.update	ACTION_EVENT_TYPE_APM_SERVICE_PRIORITY_UPDATE	Action
metrics.priority.update	ACTION_EVENT_TYPE_METRICS_PRIORITY_UPDATE	Action

Notification Center Presets

Event Name	Event Type	Field Type
notification-center-preset.set-as-default	ACTION_EVENT_TYPE_NOTIFICATION_CENTER_PRESET_SET_AS_DEFAULT	Action
notification-center-preset.delete	DELETE_EVENT_TYPE_NOTIFICATION_CENTER_PRESET	Delete
notification-center-preset.create	CREATE_EVENT_TYPE_NOTIFICATION_CENTER_PRESET	Create
notification-center-preset.update	UPDATE_EVENT_TYPE_NOTIFICATION_CENTER_PRESET	Update
notification-center-preset.get	GET_EVENT_TYPE_NOTIFICATION_CENTER_PRESET	Get
notification-center-preset.list	LIST_EVENT_TYPE_NOTIFICATION_CENTER_PRESET	List

Notification Center Connectors

Event Name	Event Type	Field Type
notification-center-connector.create	CREATE_EVENT_TYPE_NOTIFICATION_CENTER_CONNECTOR	Create
notification-center-connector.delete	DELETE_EVENT_TYPE_NOTIFICATION_CENTER_CONNECTOR	Delete
notification-center-connector.get	GET_EVENT_TYPE_NOTIFICATION_CENTER_CONNECTOR	Get
notification-center-connector.list	LIST_EVENT_TYPE_NOTIFICATION_CENTER_CONNECTOR	List
notification-center-connector.update	UPDATE_EVENT_TYPE_NOTIFICATION_CENTER_CONNECTOR	Update

Notification Center Routers

Event Name	Event Type	Field Type
notification-center-global-router.create	CREATE_EVENT_TYPE_NOTIFICATION_CENTER_GLOBAL_ROUTER	Create
notification-center-global-router.delete	DELETE_EVENT_TYPE_NOTIFICATION_CENTER_GLOBAL_ROUTER	Delete
notification-center-global-router.get	GET_EVENT_TYPE_NOTIFICATION_CENTER_GLOBAL_ROUTER	Get
notification-center-global-router.list	LIST_EVENT_TYPE_NOTIFICATION_CENTER_GLOBAL_ROUTER	List
notification-center-global-router.update	UPDATE_EVENT_TYPE_NOTIFICATION_CENTER_GLOBAL_ROUTER	Update

Notification Center Team Settings

Event Name	Event Type	Field Type
notification-center-team-settings.update	UPDATE_EVENT_TYPE_NOTIFICATION_CENTER_TEAM_SETTINGS	Update
notification-center-team-settings.create	CREATE_EVENT_TYPE_NOTIFICATION_CENTER_TEAM_SETTINGS	Create
notification-center-team-settings.delete	DELETE_EVENT_TYPE_NOTIFICATION_CENTER_TEAM_SETTINGS	Delete
notification-center-team-settings.get	GET_EVENT_TYPE_NOTIFICATION_CENTER_TEAM_SETTINGS	Get

OAuth Clients

Event Name	Event Type	Field Type
oauth2-client.update	UPDATE_EVENT_TYPE_OAUTH2_CLIENT	Update
oauth2-client.access-policy.update	UPDATE_EVENT_TYPE_OAUTH2_CLIENT_ACCESS_POLICY	Update
oauth2-client.create	CREATE_EVENT_TYPE_OAUTH2_CLIENT	Create
oauth2-client.access-policy.create	CREATE_EVENT_TYPE_OAUTH2_CLIENT_ACCESS_POLICY	Create
oauth2-client.delete	DELETE_EVENT_TYPE_OAUTH2_CLIENT	Delete
oauth2-client.access-policy.delete	DELETE_EVENT_TYPE_OAUTH2_CLIENT_ACCESS_POLICY	Delete
oauth2-client.get	GET_EVENT_TYPE_OAUTH2_CLIENT	Get
oauth2-client.access-policy.get	GET_EVENT_TYPE_OAUTH2_CLIENT_ACCESS_POLICY	Get
oauth2-client.list	LIST_EVENT_TYPE_OAUTH2_CLIENT	List
oauth2-client.access-policy.list	LIST_EVENT_TYPE_OAUTH2_CLIENT_ACCESS_POLICY	List
oauth2-client.login-denied	ACTION_EVENT_TYPE_OAUTH2_CLIENT_LOGIN_DENIED	Action
oauth2-client.delegated-access.started	ACTION_EVENT_TYPE_DELEGATED_ACCESS_STARTED	Action
oauth2-client.delegated-access.teams-discovered	ACTION_EVENT_TYPE_DELEGATED_ACCESS_TEAMS_DISCOVERED	Action
oauth2-token.exchange	ACTION_EVENT_TYPE_TOKEN_EXCHANGE	Action
oauth2-client.token-scope-narrowed	ACTION_EVENT_TYPE_OAUTH2_CLIENT_TOKEN_SCOPE_NARROWED	Action
oauth2-client.cimd-acceptance.list	LIST_EVENT_TYPE_OAUTH2_CLIENT_CIMD_ACCEPTANCE	List
oauth2-client.cimd-acceptance.update	UPDATE_EVENT_TYPE_OAUTH2_CLIENT_CIMD_ACCEPTANCE	Update

Embedded mode

Event Name	Event Type	Field Type
embedded-config.update	UPDATE_EVENT_TYPE_EMBEDDED_CONFIG	Update
embedded-config.secret.update	UPDATE_EVENT_TYPE_EMBEDDED_CONFIG_SECRET	Update
embedded-config.create	CREATE_EVENT_TYPE_EMBEDDED_CONFIG	Create
embedded-config.delete	DELETE_EVENT_TYPE_EMBEDDED_CONFIG	Delete
embedded-config.get	GET_EVENT_TYPE_EMBEDDED_CONFIG	Get
embedded-config.list	LIST_EVENT_TYPE_EMBEDDED_CONFIG	List

Olly Analysis Settings

Event Name	Event Type	Field Type
olly-analysis-settings.update	UPDATE_EVENT_TYPE_OLLY_ANALYSIS_SETTINGS	Update
olly-analysis-settings.create	CREATE_EVENT_TYPE_OLLY_ANALYSIS_SETTINGS	Create
olly-analysis-settings.delete	DELETE_EVENT_TYPE_OLLY_ANALYSIS_SETTINGS	Delete
olly-analysis-settings.get	GET_EVENT_TYPE_OLLY_ANALYSIS_SETTINGS	Get
olly-analysis-settings.get-active	ACTION_EVENT_TYPE_OLLY_ANALYSIS_SETTINGS_GET_ACTIVE	Action
olly-analysis-settings.get-system-defaults	ACTION_EVENT_TYPE_OLLY_ANALYSIS_SETTINGS_GET_SYSTEM_DEFAULTS	Action

Organization

Event Name	Event Type	Field Type
organization.add-domain	ACTION_EVENT_TYPE_ADD_DOMAIN	Action
organization.get	GET_EVENT_TYPE_ORGANIZATION	Get
organization.list	LIST_EVENT_TYPE_ORGANIZATION	List
organization.move-quota	ACTION_EVENT_TYPE_MOVE_QUOTA	Action
organization.settings.get	GET_EVENT_TYPE_ORGANIZATION_SETTINGS	Get
organization.settings.update	UPDATE_EVENT_TYPE_ORGANIZATION_SETTINGS	Update
organization.update	UPDATE_EVENT_TYPE_ORGANIZATION	Update
organization.add-user-to-team	ACTION_EVENT_TYPE_ADD_USER_TO_ORG_TEAM	Action
organization.create.team	CREATE_EVENT_TYPE_TEAM_IN_ORGANIZATION	Create
organization.domains.get	GET_EVENT_TYPE_ORGANIZATION_DOMAINS	Get
organization.remove-domain	ACTION_EVENT_TYPE_REMOVE_DOMAIN	Action
organization.users.get	GET_EVENT_TYPE_ORGANIZATION_USERS	Get
organization.verify-email-domain	ACTION_EVENT_TYPE_ORGANIZATION_VERIFY_EMAIL_DOMAIN	Action

Organization Groups

Event Name	Event Type	Field Type
org-group.get	GET_EVENT_TYPE_ORG_GROUP	Get
org-group.list	LIST_EVENT_TYPE_ORG_GROUP	List

Webhooks

Event Name	Event Type	Field Type
outbound-webhook-types.list	LIST_EVENT_TYPE_OUTBOUND_WEBHOOK_TYPES	List
outbound-webhooks.test	ACTION_EVENT_TYPE_OUTBOUND_WEBHOOK_TEST	Action
outbound-webhooks.list	LIST_EVENT_TYPE_OUTBOUND_WEBHOOK	List
outbound-webhooks.get	GET_EVENT_TYPE_OUTBOUND_WEBHOOK	Get
outbound-webhooks.delete	DELETE_EVENT_TYPE_OUTBOUND_WEBHOOK	Delete
outbound-webhooks.create	CREATE_EVENT_TYPE_OUTBOUND_WEBHOOK	Create
outbound-webhooks.update	UPDATE_EVENT_TYPE_OUTBOUND_WEBHOOK	Update

Permission

Event Name	Event Type	Field Type
permission.list	LIST_EVENT_TYPE_PERMISSION	List

Product Analytics

Event Name	Event Type	Field Type
product-analytics.funnel.query	ACTION_EVENT_TYPE_PRODUCT_ANALYTICS_FUNNEL_QUERY	Action
product-analytics.matching-users.query	ACTION_EVENT_TYPE_PRODUCT_ANALYTICS_MATCHING_USERS_QUERY	Action
product-analytics.pathways.query	ACTION_EVENT_TYPE_PRODUCT_ANALYTICS_PATHWAYS_QUERY	Action
product-analytics.views.query	ACTION_EVENT_TYPE_PRODUCT_ANALYTICS_VIEWS_QUERY	Action
product-analytics.actions.query	ACTION_EVENT_TYPE_PRODUCT_ANALYTICS_ACTIONS_QUERY	Action
product-analytics.clicks.query	ACTION_EVENT_TYPE_PRODUCT_ANALYTICS_CLICKS_QUERY	Action
product-analytics.scroll-map.query	ACTION_EVENT_TYPE_PRODUCT_ANALYTICS_SCROLL_MAP_QUERY	Action
product-analytics.funnel.store	ACTION_EVENT_TYPE_PRODUCT_ANALYTICS_FUNNEL_STORE	Action
product-analytics.funnel.update	ACTION_EVENT_TYPE_PRODUCT_ANALYTICS_FUNNEL_UPDATE	Action
product-analytics.funnel.delete	ACTION_EVENT_TYPE_PRODUCT_ANALYTICS_FUNNEL_DELETE	Action
product-analytics.heatmap.store	ACTION_EVENT_TYPE_PRODUCT_ANALYTICS_HEATMAP_STORE	Action
product-analytics.heatmap.update	ACTION_EVENT_TYPE_PRODUCT_ANALYTICS_HEATMAP_UPDATE	Action
product-analytics.heatmap.delete	ACTION_EVENT_TYPE_PRODUCT_ANALYTICS_HEATMAP_DELETE	Action
product-analytics.pathway.store	ACTION_EVENT_TYPE_PRODUCT_ANALYTICS_PATHWAY_STORE	Action
product-analytics.pathway.update	ACTION_EVENT_TYPE_PRODUCT_ANALYTICS_PATHWAY_UPDATE	Action
product-analytics.pathway.delete	ACTION_EVENT_TYPE_PRODUCT_ANALYTICS_PATHWAY_DELETE	Action
product-analytics.set-enabled	ACTION_EVENT_TYPE_PRODUCT_ANALYTICS_SET_ENABLED	Action

Rate Limiter

Event Name	Event Type	Field Type
rate-limiter.limited	ACTION_EVENT_TYPE_RATE_LIMITED	Action

Recording Rules

Event Name	Event Type	Field Type
recording-rule.delete	DELETE_EVENT_TYPE_RECORDING_RULE	Delete
recording-rule.create	CREATE_EVENT_TYPE_RECORDING_RULE	Create
recording-rule.update	UPDATE_EVENT_TYPE_RECORDING_RULE	Update
recording-rule-group.delete	DELETE_EVENT_TYPE_RECORDING_RULE_GROUP	Delete
recording-rule-group.create	CREATE_EVENT_TYPE_RECORDING_RULE_GROUP	Create
recording-rule-group.update	UPDATE_EVENT_TYPE_RECORDING_RULE_GROUP	Update
recording-rule-group-set.delete	DELETE_EVENT_TYPE_RECORDING_RULE_GROUP_SET	Delete
recording-rule-group-set.create	CREATE_EVENT_TYPE_RECORDING_RULE_GROUP_SET	Create
recording-rule-group-set.update	UPDATE_EVENT_TYPE_RECORDING_RULE_GROUP_SET	Update

Reserved Schema

Event Name	Event Type	Field Type
reserved-schema.update	UPDATE_EVENT_TYPE_RESERVED_SCHEMA	Update
reserved-schema.create	CREATE_EVENT_TYPE_RESERVED_SCHEMA	Create
reserved-schema.delete	DELETE_EVENT_TYPE_RESERVED_SCHEMA	Delete
reserved-schema.get	GET_EVENT_TYPE_RESERVED_SCHEMA	Get
audit.reserved-schema.get	ACTION_EVENT_GET_EVENT_TYPE_RESERVED_SCHEMA	Action

Roles

Event Name	Event Type	Field Type
role.list	LIST_EVENT_TYPE_ROLE	List
role.get	GET_EVENT_TYPE_ROLE	Get
role.delete	DELETE_EVENT_TYPE_ROLE	Delete
role.create	CREATE_EVENT_TYPE_ROLE	Create
role.update	UPDATE_EVENT_TYPE_ROLE	Update

RUM

RUM settings

Event Name	Event Type	Field Type
rum-settings.get	GET_EVENT_TYPE_RUM_SETTINGS	Get
rum-settings.update	UPDATE_EVENT_TYPE_RUM_SETTINGS	Update

SDK versions

Event Name	Event Type	Field Type
sdk-version.get	GET_EVENT_TYPE_SDK_VERSION	Get

Session Recording

Event Name	Event Type	Field Type
session-recording.get	GET_EVENT_TYPE_SESSION_RECORDING	Get

Source Map

Event Name	Event Type	Field Type
source-map.get	GET_EVENT_TYPE_SOURCE_MAP	Get

Hide Errors

Event Name	Event Type	Field Type
hide-errors.list	LIST_EVENT_TYPE_HIDE_ERRORS	List
hide-errors.get	GET_EVENT_TYPE_HIDE_ERRORS	Get
hide-errors.delete	DELETE_EVENT_TYPE_HIDE_ERRORS	Delete
hide-errors.create	CREATE_EVENT_TYPE_HIDE_ERRORS	Create
hide-errors.update	UPDATE_EVENT_TYPE_HIDE_ERRORS	Update

Saved Filters

Event Name	Event Type	Field Type
saved-filter.list	LIST_EVENT_TYPE_SAVED_FILTER	List
saved-filter.get	GET_EVENT_TYPE_SAVED_FILTER	Get
saved-filter.delete	DELETE_EVENT_TYPE_SAVED_FILTER	Delete
saved-filter.create	CREATE_EVENT_TYPE_SAVED_FILTER	Create
saved-filter.update	UPDATE_EVENT_TYPE_SAVED_FILTER	Update

RUM TCO

Event Name	Event Type	Field Type
rum.tco.update	UPDATE_EVENT_TYPE_RUM_TCO	Update
rum.tco.create	CREATE_EVENT_TYPE_RUM_TCO	Create
rum.tco.delete	DELETE_EVENT_TYPE_RUM_TCO	Delete
rum.tco.get	GET_EVENT_TYPE_RUM_TCO	Get
rum.tco.list	LIST_EVENT_TYPE_RUM_TCO	List
rum.tco.order	ACTION_EVENT_TYPE_RUM_TCO_ORDER	Action

SAML

Event Name	Event Type	Field Type
saml.user.email-verification-required	ACTION_EVENT_TYPE_SAML_EMAIL_VERIFICATION_REQUIRED	Action
saml.user.reactivated	ACTION_EVENT_TYPE_SAML_USER_REACTIVATED	Action
saml.user.sso-verification-required	ACTION_EVENT_TYPE_SAML_SSO_VERIFICATION_REQUIRED	Action

Saved Views

These events cover saved views across every product area that offers them, including Infrastructure Explorer, Explore, Cases, Alerts, and RUM.

Event Name	Event Type	Field Type
view.list	LIST_EVENT_TYPE_VIEW	List
view.get	GET_EVENT_TYPE_VIEW	Get
view.delete	DELETE_EVENT_TYPE_VIEW	Delete
view.create	CREATE_EVENT_TYPE_VIEW	Create
view.update	UPDATE_EVENT_TYPE_VIEW	Update

View Folder

Folders are available in Explore, Alerts, and APM. Product areas without folders, such as Infrastructure Explorer, Cases, and RUM, do not emit these events.

Event Name	Event Type	Field Type
view-folder.list	LIST_EVENT_TYPE_VIEW_FOLDER	List
view-folder.get	GET_EVENT_TYPE_VIEW_FOLDER	Get
view-folder.delete	DELETE_EVENT_TYPE_VIEW_FOLDER	Delete
view-folder.create	CREATE_EVENT_TYPE_VIEW_FOLDER	Create
view-folder.update	UPDATE_EVENT_TYPE_VIEW_FOLDER	Update

SCIM

Event Name	Event Type	Field Type
scim.user.delete	ACTION_EVENT_TYPE_SCIM_DELETE_USER	Action
scim.group.replace	ACTION_EVENT_TYPE_SCIM_REPLACE_GROUP	Action
scim.user.create	ACTION_EVENT_TYPE_SCIM_CREATE_USER	Action
scim.user.replace	ACTION_EVENT_TYPE_SCIM_REPLACE_USER	Action
scim.user.update	ACTION_EVENT_TYPE_SCIM_UPDATE_USER	Action
scim.group.delete	ACTION_EVENT_TYPE_SCIM_DELETE_GROUP	Action
scim.group.update	ACTION_EVENT_TYPE_SCIM_UPDATE_GROUP	Action
scim.group.create	ACTION_EVENT_TYPE_SCIM_CREATE_GROUP	Action
scim.user.list	LIST_EVENT_SCIM_USER	List
scim.group.list	LIST_EVENT_SCIM_GROUP	List
scim.schema.list	LIST_EVENT_SCIM_SCHEMA	List
scim.schema.get	GET_EVENT_SCIM_SCHEMA	Get
scim.user.get	GET_EVENT_SCIM_USER	Get
scim.group.get	GET_EVENT_SCIM_GROUP	Get

Scopes

Event Name	Event Type	Field Type
scopes.list	LIST_EVENT_TYPE_SCOPE_LIST	List
scopes.get	GET_EVENT_TYPE_SCOPE_GET	Get
scopes.delete	DELETE_EVENT_TYPE_SCOPE_DELETE	Delete
scopes.create	CREATE_EVENT_TYPE_SCOPE_CREATE	Create
scopes.update	UPDATE_EVENT_TYPE_SCOPE_UPDATE	Update

Security Enrichments

Event Name	Event Type	Field Type
security-enrichment.delete	DELETE_EVENT_TYPE_SECURITY_ENRICHMENT	Delete
security-enrichment.create	CREATE_EVENT_TYPE_SECURITY_ENRICHMENT	Create
security-enrichment.update	UPDATE_EVENT_TYPE_SECURITY_ENRICHMENT	Update

Spans and Traces Exploration

Event Name	Event Type	Field Type
service-map.get	ACTION_EVENT_TYPE_SERVICE_MAP_GET	Action
spans.count.get	ACTION_EVENT_TYPE_SPANS_COUNT	Action
spans.filters.get	ACTION_EVENT_TYPE_SPANS_FILTERS	Action
spans.graphs.get	ACTION_EVENT_TYPE_SPANS_GRAPHS	Action
spans.lists.highlights	ACTION_EVENT_TYPE_HIGHLIGHTS_LIST_SPANS_HIGHLIGHTS	Action
spans.search	ACTION_EVENT_TYPE_SPANS_SEARCH	Action
traces.count.get	ACTION_EVENT_TYPE_TRACES_COUNT_GET	Action
traces.get	ACTION_EVENT_TYPE_TRACES_GET_TRACE	Action
traces.latency-percentile.get	ACTION_EVENT_TYPE_TRACES_LATENCY_PERCENTILE_GET	Action
traces.search	ACTION_EVENT_TYPE_TRACES_SEARCH	Action

Spans TCO

Event Name	Event Type	Field Type
spans.tco.order	ACTION_EVENT_TYPE_SPANS_TCO_ORDER	Action
spans.tco.list	LIST_EVENT_TYPE_SPANS_TCO	List
spans.tco.get	GET_EVENT_TYPE_SPANS_TCO	Get
spans.tco.delete	DELETE_EVENT_TYPE_SPANS_TCO	Delete
spans.tco.create	CREATE_EVENT_TYPE_SPANS_TCO	Create
spans.tco.update	UPDATE_EVENT_TYPE_SPANS_TCO	Update

Slack Notifications

Event Name	Event Type	Field Type
slack-notification.update	UPDATE_EVENT_TYPE_SLACK_NOTIFICATION	Update
slack-notification.list	LIST_EVENT_TYPE_SLACK_NOTIFICATION	List

Split Index

Event Name	Event Type	Field Type
split-index.create	CREATE_EVENT_TYPE_SPLIT_INDEX	Create
split-index.get	GET_EVENT_TYPE_SPLIT_INDEX_COUNT	Get

SLOs

Event Name	Event Type	Field Type
slo.list	LIST_EVENT_TYPE_SLO	List
slo.batch.get	GET_EVENT_TYPE_SLO_BATCH	Get
slo.create	CREATE_EVENT_TYPE_SLO_CREATE	Create
slo.delete	DELETE_EVENT_TYPE_SLO	Delete
slo.update	UPDATE_EVENT_TYPE_SLO	Update

SSO

Event Name	Event Type	Field Type
sso.set-idp-parameters	ACTION_EVENT_TYPE_SSO_SET_IDP_PARAMETERS	Action
sso.set-active	ACTION_EVENT_TYPE_SSO_SET_ACTIVE	Action
sso.configuration.get	GET_EVENT_SSO_CONFIGURATION	Get
sso.sp-parameters.get	GET_EVENT_SSO_SP_PARAMETERS	Get
sso.config.update	UPDATE_EVENT_TYPE_SAML_CONFIG	Update
sso.metadata.update	UPDATE_EVENT_TYPE_SAML_METADATA	Update
sso.claimable-domains.list	LIST_EVENT_TYPE_SAML_CLAIMABLE_DOMAINS	List
sso.config-details.get	GET_EVENT_TYPE_SAML_CONFIG_DETAILS	Get
sso.config.create	CREATE_EVENT_TYPE_SAML_CONFIG	Create
sso.config.delete	DELETE_EVENT_TYPE_SAML_CONFIG	Delete
sso.config.get	GET_EVENT_TYPE_SAML_CONFIG	Get
sso.config.list	LIST_EVENT_TYPE_SAML_CONFIGS	List
sso.login-events.get	GET_EVENT_TYPE_SAML_LOGIN_EVENTS	Get

Streams

Event Name	Event Type	Field Type
streams.update	UPDATE_EVENT_TYPE_STREAMS	Update
streams.create	CREATE_EVENT_TYPE_STREAMS	Create
streams.delete	DELETE_EVENT_TYPE_STREAMS	Delete
streams.get	GET_EVENT_TYPE_STREAMS	Get
streams.list	LIST_EVENT_TYPE_STREAMS	List
streams.test	ACTION_EVENT_TYPE_STREAMS_TEST	Action

Team IP Access

Event Name	Event Type	Field Type
team-ip-access.list	LIST_EVENT_TYPE_IP_FILTER	List
team-ip-access.delete	DELETE_EVENT_TYPE_IP_FILTER	Delete
team-ip-access.create	CREATE_EVENT_TYPE_IP_FILTER	Create
team-ip-access.update	UPDATE_EVENT_TYPE_IP_FILTER	Update
team-ip-access.blocked	ACTION_EVENT_TYPE_IP_RESTRICTION_BLOCKED	Action
team-ip-access.validate	ACTION_EVENT_TYPE_VALIDATE_IP_ACCESS	Action

Team Management

Event Name	Event Type	Field Type
team-landing-page.update	UPDATE_EVENT_TYPE_TEAM_LANDING_PAGE	Update
team-member.remove	ACTION_EVENT_TYPE_TEAM_MEMBER_REMOVE	Action
team-member.unlock	ACTION_EVENT_TYPE_TEAM_MEMBER_UNLOCK	Action
team-member.add	ACTION_EVENT_TYPE_TEAM_MEMBER_ADD	Action
team-member.invite	ACTION_EVENT_TYPE_TEAM_MEMBER_INVITE	Action
team-member.list	LIST_EVENT_TEAM_MEMBER	List
team-sessions.session-timeout.update	UPDATE_EVENT_TYPE_TEAM_SESSIONS_SESSION_TIMEOUT	Update
team-sessions.force-logout.update	UPDATE_EVENT_TYPE_TEAM_SESSIONS_FORCE_LOGOUT	Update
team-url.update	UPDATE_EVENT_TYPE_TEAM_URL	Update
team-member.create	CREATE_EVENT_TYPE_TEAM_MEMBER_CREATE	Create
team-member-invite.list	LIST_EVENT_TYPE_TEAM_MEMBER_INVITE	List
team-member.delete	DELETE_EVENT_TYPE_TEAM_MEMBER	Delete
team-member.expire-temp-user	ACTION_EVENT_TYPE_TEAM_MEMBER_EXPIRE_TEMP_USER	Action
team-member.invite-temp-user	ACTION_EVENT_TYPE_TEAM_MEMBER_INVITE_TEMP_USER	Action
team-member.mfa.change-enforcement	ACTION_EVENT_TYPE_TEAM_MEMBER_MFA_CHANGE_ENFORCEMENT	Action
team-member.reset-password	ACTION_EVENT_RESET_PASSORD	Action
team-member.update	UPDATE_EVENT_TYPE_TEAM_MEMBER_UPDATE	Update
team-member.update-active-status	UPDATE_EVENT_TYPE_TEAM_MEMBER_UPDATE_ACTIVE_STATUS	Update
team-member-invite.delete	DELETE_EVENT_TYPE_TEAM_MEMBER_INVITE	Delete

team-member.add is deprecated; use team-member.create instead.

Team

Event Name	Event Type	Field Type
team.update	UPDATE_EVENT_TYPE_UPDATE_TEAM	Update
team.create	CREATE_EVENT_TYPE_TEAM	Create
team.delete	DELETE_EVENT_TYPE_TEAM	Delete
team.get-quota	GET_EVENT_TYPE_TEAM_GET_QUOTA	Get
team.get	GET_EVENT_TYPE_TEAM	Get
team.list	LIST_EVENT_TYPE_TEAM	List
team.move-quota	ACTION_EVENT_TYPE_TEAM_MOVE_QUOTA	Action
team.mfa.change-enforcement	ACTION_EVENT_TYPE_TEAM_MFA_CHANGE_ENFORCEMENT	Action
team.set-daily-quota	ACTION_EVENT_TYPE_TEAM_SET_DAILY_QUOTA	Action

Team Settings

Event Name	Event Type	Field Type
team-allowed-domains.update	UPDATE_EVENT_TYPE_TEAM_ALLOWED_DOMAINS	Update
team-allowed-domains.create	CREATE_EVENT_TYPE_TEAM_ALLOWED_DOMAIN	Create
team-allowed-domains.delete	DELETE_EVENT_TYPE_TEAM_ALLOWED_DOMAIN	Delete
team-allowed-domains.list	LIST_EVENT_TYPE_TEAM_ALLOWED_DOMAINS	List
team-allowed-domains.csv-upload	ACTION_EVENT_TYPE_TEAM_ALLOWED_DOMAIN_CSV_UPLOAD	Action
team-invitation-expiry-policy.update	UPDATE_EVENT_TYPE_TEAM_INVITATION_EXPIRY_POLICY	Update
team-mfa-enforcement.update	UPDATE_EVENT_TYPE_TEAM_MFA_ENFORCEMENT	Update
team-sorting.update	UPDATE_EVENT_TYPE_TEAM_DEFAULT_SORTING	Update
team-sso-enforcement.update	UPDATE_EVENT_TYPE_TEAM_SSO_ENFORCEMENT	Update

Team Payments

Event Name	Event Type	Field Type
team-payments.update	UPDATE_EVENT_TYPE_TEAM_PAYMENTS	Update
team-payments.create	CREATE_EVENT_TYPE_TEAM_PAYMENTS	Create
team-payments.delete	DELETE_EVENT_TYPE_TEAM_PAYMENTS	Delete
team-payments.get	GET_EVENT_TYPE_TEAM_PAYMENTS	Get
team-pay-as-you-go.create	CREATE_EVENT_TYPE_TEAM_PAY_AS_YOU_GO	Create
team-pay-as-you-go.delete	DELETE_EVENT_TYPE_TEAM_PAY_AS_YOU_GO	Delete
team-pay-as-you-go.get	GET_EVENT_TYPE_TEAM_PAY_AS_YOU_GO	Get
team-plan.get	GET_EVENT_TYPE_TEAM_PLAN	Get

Templates

Event Name	Event Type	Field Type
templates.list.read	ACTION_EVENT_TYPE_TEMPLATES_READ_DATA	Action
templates.count.read	ACTION_EVENT_TYPE_TEMPLATES_COUNT_READ_DATA	Action
templates-dates.get	GET_EVENT_TYPE_TEMPLATES_DATES	Get

User Account

Event Name	Event Type	Field Type
user-account.login	ACTION_EVENT_TYPE_USER_ACCOUNT_LOGIN	Action
user-account.mfa-complete-enrolment	ACTION_EVENT_TYPE_USER_ACCOUNT_MFA_COMPLETE_ENROLMENT	Action
user-account.mfa-regenerate-backup-codes	ACTION_EVENT_TYPE_USER_ACCOUNT_MFA_REGENERATE_BACKUP_CODES	Action
user-account.mfa-start-enrolment	ACTION_EVENT_TYPE_USER_ACCOUNT_MFA_START_ENROLMENT	Action
user-account.mfa-unenroll	ACTION_EVENT_TYPE_USER_ACCOUNT_MFA_UNENROLL	Action
user-account.mfa-verification.lock	ACTION_EVENT_TYPE_USER_ACCOUNT_MFA_VERIFICATION_LOCK	Action
user-account.mfa-verification.verify	ACTION_EVENT_TYPE_USER_ACCOUNT_MFA_VERIFICATION_VERIFY	Action
user-account.password-change	ACTION_EVENT_TYPE_USER_ACCOUNT_PASSWORD_CHANGE	Action

User Management

Event Name	Event Type	Field Type
user-landing-page.update	UPDATE_EVENT_TYPE_USER_LANDING_PAGE	Update
user-settings.get	GET_EVENT_TYPE_USER_SETTING	Get
user-settings.update	UPDATE_EVENT_TYPE_USER_SETTING	Update
users-login-methods.update	UPDATE_EVENT_TYPE_USERS_LOGIN_METHODS	Update
user.get	GET_EVENT_TYPE_USER	Get
user.list	LIST_EVENT_TYPE_USER	List
user-enterprise-attributes.update	UPDATE_EVENT_TYPE_USER_ENTERPRISE_ATTRIBUTES	Update
users-expiry.update	UPDATE_EVENT_TYPE_USERS_EXPIRY	Update
users-login-methods.list	LIST_EVENT_TYPE_USERS_LOGIN_METHODS	List
users-mfa-enforcement.update	UPDATE_EVENT_TYPE_USERS_MFA_ENFORCEMENT	Update
users-statuses.update	UPDATE_EVENT_TYPE_USERS_STATUSES	Update
landing-page.get	GET_EVENT_TYPE_LANDING_PAGE	Get

User Digest

Event Name	Event Type	Field Type
user_digest.update	UPDATE_EVENT_TYPE_DIGEST	Update
user_digest.list	LIST_EVENT_TYPE_DIGEST	List

Version Benchmarks

Event Name	Event Type	Field Type
version-benchmarks.list	LIST_EVENT_TYPE_VERSION_BENCHMARKS	List
version-benchmarks.get	GET_EVENT_TYPE_VERSION_BENCHMARKS	Get
version-benchmarks.delete	DELETE_EVENT_TYPE_VERSION_BENCHMARKS	Delete
version-benchmarks.create	CREATE_EVENT_TYPE_VERSION_BENCHMARKS	Create
version-benchmarks.update	UPDATE_EVENT_TYPE_VERSION_BENCHMARKS	Update

Webhook Integration

Event Name	Event Type	Field Type
webhook-integration.update	UPDATE_EVENT_TYPE_WEBHOOK_INTEGRATION	Update
webhook-integration.create	CREATE_EVENT_TYPE_WEBHOOK_INTEGRATION	Create
webhook-integration.delete	DELETE_EVENT_TYPE_WEBHOOK_INTEGRATION	Delete
webhook-integration.list	LIST_EVENT_TYPE_WEBHOOK_INTEGRATION	List

Monitoring audit events

To monitor your audit events, take the following steps:

1. Sign in to the team designated as your audit team.
2. View audit events in Explore or Visual Explorer, or create visualizations in Custom Dashboards.

Monitor & query audit events in Explore

Your audit events will appear in the Logs screen in Explore. For any log, click on the left-hand ellipsis and select Show graph for key from the dropdown menu.

This graph shows the breakdown of actions taken on the organization, team, and user levels for actorType.

Create analytics in Custom Dashboards

Create a visual in Custom Dashboards to view audit event analytics.

In this example, the user has created a pie chart to understand the breakdown of events per Coralogix environment. Here you can see the user query failure errors per Coralogix event.