aaa.audit_events
Note
The payload schema for aaa.audit_events is coming soon.
Purpose
The audit events dataset captures a complete trail of actions across Coralogix features by combining a consistent envelope with an action-specific payload so teams can prove who did what and when, monitor API usage and errors, investigate security and compliance issues, and reconstruct resource changes over time.
Schema description
Every event carries the standard log envelope: engine metadata in $m, labels in $l, and the action-specific payload in $d. The payload fields aren't published yet.
| Field | Type | Required | Description |
|---|---|---|---|
$d | object | Yes | Entity-type-specific payload — shape defined by each entity type's schema |
$l | map | Yes | User labels: free-form string-to-string map |
$l.<key> | string | No | |
$m | object | Yes | Engine metadata |
$m.cxEventId | string (uuid) | Yes | Globally unique event id |
$m.ingressTimestamp | string (date-time) | Yes | Time the event was ingested |
$m.priorityClass | string | Yes | Defines the feature-set enabled for the event One of: high, medium, low. |
$m.severity | string | Yes | Event severity level One of: Verbose, Debug, Info, Warning, Error, Critical. |
$m.timestamp | string (date-time) | Yes | Event timestamp |
Next steps
Review alert evaluation and trigger metadata with alerts.history.
Last updated on