Coralogix Audit

Open in ChatGPTOpen in Claude

Overview

Users with audit permissions can utilize Coralogix audit logs to monitor organizational activity within Coralogix, including all user actions and API operations. This tool empowers you to track actions, ensure compliance, and maintain transparency across your team or organization.

Use Coralogix Audit to:

• Review infrastructure-related user activities like payment or resource configuration changes.
• Track before-and-after states of any system changes.
• Monitor API operations during specific timeframes — from the API call, to the resulting action, and its outcome.
• Create analytics to evaluate activity across your account by product.

How it works

Audit events from your teams (the source teams) are routed to a single designated destination team — the audit team — where they're centralized for querying and analysis. With Audit v2, events are logged and delivered to the audit team in real time as they occur (e.g., when a query is executed or an API operation takes place). These events follow a standardized structure, ensuring efficient querying and compliance-focused analysis.

This page describes Audit v2, the current audit log structure. The earlier structure is covered in Deprecation of Audit v1 schema.

Permissions

To view or manage audit team settings, users must have the required permissions:

Resource	Action	Description
team-auditing	ReadConfig	View team audit settings
team-auditing	UpdateConfig	Manage team audit settings

Membership in the audit team allows you to view audit events.

Setup

Access audit settings

In the main menu, select Settings, then Audit. The page opens with the title Team audit log.

Audit log destination card

The Audit log destination card shows where audit logs from the current team are sent. A badge on the card indicates the current state:

Badge	Meaning
Active	Audit logs from this team are sent to the destination shown on the card.
Inactive	A destination is set, but audit logs from this team aren't being sent to it.
Not configured	No destination has been set yet.

Note

The audit log destination only controls where audit logs are routed — not whether audit data is collected. Audit data collection and datasets are configured in Dataspace Management.

To configure a destination:

1. Select Configure audit destination (first-time setup) or Change destination (to swap an existing destination).
2. In the Change audit log destination drawer, search for the team you want to use as the destination and select Set as destination.
3. In the confirmation dialog, select Change destination.

Use the toggle on the card to activate or deactivate sending audit logs without changing the destination.

Select View audit history on the card to open the destination team filtered to events from the current team. You are redirected to Explore.

Team members card

The Team members card lists members of the current team — the source team whose actions are being audited — not members of the destination audit team.

For each member you can:

• Filter by role or search by name and email.
• Select View user audit logs to open the destination team filtered to that user's events.

If no destination is configured, View user audit logs is unavailable.

Billing & usage

The audit team has a daily quota of up to 25 MB and a retention period of 7 days.

This quota should generally be sufficient for audit purposes. However, using the quota management CLI, you can increase it or reallocate it between teams if needed.

Configure your S3 archive to retain audit logs for longer periods. You can query these logs in Explore or use Background Queries for long-running queries.

Audit events structure

Events follow a unified structure, comprising an audit envelope and an audit payload. Payloads are standardized per event type (e.g., after for create, before/after for update, etc.).

Audit envelope

The envelope structure consists of the following fields:

Field	Description
auditVersion	Audit log structure version (e.g., v2, v3, etc.).
eventName	The name of the event reflects its related features and functionality.
cxFeature	The specific Coralogix feature the event data is related to.
cxFeatureGroup	Stable Coralogix feature groups, used as the subsystem name of each audit event.
eventKind	The type of the event (Action/Update/Delete/Create/Get/List). eventData payload structure is determined by this key.
endpointInfo	Provides connection information, like the protocol used to connect to the system, the IP address that sent the request, and the request protocol.
authDetails	Authentication details that depend on the type of authentication (API key, user login, or internal context).
actorDetails	Details about the actor responsible for the action (organization, user, or team).
eventData	The event payload, which contains details about the resources affected by the event and/or the resources themselves.
outcome	The logical outcome of the actions. Contains the outcome status and failure type if relevant.

Example

 {
    "endpointInfo":{
        "clientInfo":{
            "ipAddress": <ip_address>,
            "userAgent": <user_agent>
        },
        "protocol": "HTTP",
        "httpDetails": {
            "statusCode": 200
        }
    },
    "cxFeatureGroup": "metrics",
    "actorDetails": {
        "actorType": "User",
        "username": <username>,
        "teamId": <team_id>,
        "teamName": <team_name>,
        "orgName": <org_name>
    },
    "auditVersion": "v2",
    "eventData": { 
        ...
    },
    "eventKind": "Action",
    "eventName": "logs-data-api.ReadData",
    "authDetails": {
        "authType": <auth_type>,
        "apiKeyId": <api_key_id>,
        "apiKeyName": <api_key_name>,
        "apiKeyOwnerType": <api_key_owner_type>
    },
    "outcome": {
        "status": "Success",
        "statusMessage": "200 OK"
    },
    "cxFeature": "metrics.data-api"
}

Audit payload

Event type

Each event type has a common payload structure, which is contained in the eventData field and is determined by the event type (eventKind field).

Note

Large payloads are converted to strings and contained in the stringifiedEventData field for increased indexing efficiency.

• Action

  Contains complex event data with varying structure.

• List

  Contains a filter field with the resource request.

  "eventData": {
    "filter": <query>
  }

• Get

  Contains an identifier of the received resource.

  "eventData":{
    "identifier": <resource_id>
  }

• Delete

  Contains the deleted resource.

  "eventData": {
    "data": {
      "displayName": <display_name>,
      "description": <description>,
      "filters": [
        ...
      ],
      "id": <resource_id>
    }
  }

• Create

  Contains the created resource.

  "eventData": {
    "data": {
      "data": { ... },
      "name": <created_resource_name>,
      "id": <resource_id>
    }
  }

• Update

  Contains the original and new versions of a resource.

  "eventData": {
    "before": { ... },
    "after": { ... }
  }

Event type per feature

The following tables list the audit events emitted by each Coralogix feature. For every feature, they show the eventName, its corresponding eventType, and the field type (eventKind) that determines the payload structure. Expand a feature to see the events it produces.

Coralogix custom actions

Event Name	Event Type	Field Type
actions.order	ACTION_EVENT_TYPE_ACTION_ORDER	Action
actions.list	LIST_EVENT_TYPE_ACTION_LIST	List
actions.get	GET_EVENT_TYPE_ACTION_GET	Get
actions.delete	DELETE_EVENT_TYPE_ACTION_DELETE	Delete
actions.create	CREATE_EVENT_TYPE_ACTION_CREATE	Create
actions.update	UPDATE_EVENT_TYPE_ACTION_REPLACE	Update

Access Policies

Event Name	Event Type	Field Type
access-policy.create	CREATE_EVENT_TYPE_ACCESS_POLICY	Create
access-policy.delete	DELETE_EVENT_TYPE_ACCESS_POLICY	Delete
access-policy.update	UPDATE_EVENT_TYPE_ACCESS_POLICY	Update

Alerts

Event Name	Event Type	Field Type
alert.snooze	ACTION_EVENT_TYPE_ALERT_SNOOZE	Action

alerts.list	LIST_EVENT_TYPE_ALERT	List
alerts.get	GET_EVENT_TYPE_ALERT	Get
alerts.delete	DELETE_EVENT_TYPE_ALERT	Delete
alerts.create	CREATE_EVENT_TYPE_ALERT	Create
alerts.update	UPDATE_EVENT_TYPE_ALERT	Update

Alert Scheduler

Event Name	Event Type	Field Type
alert_scheduler.list	LIST_EVENT_TYPE_ALERT_SCHEDULER	List
alert_scheduler.get	GET_EVENT_TYPE_ALERT_SCHEDULER	Get
alert_scheduler.delete	DELETE_EVENT_TYPE_ALERT_SCHEDULER	Delete
alert_scheduler.create	CREATE_EVENT_TYPE_ALERT_SCHEDULER	Create
alert_scheduler.update	UPDATE_EVENT_TYPE_ALERT_SCHEDULER	Update

API Keys

Event Name	Event Type	Field Type
api-key.get	GET_EVENT_TYPE_API_KEY	Get
api-key.delete	DELETE_EVENT_TYPE_API_KEY	Delete
api-key.create	CREATE_EVENT_TYPE_API_KEY	Create
api-key.update	UPDATE_EVENT_TYPE_API_KEY	Update
api-keys.list	LIST_EVENT_TYPE_API_KEY	List
team-api-keys-security-settings.update	UPDATE_EVENT_TYPE_API_KEY_SECURITY_SETTING	Update

APM

Event Name	Event Type	Field Type
apm.entity.action	ACTION_EVENT_TYPE_APM_ENTITY	Action
apm.entity.list	LIST_EVENT_TYPE_APM_ENTITY	List
apm.entity.get	GET_EVENT_TYPE_APM_ENTITY	Get
apm.entity.delete	DELETE_EVENT_TYPE_APM_ENTITY	Delete
apm.entity.create	CREATE_EVENT_TYPE_APM_ENTITY	Create
apm.settings.update	UPDATE_EVENT_TYPE_APM_SETTINGS	Update
apm.entity.update	UPDATE_EVENT_TYPE_APM_ENTITY	Update

Archive Setup

Event Name	Event Type	Field Type
archive-setup.get	GET_EVENT_TYPE_ARCHIVE_SETUP	Get
archive-setup.update	UPDATE_EVENT_TYPE_ARCHIVE_SETUP	Update

Audit Teams

Event Name	Event Type	Field Type
auditing.attach-team	ACTION_EVENT_TYPE_AUDITING_ATTACH_TEAM	Action
auditing.audit-team.create	CREATE_EVENT_TYPE_AUDITING_AUDIT_TEAM	Create
auditing.audit-team.deactivate	ACTION_EVENT_TYPE_AUDITING_DEACTIVATE_AUDIT_TEAM	Action
auditing.audit-team.is-configured	ACTION_EVENT_TYPE_AUDITING_IS_TEAM_CONFIGURES	Action
auditing.audit-teams.list	LIST_EVENT_TYPE_AUDITING_AUDIT_TEAMS	List
auditing.detach-team	ACTION_EVENT_TYPE_AUDITING_DETACH_TEAM	Action

Cases

Event Name	Event Type	Field Type
case.acknowledge	ACTION_EVENT_TYPE_CASE_ACKNOWLEDGE	Action
case.ai-summary.generate	ACTION_EVENT_TYPE_CASE_AI_SUMMARY_GENERATE	Action
case.alert-events.get-cases	ACTION_EVENT_TYPE_CASE_ALERT_EVENTS_GET_CASES	Action
case.alert-events.get-ids	ACTION_EVENT_TYPE_CASE_ALERT_EVENTS_GET_IDS	Action
case.analytics.get-available-filters	ACTION_EVENT_TYPE_CASE_ANALYTICS_GET_AVAILABLE_FILTERS	Action
case.analytics.get-metrics	ACTION_EVENT_TYPE_CASE_ANALYTICS_GET_METRICS	Action
case.analytics.get-overview	ACTION_EVENT_TYPE_CASE_ANALYTICS_GET_OVERVIEW	Action
case.assign	ACTION_EVENT_TYPE_CASE_ASSIGN	Action
case.bulk-acknowledge	ACTION_EVENT_TYPE_CASE_BULK_ACKNOWLEDGE	Action
case.bulk-assign	ACTION_EVENT_TYPE_CASE_BULK_ASSIGN	Action
case.bulk-close	ACTION_EVENT_TYPE_CASE_BULK_CLOSE	Action
case.bulk-priority-override.clear	ACTION_EVENT_TYPE_CASE_BULK_CLEAR_PRIORITY_OVERRIDE	Action
case.bulk-priority-override.set	ACTION_EVENT_TYPE_CASE_BULK_SET_PRIORITY_OVERRIDE	Action
case.bulk-resolve	ACTION_EVENT_TYPE_CASE_BULK_RESOLVE	Action
case.bulk-unassign	ACTION_EVENT_TYPE_CASE_BULK_UNASSIGN	Action
case.close	ACTION_EVENT_TYPE_CASE_CLOSE	Action
case.comments.create	ACTION_EVENT_TYPE_CASE_COMMENTS_CREATE	Action
case.comments.delete	ACTION_EVENT_TYPE_CASE_COMMENTS_DELETE	Action
case.comments.update	ACTION_EVENT_TYPE_CASE_COMMENTS_UPDATE	Action
case.deep-links.get	ACTION_EVENT_TYPE_CASE_GET_DEEP_LINKS	Action
case.events.get	ACTION_EVENT_TYPE_CASE_EVENTS_GET	Action
case.events.list	ACTION_EVENT_TYPE_CASE_EVENTS_LIST	Action
case.events.sync-external	ACTION_EVENT_TYPE_CASE_SYNC_EXTERNAL_EVENTS	Action
case.external-references.get	ACTION_EVENT_TYPE_CASE_GET_EXTERNAL_REFERENCES	Action
case.filter-values.get	ACTION_EVENT_TYPE_CASE_GET_FILTER_VALUES	Action
case.get	GET_EVENT_TYPE_CASE	Get
case.grouping-keys.get	ACTION_EVENT_TYPE_CASE_GET_GROUPING_KEYS	Action
case.list	LIST_EVENT_TYPE_CASE	List
case.notification-delivery.list	LIST_EVENT_TYPE_CASE_NOTIFICATION_DELIVERY	List
case.priority-override.clear	ACTION_EVENT_TYPE_CASE_CLEAR_PRIORITY_OVERRIDE	Action
case.priority-override.set	ACTION_EVENT_TYPE_CASE_SET_PRIORITY_OVERRIDE	Action
case.resolve	ACTION_EVENT_TYPE_CASE_RESOLVE	Action
case.system-defaults.get	ACTION_EVENT_TYPE_CASE_GET_SYSTEM_DEFAULTS	Action
case.unacknowledge	ACTION_EVENT_TYPE_CASE_UNACKNOWLEDGE	Action
case.unassign	ACTION_EVENT_TYPE_CASE_UNASSIGN	Action
case.update	UPDATE_EVENT_TYPE_CASE	Update

Case team configuration

Event Name	Event Type	Field Type
case-team-config.create	CREATE_EVENT_TYPE_CASE_TEAM_CONFIG	Create
case-team-config.delete	DELETE_EVENT_TYPE_CASE_TEAM_CONFIG	Delete
case-team-config.get	GET_EVENT_TYPE_CASE_TEAM_CONFIG	Get
case-team-config.get-active	ACTION_EVENT_TYPE_CASE_TEAM_CONFIG_GET_ACTIVE	Action
case-team-config.update	UPDATE_EVENT_TYPE_CASE_TEAM_CONFIG	Update

Cloud Metadata Enrichment

Event Name	Event Type	Field Type
cloud-metadata-enrichment.delete	DELETE_EVENT_TYPE_CLOUD_METADATA_ENRICHMENT	Delete
cloud-metadata-enrichment.create	CREATE_EVENT_TYPE_CLOUD_METADATA_ENRICHMENT	Create
cloud-metadata-enrichment.update	UPDATE_EVENT_TYPE_CLOUD_METADATA_ENRICHMENT	Update

Continuous Profiling

Event Name	Event Type	Field Type
profiles.symbols.upload	ACTION_EVENT_TYPE_PROFILES_SYMBOLS_UPLOAD	Action
profiles.query	ACTION_EVENT_TYPE_PROFILES_QUERY	Action
profiles.query.graph	ACTION_EVENT_TYPE_PROFILES_QUERY_GRAPH	Action

Custom Enrichment

Event Name	Event Type	Field Type
custom-enrichment.overwrite	ACTION_EVENT_TYPE_OVERWRITE_CUSTOM_ENRICHMENTS	Action
custom-enrichment.delete	DELETE_EVENT_TYPE_CUSTOM_ENRICHMENT	Delete
custom-enrichment.create	CREATE_EVENT_TYPE_CUSTOM_ENRICHMENT	Create
custom-enrichment.update	UPDATE_EVENT_TYPE_CUSTOM_ENRICHMENT	Update
custom-enrichment-data.list	LIST_EVENT_TYPE_CUSTOM_ENRICHMENT_DATA	List
custom-enrichment-data.get	GET_EVENT_TYPE_CUSTOM_ENRICHMENT_DATA	Get
custom-enrichment-data.delete	DELETE_EVENT_TYPE_CUSTOM_ENRICHMENT_DATA	Delete
custom-enrichment-data.create	CREATE_EVENT_TYPE_CUSTOM_ENRICHMENT_DATA	Create
custom-enrichment-data.update	UPDATE_EVENT_TYPE_CUSTOM_ENRICHMENT_DATA	Update

Dashboard Reports

Event Name	Event Type	Field Type
dashboard-report.get	GET_EVENT_TYPE_DASHBOARD_REPORT	Get
dashboard-report-schedule.list	LIST_EVENT_TYPE_DASHBOARD_REPORT_SCHEDULE	List
dashboard-report-schedule.get	GET_EVENT_TYPE_DASHBOARD_REPORT_SCHEDULE	Get
dashboard-report-schedule.delete	DELETE_EVENT_TYPE_DASHBOARD_REPORT_SCHEDULE	Delete
dashboard-report-schedule.create	CREATE_EVENT_TYPE_DASHBOARD_REPORT_SCHEDULE	Create
dashboard-report-schedule.update	UPDATE_EVENT_TYPE_DASHBOARD_REPORT_SCHEDULE	Update

Dashboards

Event Name	Event Type	Field Type
dashboards.list	LIST_EVENT_TYPE_DASHBOARD	List
dashboards.get	GET_EVENT_TYPE_DASHBOARD	Get
dashboards.delete	DELETE_EVENT_TYPE_DASHBOARD	Delete
dashboards.create	CREATE_EVENT_TYPE_DASHBOARD	Create
dashboards.update	UPDATE_EVENT_TYPE_DASHBOARD	Update

Data Usage

Event Name	Event Type	Field Type
datausage.get-daily	ACTION_EVENT_TYPE_GET_DAILY_DATA_USAGE	Action
datausage.export	ACTION_EVENT_TYPE_EXPORT_DETAILED_DATA_USAGE	Action
datausage.data-usage-to-metrics-enable	ACTION_EVENT_TYPE_DATA_USAGE_TO_METRICS_ENABLE	Action

Enrichment

Event Name	Event Type	Field Type
enrichment.list	LIST_EVENT_TYPE_ENRICHMENT	List
enrichment.get	GET_EVENT_TYPE_ENRICHMENT	Get

Events2Metrics

events-2-metrics.list	LIST_EVENT_TYPE_EVENTS_2_METRICS	List
events-2-metrics.get	GET_EVENT_TYPE_EVENTS_2_METRICS	Get
events-2-metrics.delete	DELETE_EVENT_TYPE_EVENTS_2_METRICS	Delete
events-2-metrics.create	CREATE_EVENT_TYPE_EVENTS_2_METRICS	Create
events-2-metrics.update	UPDATE_EVENT_TYPE_EVENTS_2_METRICS	Update

Extensions

Event Name	Event Type	Field Type
extensions.undeploy	ACTION_EVENT_TYPE_EXTENSION_UNDEPLOY	Action
extensions.update	ACTION_EVENT_TYPE_EXTENSION_UPDATE	Action
extensions.deploy	ACTION_EVENT_TYPE_EXTENSION_DEPLOY	Action
extensions.list	LIST_EVENT_TYPE_EXTENSION	List
extensions.get	GET_EVENT_TYPE_EXTENSION	Get

Forwarders

Event Name	Event Type	Field Type
forwarders.test	ACTION_EVENT_TYPE_FORWARDERS_TEST	Action
forwarders.list	LIST_EVENT_TYPE_FORWARDERS	List
forwarders.get	GET_EVENT_TYPE_FORWARDERS	Get
forwarders.delete	DELETE_EVENT_TYPE_FORWARDERS	Delete
forwarders.create	CREATE_EVENT_TYPE_FORWARDERS	Create
forwarders.update	UPDATE_EVENT_TYPE_FORWARDERS	Update

Geo Enrichment

Event Name	Event Type	Field Type
geo-enrichment.delete	DELETE_EVENT_TYPE_GEO_ENRICHMENT	Delete
geo-enrichment.create	CREATE_EVENT_TYPE_GEO_ENRICHMENT	Create
geo-enrichment.update	UPDATE_EVENT_TYPE_GEO_ENRICHMENT	Update

Group

Event Name	Event Type	Field Type
group.delete	DELETE_EVENT_TYPE_GROUP	Delete
group.create	CREATE_EVENT_TYPE_GROUP	Create
group.update	UPDATE_EVENT_TYPE_GROUP	Update

Incidents

Event Name	Event Type	Field Type
incidents.close	ACTION_EVENT_TYPE_INCIDENTS_CLOSE	Action
incidents.assign	ACTION_EVENT_TYPE_INCIDENTS_ASSIGN	Action
incidents.unassign	ACTION_EVENT_TYPE_INCIDENTS_UNASSIGN	Action
incidents.acknowledge	ACTION_EVENT_TYPE_INCIDENTS_ACKNOWLEDGE	Action
incidents.list	LIST_EVENT_TYPE_INCIDENTS	List
incidents.get	GET_EVENT_TYPE_INCIDENTS	Get

Integrations

Event Name	Event Type	Field Type
integration.check-api-key-permission	ACTION_EVENT_TYPE_CHECK_API_KEY_PERMISSION	Action
integration.create	CREATE_EVENT_TYPE_INTEGRATION	Create
integration.definition.get	GET_EVENT_TYPE_INTEGRATION_DEFINITION	Get
integration.delete	DELETE_EVENT_TYPE_INTEGRATION	Delete
integration.details.get	GET_EVENT_TYPE_INTEGRATION_DETAILS	Get
integration.generate-token	ACTION_EVENT_TYPE_INTEGRATION_GENERATE_TOKEN	Action
integration.get	GET_EVENT_TYPE_INTEGRATION	Get
integration.list	LIST_EVENT_TYPE_INTEGRATION	List
integration.quotas.get	GET_EVENT_TYPE_INTEGRATION_QUOTAS	Get
integration.rotate-token	ACTION_EVENT_TYPE_INTEGRATION_ROTATE_TOKEN	Action
integration.rum-app-version.get	GET_EVENT_TYPE_RUM_APPLICATION_VERSION_DATA	Get
integration.sync-rum-data	ACTION_EVENT_TYPE_INTEGRATION_SYNC_RUM_DATA	Action
integration.template.get	GET_EVENT_TYPE_INTEGRATION_TEMPLATE	Get
integration.test	ACTION_EVENT_TYPE_INTEGRATION_TEST	Action
integration.update	UPDATE_EVENT_TYPE_INTEGRATION	Update

Contextual Data Integrations

Event Name	Event Type	Field Type
contextual-data-integration.create	CREATE_EVENT_TYPE_CONTEXTUAL_DATA_INTEGRATION	Create
contextual-data-integration.definition.get	GET_EVENT_TYPE_CONTEXTUAL_DATA_INTEGRATION_DEFINITION	Get
contextual-data-integration.delete	DELETE_EVENT_TYPE_CONTEXTUAL_DATA_INTEGRATION	Delete
contextual-data-integration.details.get	GET_EVENT_TYPE_CONTEXTUAL_DATA_INTEGRATION_DETAILS	Get
contextual-data-integration.list	LIST_EVENT_TYPE_CONTEXTUAL_DATA_INTEGRATION	List
contextual-data-integration.test	ACTION_EVENT_TYPE_CONTEXTUAL_DATA_INTEGRATION_TEST	Action
contextual-data-integration.update	UPDATE_EVENT_TYPE_CONTEXTUAL_DATA_INTEGRATION	Update

Livetail

Event Name	Event Type	Field Type
livetail.subscribe	ACTION_EVENT_TYPE_LIVETAIL_SUBSCRIBE	Action

Logs TCO

Event Name	Event Type	Field Type
logs.tco.test	ACTION_EVENT_TYPE_LOGS_TCO_TEST	Action
logs.tco.order	ACTION_EVENT_TYPE_LOGS_TCO_ORDER	Action
logs.tco.list	LIST_EVENT_TYPE_LOGS_TCO	List
logs.tco.get	GET_EVENT_TYPE_LOGS_TCO	Get
logs.tco.delete	DELETE_EVENT_TYPE_LOGS_TCO	Delete
logs.tco.create	CREATE_EVENT_TYPE_LOGS_TCO	Create
logs.tco.update	UPDATE_EVENT_TYPE_LOGS_TCO	Update

Logs Parsing Rules

Event Name	Event Type	Field Type
logs.parsing-rules.order	ACTION_EVENT_TYPE_LOGS_RULES_GROPS_ORDER	Action
logs.parsing-rules.list	LIST_EVENT_TYPE_LOGS_RULES_GROUP	List
logs.parsing-rules.get	GET_EVENT_TYPE_LOGS_RULES_GROUP	Get
logs.parsing-rules.delete	DELETE_EVENT_TYPE_LOGS_RULES_GROUP	Delete
logs.parsing-rules.create	CREATE_EVENT_TYPE_LOGS_RULES_GROUP	Create
logs.parsing-rules.update	UPDATE_EVENT_TYPE_LOGS_RULES_GROUP	Update

Logs Data API

Event Name	Event Type	Field Type
logs-data-api.ReadData	ACTION_EVENT_TYPE_DATA_API_READ_DATA	Action

Metrics

Event Name	Event Type	Field Type
metrics.data-api.read	ACTION_EVENT_TYPE_METRICS_READ_DATA	Action

Notification Center Presets

Event Name	Event Type	Field Type
notification-center-preset.set-as-default	ACTION_EVENT_TYPE_NOTIFICATION_CENTER_PRESET_SET_AS_DEFAULT	Action
notification-center-preset.delete	DELETE_EVENT_TYPE_NOTIFICATION_CENTER_PRESET	Delete
notification-center-preset.create	CREATE_EVENT_TYPE_NOTIFICATION_CENTER_PRESET	Create
notification-center-preset.update	UPDATE_EVENT_TYPE_NOTIFICATION_CENTER_PRESET	Update
notification-center-preset.get	GET_EVENT_TYPE_NOTIFICATION_CENTER_PRESET	Get
notification-center-preset.list	LIST_EVENT_TYPE_NOTIFICATION_CENTER_PRESET	List

Notification Center Connectors

Event Name	Event Type	Field Type
notification-center-connector.create	CREATE_EVENT_TYPE_NOTIFICATION_CENTER_CONNECTOR	Create
notification-center-connector.delete	DELETE_EVENT_TYPE_NOTIFICATION_CENTER_CONNECTOR	Delete
notification-center-connector.get	GET_EVENT_TYPE_NOTIFICATION_CENTER_CONNECTOR	Get
notification-center-connector.list	LIST_EVENT_TYPE_NOTIFICATION_CENTER_CONNECTOR	List
notification-center-connector.update	UPDATE_EVENT_TYPE_NOTIFICATION_CENTER_CONNECTOR	Update

Notification Center Routers

Event Name	Event Type	Field Type
notification-center-global-router.create	CREATE_EVENT_TYPE_NOTIFICATION_CENTER_GLOBAL_ROUTER	Create
notification-center-global-router.delete	DELETE_EVENT_TYPE_NOTIFICATION_CENTER_GLOBAL_ROUTER	Delete
notification-center-global-router.get	GET_EVENT_TYPE_NOTIFICATION_CENTER_GLOBAL_ROUTER	Get
notification-center-global-router.list	LIST_EVENT_TYPE_NOTIFICATION_CENTER_GLOBAL_ROUTER	List
notification-center-global-router.update	UPDATE_EVENT_TYPE_NOTIFICATION_CENTER_GLOBAL_ROUTER	Update

Organization

Event Name	Event Type	Field Type
organization.add-domain	ACTION_EVENT_TYPE_ADD_DOMAIN	Action
organization.move-quota	ACTION_EVENT_TYPE_MOVE_QUOTA	Action
organization.settings.get	GET_EVENT_TYPE_ORGANIZATION_SETTINGS	Get
organization.settings.update	UPDATE_EVENT_TYPE_ORGANIZATION_SETTINGS	Update
organization.update	UPDATE_EVENT_TYPE_ORGANIZATION	Update

Webhooks

Event Name	Event Type	Field Type
outbound-webhook-types.list	LIST_EVENT_TYPE_OUTBOUND_WEBHOOK_TYPES	List
outbound-webhooks.test	ACTION_EVENT_TYPE_OUTBOUND_WEBHOOK_TEST	Action
outbound-webhooks.list	LIST_EVENT_TYPE_OUTBOUND_WEBHOOK	List
outbound-webhooks.get	GET_EVENT_TYPE_OUTBOUND_WEBHOOK	Get
outbound-webhooks.delete	DELETE_EVENT_TYPE_OUTBOUND_WEBHOOK	Delete
outbound-webhooks.create	CREATE_EVENT_TYPE_OUTBOUND_WEBHOOK	Create
outbound-webhooks.update	UPDATE_EVENT_TYPE_OUTBOUND_WEBHOOK	Update

Recording Rules

Event Name	Event Type	Field Type
recording-rule.delete	DELETE_EVENT_TYPE_RECORDING_RULE	Delete
recording-rule.create	CREATE_EVENT_TYPE_RECORDING_RULE	Create
recording-rule.update	UPDATE_EVENT_TYPE_RECORDING_RULE	Update
recording-rule-group.delete	DELETE_EVENT_TYPE_RECORDING_RULE_GROUP	Delete
recording-rule-group.create	CREATE_EVENT_TYPE_RECORDING_RULE_GROUP	Create
recording-rule-group.update	UPDATE_EVENT_TYPE_RECORDING_RULE_GROUP	Update
recording-rule-group-set.delete	DELETE_EVENT_TYPE_RECORDING_RULE_GROUP_SET	Delete
recording-rule-group-set.create	CREATE_EVENT_TYPE_RECORDING_RULE_GROUP_SET	Create
recording-rule-group-set.update	UPDATE_EVENT_TYPE_RECORDING_RULE_GROUP_SET	Update

Roles

Event Name	Event Type	Field Type
role.list	LIST_EVENT_TYPE_ROLE	List
role.get	GET_EVENT_TYPE_ROLE	Get
role.delete	DELETE_EVENT_TYPE_ROLE	Delete
role.create	CREATE_EVENT_TYPE_ROLE	Create
role.update	UPDATE_EVENT_TYPE_ROLE	Update

RUM

RUM settings

Event Name	Event Type	Field Type
rum-settings.get	GET_EVENT_TYPE_RUM_SETTINGS	Get
rum-settings.update	UPDATE_EVENT_TYPE_RUM_SETTINGS	Update

SDK versions

Event Name	Event Type	Field Type
sdk-version.get	GET_EVENT_TYPE_SDK_VERSION	Get

Session Recording

Event Name	Event Type	Field Type
session-recording.get	GET_EVENT_TYPE_SESSION_RECORDING	Get

Source Map

Event Name	Event Type	Field Type
source-map.get	GET_EVENT_TYPE_SOURCE_MAP	Get

Hide Errors

Event Name	Event Type	Field Type
hide-errors.list	LIST_EVENT_TYPE_HIDE_ERRORS	List
hide-errors.get	GET_EVENT_TYPE_HIDE_ERRORS	Get
hide-errors.delete	DELETE_EVENT_TYPE_HIDE_ERRORS	Delete
hide-errors.create	CREATE_EVENT_TYPE_HIDE_ERRORS	Create
hide-errors.update	UPDATE_EVENT_TYPE_HIDE_ERRORS	Update

Saved Filters

Event Name	Event Type	Field Type
saved-filter.list	LIST_EVENT_TYPE_SAVED_FILTER	List
saved-filter.get	GET_EVENT_TYPE_SAVED_FILTER	Get
saved-filter.delete	DELETE_EVENT_TYPE_SAVED_FILTER	Delete
saved-filter.create	CREATE_EVENT_TYPE_SAVED_FILTER	Create
saved-filter.update	UPDATE_EVENT_TYPE_SAVED_FILTER	Update

SAML

Event Name	Event Type	Field Type
saml.user.email-verification-required	ACTION_EVENT_TYPE_SAML_EMAIL_VERIFICATION_REQUIRED	Action
saml.user.reactivated	ACTION_EVENT_TYPE_SAML_USER_REACTIVATED	Action
saml.user.sso-verification-required	ACTION_EVENT_TYPE_SAML_SSO_VERIFICATION_REQUIRED	Action

SCIM

Event Name	Event Type	Field Type
scim.user.delete	ACTION_EVENT_TYPE_SCIM_DELETE_USER	Action
scim.group.replace	ACTION_EVENT_TYPE_SCIM_REPLACE_GROUP	Action
scim.user.create	ACTION_EVENT_TYPE_SCIM_CREATE_USER	Action
scim.user.replace	ACTION_EVENT_TYPE_SCIM_REPLACE_USER	Action
scim.user.update	ACTION_EVENT_TYPE_SCIM_UPDATE_USER	Action
scim.group.delete	ACTION_EVENT_TYPE_SCIM_DELETE_GROUP	Action
scim.group.update	ACTION_EVENT_TYPE_SCIM_UPDATE_GROUP	Action
scim.group.create	ACTION_EVENT_TYPE_SCIM_CREATE_GROUP	Action
scim.user.list	LIST_EVENT_SCIM_USER	List
scim.group.list	LIST_EVENT_SCIM_GROUP	List
scim.schema.list	LIST_EVENT_SCIM_SCHEMA	List
scim.schema.get	GET_EVENT_SCIM_SCHEMA	Get
scim.user.get	GET_EVENT_SCIM_USER	Get
scim.group.get	GET_EVENT_SCIM_GROUP	Get

Scopes

Event Name	Event Type	Field Type
scopes.list	LIST_EVENT_TYPE_SCOPE_LIST	List
scopes.get	GET_EVENT_TYPE_SCOPE_GET	Get
scopes.delete	DELETE_EVENT_TYPE_SCOPE_DELETE	Delete
scopes.create	CREATE_EVENT_TYPE_SCOPE_CREATE	Create
scopes.update	UPDATE_EVENT_TYPE_SCOPE_UPDATE	Update

Security Enrichments

Event Name	Event Type	Field Type
security-enrichment.delete	DELETE_EVENT_TYPE_SECURITY_ENRICHMENT	Delete
security-enrichment.create	CREATE_EVENT_TYPE_SECURITY_ENRICHMENT	Create
security-enrichment.update	UPDATE_EVENT_TYPE_SECURITY_ENRICHMENT	Update

Spans and Traces Exploration

Event Name	Event Type	Field Type
service-map.get	ACTION_EVENT_TYPE_SERVICE_MAP_GET	Action
spans.count.get	ACTION_EVENT_TYPE_SPANS_COUNT	Action
spans.filters.get	ACTION_EVENT_TYPE_SPANS_FILTERS	Action
spans.graphs.get	ACTION_EVENT_TYPE_SPANS_GRAPHS	Action
spans.lists.highlights	ACTION_EVENT_TYPE_HIGHLIGHTS_LIST_SPANS_HIGHLIGHTS	Action
spans.search	ACTION_EVENT_TYPE_SPANS_SEARCH	Action
traces.count.get	ACTION_EVENT_TYPE_TRACES_COUNT_GET	Action
traces.get	ACTION_EVENT_TYPE_TRACES_GET_TRACE	Action
traces.latency-percentile.get	ACTION_EVENT_TYPE_TRACES_LATENCY_PERCENTILE_GET	Action
traces.search	ACTION_EVENT_TYPE_TRACES_SEARCH	Action

Spans TCO

Event Name	Event Type	Field Type
spans.tco.order	ACTION_EVENT_TYPE_SPANS_TCO_ORDER	Action
spans.tco.list	LIST_EVENT_TYPE_SPANS_TCO	List
spans.tco.get	GET_EVENT_TYPE_SPANS_TCO	Get
spans.tco.delete	DELETE_EVENT_TYPE_SPANS_TCO	Delete
spans.tco.create	CREATE_EVENT_TYPE_SPANS_TCO	Create
spans.tco.update	UPDATE_EVENT_TYPE_SPANS_TCO	Update

SSO

Event Name	Event Type	Field Type
sso.set-idp-parameters	ACTION_EVENT_TYPE_SSO_SET_IDP_PARAMETERS	Action
sso.set-active	ACTION_EVENT_TYPE_SSO_SET_ACTIVE	Action
sso.configuration.get	GET_EVENT_SSO_CONFIGURATION	Get
sso.sp-parameters.get	GET_EVENT_SSO_SP_PARAMETERS	Get
sso.config.update	UPDATE_EVENT_TYPE_SAML_CONFIG	Update
sso.metadata.update	UPDATE_EVENT_TYPE_SAML_METADATA	Update

Team IP Access

Event Name	Event Type	Field Type
team-ip-access.list	LIST_EVENT_TYPE_IP_FILTER	List
team-ip-access.delete	DELETE_EVENT_TYPE_IP_FILTER	Delete
team-ip-access.create	CREATE_EVENT_TYPE_IP_FILTER	Create
team-ip-access.update	UPDATE_EVENT_TYPE_IP_FILTER	Update

Team Management

Event Name	Event Type	Field Type
team-landing-page.update	UPDATE_EVENT_TYPE_TEAM_LANDING_PAGE	Update
team-member.remove	ACTION_EVENT_TYPE_TEAM_MEMBER_REMOVE	Action
team-member.unlock	ACTION_EVENT_TYPE_TEAM_MEMBER_UNLOCK	Action
team-member.add	ACTION_EVENT_TYPE_TEAM_MEMBER_ADD	Action
team-member.invite	ACTION_EVENT_TYPE_TEAM_MEMBER_INVITE	Action
team-member.list	LIST_EVENT_TEAM_MEMBER	List
team-sessions.session-timeout.update	UPDATE_EVENT_TYPE_TEAM_SESSIONS_SESSION_TIMEOUT	Update
team-sessions.force-logout.update	UPDATE_EVENT_TYPE_TEAM_SESSIONS_FORCE_LOGOUT	Update
team-url.update	UPDATE_EVENT_TYPE_TEAM_URL	Update
team-member.create	CREATE_EVENT_TYPE_TEAM_MEMBER_CREATE	Create

team-member.add is deprecated; use team-member.create instead.

Templates

Event Name	Event Type	Field Type
templates.list.read	ACTION_EVENT_TYPE_TEMPLATES_READ_DATA	Action
templates.count.read	ACTION_EVENT_TYPE_TEMPLATES_COUNT_READ_DATA	Action
templates-dates.get	GET_EVENT_TYPE_TEMPLATES_DATES	Get

User Account

Event Name	Event Type	Field Type
user-account.login	ACTION_EVENT_TYPE_USER_ACCOUNT_LOGIN	Action
user-account.mfa-complete-enrolment	ACTION_EVENT_TYPE_USER_ACCOUNT_MFA_COMPLETE_ENROLMENT	Action
user-account.mfa-regenerate-backup-codes	ACTION_EVENT_TYPE_USER_ACCOUNT_MFA_REGENERATE_BACKUP_CODES	Action
user-account.mfa-start-enrolment	ACTION_EVENT_TYPE_USER_ACCOUNT_MFA_START_ENROLMENT	Action
user-account.mfa-unenroll	ACTION_EVENT_TYPE_USER_ACCOUNT_MFA_UNENROLL	Action
user-account.mfa-verification.lock	ACTION_EVENT_TYPE_USER_ACCOUNT_MFA_VERIFICATION_LOCK	Action
user-account.mfa-verification.verify	ACTION_EVENT_TYPE_USER_ACCOUNT_MFA_VERIFICATION_VERIFY	Action
user-account.password-change	ACTION_EVENT_TYPE_USER_ACCOUNT_PASSWORD_CHANGE	Action

User Management

Event Name	Event Type	Field Type
user-landing-page.update	UPDATE_EVENT_TYPE_USER_LANDING_PAGE	Update
user-settings.get	GET_EVENT_TYPE_USER_SETTING	Get
user-settings.update	UPDATE_EVENT_TYPE_USER_SETTING	Update
users-login-methods.update	UPDATE_EVENT_TYPE_USERS_LOGIN_METHODS	Update

Version Benchmarks

Event Name	Event Type	Field Type
version-benchmarks.list	LIST_EVENT_TYPE_VERSION_BENCHMARKS	List
version-benchmarks.get	GET_EVENT_TYPE_VERSION_BENCHMARKS	Get
version-benchmarks.delete	DELETE_EVENT_TYPE_VERSION_BENCHMARKS	Delete
version-benchmarks.create	CREATE_EVENT_TYPE_VERSION_BENCHMARKS	Create
version-benchmarks.update	UPDATE_EVENT_TYPE_VERSION_BENCHMARKS	Update

Views

Event Name	Event Type	Field Type
view.list	LIST_EVENT_TYPE_VIEW	List
view.get	GET_EVENT_TYPE_VIEW	Get
view.delete	DELETE_EVENT_TYPE_VIEW	Delete
view.create	CREATE_EVENT_TYPE_VIEW	Create
view.update	UPDATE_EVENT_TYPE_VIEW	Update

View Folder

Event Name	Event Type	Field Type
view-folder.list	LIST_EVENT_TYPE_VIEW_FOLDER	List
view-folder.get	GET_EVENT_TYPE_VIEW_FOLDER	Get
view-folder.delete	DELETE_EVENT_TYPE_VIEW_FOLDER	Delete
view-folder.create	CREATE_EVENT_TYPE_VIEW_FOLDER	Create
view-folder.update	UPDATE_EVENT_TYPE_VIEW_FOLDER	Update

Monitoring audit events

To monitor your audit events, take the following steps:

1. Sign in to the team designated as your audit team.
2. View audit events in Explore or Visual Explorer, or create visualizations in Custom Dashboards.

Monitor & query audit events in Explore

Your audit events will appear in the Logs screen in Explore. For any log, click on the left-hand ellipsis and select Show graph for key from the dropdown menu.

This graph shows the breakdown of actions taken on the organization, team, and user levels for actorType.

Let’s say an admin is interested in querying users with the most actions taken, grouped by user name and team name. The DataPrime query will look as follows:

source logs | filter actorDetails.username != null | filter actorDetails.teamName != null | groupby actorDetails.username as username, actorDetails.teamName as team_name agg count() as count

Create analytics in Custom Dashboards

Create a visual in Custom Dashboards to view audit event analytics.

In this example, the user has created a pie chart to understand the breakdown of events per Coralogix environment. Here you can see the user query failure errors per Coralogix event.