Log Events

Alation Cloud Service Applies to Alation Cloud Service instances of Alation

Customer Managed Applies to customer-managed instances of Alation

This topic shows which events are logged in Alation, along with example log entries. The events are logged in JSON format, and the examples below show the structure of the log entries.

Authentication Events

Available in release 2023.3.2 and later

Alation User Accounts

{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.roles.default_role'])",
    "requestid": "bcae6e68-3734-42ff-86c4-0d47bafa1fdb"
  }
  "level": "EVENT",
  "header": {
    "traceid": "14382265308526883839",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-13T10:28:01.895585"
  },
  "timestamp": "2023-10-13T10:28:01.895770Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "c5cc8fff-35c8-4e4e-bb34-63cbae138c20",
    "action": "site_settings_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": "account_policy",
          "type": "SiteSettings"
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "16985852351481713873",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T08:39:52.962963"
  },
  "timestamp": "2023-10-12T08:39:52.963205Z"
}

Authentication Configuration for External Systems

{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "6afb7ad8-4dbd-47fd-baa5-2604282f1d16",
    "action": "auth_config_method_added",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": "test",
          "type": "external_auth_configuration"
        },
        "attributes": {
          "added": {
            "tenant_id": {
              "value": "12345"
            },
            "vault_url": {
              "value": "https://example.com/"
            },
            "client_id": {
              "value": "id"
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "11948470849732592520",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-13T10:12:34.074278"
  },
  "timestamp": "2023-10-13T10:12:34.074523Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "6afb7ad8-4dbd-47fd-baa5-2604282f1d16",
    "action": "auth_config_method_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": "test",
          "type": "external_auth_configuration"
        },
        "attributes": {
          "updated": {
            "vault_url": {
              "value": "https://example.com/"
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "11948470849732592520",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-13T10:12:34.074278"
  },
  "timestamp": "2023-10-13T10:12:34.074523Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "6afb7ad8-4dbd-47fd-baa5-2604282f1d16",
    "action": "auth_config_method_deleted",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": "test",
          "type": "external_auth_configuration"
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "11948470849732592520",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-13T10:12:34.074278"
  },
  "timestamp": "2023-10-13T10:12:34.074523Z"
}

Authentication Service on Alation Cloud Service

{
  "header":{
    "agentid":"",
    "appname":"authservice",
    "instanceurl":"https://example.com",
    "loglevel":"INFO",
    "tenantid":"12345",
    "timestamp":"2024-09-03T16:08:32.915Z"
  },
  "data":{
    "msg":"Reading all the configurations for a plugin: aws_scm",
    "logger":{
      "name":"alation.authserver.configuration.ConfigManager",
      "fqcn":"org.apache.log4j.Category"
    },
    "thread":{
      "name":"grpc-default-executor-5",
      "id":29,
      "priority":5
    },
    "source":{
      "className":"alation.authserver.configuration.ConfigManager",
      "fileName":"ConfigManager.java",
      "methodName":"readAll",
      "lineNumber":234
    }
  }
}

Authentication Service on the Alation Agent

{
  "header":{
    "agentid":"159e22b2-6a0d-11ef-8d69-8ec357f16d3a",
    "appname":"authservice",
    "instanceurl":"",
    "loglevel":"INFO",
    "tenantid":"12345",
    "timestamp":"2024-09-03T16:11:06.240Z"
  },
  "data":{
    "msg":"Reading all the configurations for a plugin: aws_scm",
    "logger":{
      "name":"alation.authserver.configuration.ConfigManager",
      "fqcn":"org.apache.log4j.Category"
    },
    "thread":{
      "name":"grpc-default-executor-0",
      "id":16,
      "priority":5
    },
    "source":{
      "className":"alation.authserver.configuration.ConfigManager",
      "fileName":"ConfigManager.java",
      "methodName":"readAll",
      "lineNumber":234
    }
  }
}

Authentication Service on Customer-Managed Alation

{
  "header":{
    "agentid":"",
    "appname":"authservice",
    "instanceurl":"http://example.com",
    "loglevel":"INFO",
    "tenantid":"",
    "timestamp":"2024-09-03T16:30:19.900Z"
  },
  "data":{
    "msg":"Reading all the configurations for a plugin: aws_scm",
    "logger":{
      "name":"alation.authserver.configuration.ConfigManager",
      "fqcn":"org.apache.log4j.Category"
    },
    "thread":{
      "name":"grpc-default-executor-1",
      "id":18,
      "priority":5
    },
    "source":{
      "className":"alation.authserver.configuration.ConfigManager",
      "fileName":"ConfigManager.java",
      "methodName":"readAll",
      "lineNumber":234
    }
  }
}

LDAP

{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['user_group_management.sync_from_directory_provider.enabled'])",
    "requestid": "1f1489f9-5668-4154-a9a0-29a821b2d888"
  },
  "level": "EVENT",
  "header": {
    "traceid": "9758985851910129382",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T09:12:17.877085"
  },
  "timestamp": "2023-10-12T09:12:17.881874Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.authentication.builtin.enabled'])",
    "requestid": "1f1489f9-5668-4154-a9a0-29a821b2d888"
  },
  "level": "EVENT",
  "header": {
    "traceid": "9758985851910129382",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T09:12:17.877085"
  },
  "timestamp": "2023-10-12T09:12:17.881874Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.authentication.ldap.enabled'])",
    "requestid": "1f1489f9-5668-4154-a9a0-29a821b2d888"
  },
  "level": "EVENT",
  "header": {
    "traceid": "9758985851910129382",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T09:12:17.877085"
  },
  "timestamp": "2023-10-12T09:12:17.881874Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.authentication.saml.enabled'])",
    "requestid": "1f1489f9-5668-4154-a9a0-29a821b2d888"
  },
  "level": "EVENT",
  "header": {
    "traceid": "9758985851910129382",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T09:12:17.877085"
  },
  "timestamp": "2023-10-12T09:12:17.881874Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.authentication.oidc.enabled'])",
    "requestid": "1f1489f9-5668-4154-a9a0-29a821b2d888"
  },
  "level": "EVENT",
  "header": {
    "traceid": "9758985851910129382",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T09:12:17.877085"
  },
  "timestamp": "2023-10-12T09:12:17.881874Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['user_group_management.sync_from_directory_provider.protocol'])",
    "requestid": "1f1489f9-5668-4154-a9a0-29a821b2d888"
  },
  "level": "EVENT",
  "header": {
    "traceid": "9758985851910129382",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T09:12:17.877085"
  },
  "timestamp": "2023-10-12T09:12:17.881874Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.authentication.ldap.bind_type'])",
    "requestid": "509c92dc-8231-4529-9d23-7de46078153f"
  },
  "level": "EVENT",
  "header": {
    "traceid": "6624534634578512429",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T09:08:05.454572"
  },
  "timestamp": "2023-10-12T09:08:05.454860Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.authentication.ldap.bind_password'])",
    "requestid": "509c92dc-8231-4529-9d23-7de46078153f"
  },
  "level": "EVENT",
  "header": {
    "traceid": "6624534634578512429",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T09:08:05.454572"
  },
  "timestamp": "2023-10-12T09:08:05.454860Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.authentication.ldap.use_ssl'])",
    "requestid": "509c92dc-8231-4529-9d23-7de46078153f"
  },
  "level": "EVENT",
  "header": {
    "traceid": "6624534634578512429",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T09:08:05.454572"
  },
  "timestamp": "2023-10-12T09:08:05.454860Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.authentication.ldap.attr_uid'])",
    "requestid": "509c92dc-8231-4529-9d23-7de46078153f"
  },
  "level": "EVENT",
  "header": {
    "traceid": "6624534634578512429",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T09:08:05.454572"
  },
  "timestamp": "2023-10-12T09:08:05.454860Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.authentication.ldap.attr_photo'])",
    "requestid": "509c92dc-8231-4529-9d23-7de46078153f"
  },
  "level": "EVENT",
  "header": {
    "traceid": "6624534634578512429",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T09:08:05.454572"
  },
  "timestamp": "2023-10-12T09:08:05.454860Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.authentication.ldap.attr_email'])",
    "requestid": "509c92dc-8231-4529-9d23-7de46078153f"
  },
  "level": "EVENT",
  "header": {
    "traceid": "6624534634578512429",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T09:08:05.454572"
  },
  "timestamp": "2023-10-12T09:08:05.454860Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.authentication.ldap.bind_dn'])",
    "requestid": "509c92dc-8231-4529-9d23-7de46078153f"
  },
  "level": "EVENT",
  "header": {
    "traceid": "6624534634578512429",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T09:08:05.454572"
  },
  "timestamp": "2023-10-12T09:08:05.454860Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.authentication.ldap.host'])",
    "requestid": "509c92dc-8231-4529-9d23-7de46078153f"
  },
  "level": "EVENT",
  "header": {
    "traceid": "6624534634578512429",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T09:08:05.454572"
  },
  "timestamp": "2023-10-12T09:08:05.454860Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.authentication.ldap.base_dn'])",
    "requestid": "509c92dc-8231-4529-9d23-7de46078153f"
  },
  "level": "EVENT",
  "header": {
    "traceid": "6624534634578512429",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T09:08:05.454572"
  },
  "timestamp": "2023-10-12T09:08:05.454860Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.authentication.ldap.attr_title'])",
    "requestid": "509c92dc-8231-4529-9d23-7de46078153f"
  },
  "level": "EVENT",
  "header": {
    "traceid": "6624534634578512429",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T09:08:05.454572"
  },
  "timestamp": "2023-10-12T09:08:05.454860Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.authentication.ldap.attr_department'])",
    "requestid": "509c92dc-8231-4529-9d23-7de46078153f"
  },
  "level": "EVENT",
  "header": {
    "traceid": "6624534634578512429",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T09:08:05.454572"
  },
  "timestamp": "2023-10-12T09:08:05.454860Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.authentication.ldap.ts_updated'])",
    "requestid": "509c92dc-8231-4529-9d23-7de46078153f"
  },
  "level": "EVENT",
  "header": {
    "traceid": "6624534634578512429",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T09:08:05.454572"
  },
  "timestamp": "2023-10-12T09:08:05.454860Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.authentication.ldap.group_membership_search_strategy'])",
    "requestid": "509c92dc-8231-4529-9d23-7de46078153f"
  },
  "level": "EVENT",
  "header": {
    "traceid": "6624534634578512429",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T09:08:05.454572"
  },
  "timestamp": "2023-10-12T09:08:05.454860Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.authentication.ldap.attr_group'])",
    "requestid": "509c92dc-8231-4529-9d23-7de46078153f"
  },
  "level": "EVENT",
  "header": {
    "traceid": "6624534634578512429",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T09:08:05.454572"
  },
  "timestamp": "2023-10-12T09:08:05.454860Z"
}
{
  "data":{
    "msg":"",
    "action_initiated_by":"7",
    "requestid":"cf4a9a95-fdf0-4df7-9bd3-13237445e63f",
    "action":"user_login",
    "outcome":"success",
    "event_datum":[
      {
        "resource":{
          "id":7,
          "type":"User"
        },
        "additional_info":{
          "auth_type":"ldap",
          "username":"example"
        }
      }
    ]
  },
  "level":"EVENT",
  "header":{
    "traceid":"4501303498640810056",
    "loglevel":"EVENT",
    "tenantid":"12345",
    "instanceurl":"https://example.com",
    "timestamp":"2023-10-12T11:35:36.386187"
  },
  "timestamp":"2023-10-12T11:35:36.396984Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "7",
    "requestid": "b579d9f7-e31b-4090-be79-5245767c01a8",
    "action": "user_logout",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 7,
          "type": "User"
        },
        "additional_info": {
          "auth_type": "ldap"
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "11008404513631510216",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T11:38:10.687575"
  },
  "timestamp": "2023-10-12T11:38:10.687867Z"
}

OAuth Client Applications

{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "f4e4bd34-c40e-48b2-80ee-9cbed555fd6f",
    "action": "user_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 2,
          "type": "User Profile"
        },
        "attributes": {
          "updated": {
            "is_suspended": {
              "old_value": false,
              "value": false
            }
          }
        }
      },
      {
        "resource": {
          "id": 2,
          "type": "User"
        },
        "attributes": {
          "updated": {
            "is_active": {
              "old_value": false,
              "value": true
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "5568541056296547151",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-13T08:57:08.473277"
  },
  "timestamp": "2023-10-13T08:57:08.479134Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "f4e4bd34-c40e-48b2-80ee-9cbed555fd6f",
    "action": "user_created",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 2,
          "type": "User"
        },
        "attributes": {
          "added": {
            "user_type": {
              "value": 6
            },
            "is_active": {
              "value": true
            },
            "role_val": {
              "value": 0
            },
            "fullname": {
              "value": "oauth-application-test-system-user"
            },
            "title": {
              "value": "OAuth client Application"
            },
            "username": {
              "value": "oauth-application-test-system-user"
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "5568541056296547151",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-13T08:57:08.461242"
  },
  "timestamp": "2023-10-13T08:57:08.461486Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "f4e4bd34-c40e-48b2-80ee-9cbed555fd6f",
    "action": "user_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 2,
          "type": "User"
        },
        "attributes": {
          "updated": {
            "is_active": {
              "value": true
            },
            "username": {
              "value": "oauth-application-test-system-user"
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "5568541056296547151",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-13T08:57:08.461667"
  },
  "timestamp": "2023-10-13T08:57:08.467064Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "f4e4bd34-c40e-48b2-80ee-9cbed555fd6f",
    "action": "user_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 2,
          "type": "User Profile"
        },
        "attributes": {
          "updated": {
            "license": {
              "value": 0
            },
            "role": {
              "value": 0
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "5568541056296547151",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-13T08:57:08.467397"
  },
  "timestamp": "2023-10-13T08:57:08.472903Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "30dcb44a-55bc-4e1b-8e3e-a5969d7bfe71",
    "action": "oauth_v2_client_application_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": "58adc720-cd46-4f5b-8781-91490c6b60b9",
          "type": "oauth_v2_client_application"
        },
        "attributes": {
          "updated": {
            "role": {
              "value": "CATALOG_ADMIN"
            },
            "updated_by_user_uuid": {
              "value": "964e1d49-3bf0-4138-a71a-7989a184f64e"
            },
            "special_user_uuid": {
              "value": "3cecf774-1acc-4a6e-90b9-c8912ef6cb32"
            },
            "is_client_credentials_enabled": {
              "value": true
            },
            "name": {
              "value": "oauth-application-test"
            },
            "access_token_expiry": {
              "value": 3604
            },
            "client_type": {
              "value": "CONFIDENTIAL"
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "4019011997863411796",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-13T09:16:03.689310"
  },
  "timestamp": "2023-10-13T09:16:03.696483Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "30dcb44a-55bc-4e1b-8e3e-a5969d7bfe71",
    "action": "user_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 2,
          "type": "User"
        },
        "attributes": {
          "updated": {
            "user_type": {
              "value": 6
            },
            "is_active": {
              "value": true
            },
            "role_val": {
              "value": 2
            },
            "fullname": {
              "value": "oauth-application-test-system-user"
            },
            "title": {
              "value": "OAuth client Application"
            },
            "username": {
              "value": "oauth-application-test-system-user"
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "4019011997863411796",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-13T09:16:03.682365"
  },
  "timestamp": "2023-10-13T09:16:03.682603Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "30dcb44a-55bc-4e1b-8e3e-a5969d7bfe71",
    "action": "user_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 2,
          "type": "User Profile"
        },
        "attributes": {
          "updated": {
            "license": {
              "old_value": 0,
              "value": 0
            },
            "role": {
              "old_value": 0,
              "value": 2
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "4019011997863411796",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-13T09:16:03.682787"
  },
  "timestamp": "2023-10-13T09:16:03.688892Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "7ffc34ae-18cf-4bc5-94f9-4f5e5ace8e01",
    "action": "oauth_v2_client_application_deleted",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": "58adc720-cd46-4f5b-8781-91490c6b60b9",
          "type": "oauth_v2_client_application"
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "11176605024600238666",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-13T09:32:44.642018"
  },
  "timestamp": "2023-10-13T09:32:44.647807Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "7ffc34ae-18cf-4bc5-94f9-4f5e5ace8e01",
    "action": "user_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 2,
          "type": "User"
        },
        "attributes": {
          "updated": {
            "is_active": {
              "value": false
            },
            "username": {
              "value": "oauth-application-test-system-user"
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "11176605024600238666",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-13T09:32:44.635971"
  },
  "timestamp": "2023-10-13T09:32:44.636219Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "7ffc34ae-18cf-4bc5-94f9-4f5e5ace8e01",
    "action": "user_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 2,
          "type": "User Profile"
        },
        "attributes": {
          "updated": {
            "is_suspended": {
              "old_value": false,
              "value": true
            }
          }
        }
      },
      {
        "resource": {
          "id": 2,
          "type": "User"
        },
        "attributes": {
          "updated": {
            "is_active": {
              "old_value": true,
              "value": false
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "11176605024600238666",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-13T09:32:44.636427"
  },
  "timestamp": "2023-10-13T09:32:44.641872Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "b009df21-c152-4a0e-8455-6b4250834bd3",
    "action": "oauth_v2_client_application_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": "58adc720-cd46-4f5b-8781-91490c6b60b9",
          "type": "oauth_v2_client_application"
        },
        "attributes": {
          "updated": {
            "updated_by_user_uuid": {
              "value": "964e1d49-3bf0-4138-a71a-7989a184f64e"
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "2322177602443315788",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-13T09:30:09.486811"
  },
  "timestamp": "2023-10-13T09:30:09.487066Z"
}
{
  "data": {
    "msg": "Tokens of a client: 58adc720-cd46-4f5b-8781-91490c6b60b9 revoked",
    "action_initiated_by": "1",
    "requestid": "92e937fe-52ad-4aab-b9e3-0a115500e8d7",
    "action": "tokens_revoked",
    "outcome": "success"
  },
  "level": "EVENT",
  "header": {
    "traceid": "18386219518042327472",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-13T09:19:19.399451"
  },
  "timestamp": "2023-10-13T09:19:19.399704Z"
}
{
  "data": {
    "msg": "JWT signing keys rotated for a tenant:251d849c-e6df-46eb-a261-3979950d22ae",
    "action_initiated_by": "1",
    "requestid": "d598625f-4e1e-409e-a511-5958d6a12a17",
    "action": "jwt_signing_keys_rotated",
    "outcome": "success"
  },
  "level": "EVENT",
  "header": {
    "traceid": "2051235247823110039",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-13T09:30:52.608044"
  },
  "timestamp": "2023-10-13T09:30:52.608321Z"
}

OIDC

{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['user_group_management.sync_from_directory_provider.enabled'])",
    "requestid": "0ab5c320-a485-4df9-b217-b3d0500246f4"
  },
  "level": "EVENT",
  "header": {
    "traceid": "10969848557437602915",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T09:46:31.870027"
  },
  "timestamp": "2023-10-12T09:46:31.881659Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['user_group_management.use_groups_to_manage_user_status'])",
    "requestid": "0ab5c320-a485-4df9-b217-b3d0500246f4"
  },
  "level": "EVENT",
  "header": {
    "traceid": "10969848557437602915",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T09:46:31.870027"
  },
  "timestamp": "2023-10-12T09:46:31.881659Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['user_group_management.use_groups_to_assign_user_roles'])",
    "requestid": "0ab5c320-a485-4df9-b217-b3d0500246f4"
  },
  "level": "EVENT",
  "header": {
    "traceid": "10969848557437602915",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T09:46:31.870027"
  },
  "timestamp": "2023-10-12T09:46:31.881659Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "daebad27-64ed-489b-9073-ed261c5221c2",
    "action": "auth_config_method_added",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": "oauth_login_config",
          "type": "external_auth_configuration"
        },
        "attributes": {
          "added": {
            "authorize_endpoint": {
              "value": "https://example.com/authorize"
            },
            "user_info_endpoint": {
              "value": "https://example.com/userinfo"
            },
            "grant_type": {
              "value": "oidc"
            },
            "subject": {
              "value": "email"
            },
            "attribute_mapping": {
              "value": "{\"email\": [\"username\", \"email\"], \"given_name\": [\"first_name\"], \"family_name\": [\"last_name\"], \"https://example.com/title\": [\"title\"]}"
            },
            "scope": {
              "value": "openid,profile,email"
            },
            "oauth_provider_end_session_endpoint": {
              "value": "https://example.com/logout?client_id=OdB3sWr74Rhqsh5VrywRhyIjbGWuXryr"
            },
            "client_id": {
              "value": "OdB3sWr74Rhqsh5VrywRhyIjbGWuXryr"
            },
            "redirect_url": {
              "value": "https://example.com/auth/oidc/callback/?config_name=oauth_login_config"
            },
            "token_endpoint": {
              "value": "https://example.com/oauth/token"
            },
            "is_logout_supported": {
              "value": true
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "15426433948760850835",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T09:38:16.106393"
  },
  "timestamp": "2023-10-12T09:38:16.106755Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "9ca4dddd-8c60-4b9d-a854-bee3fbfa9549",
    "action": "auth_config_method_added",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": "oauth_login_test_config",
          "type": "external_auth_configuration"
        },
        "attributes": {
          "added": {
            "authorize_endpoint": {
              "value": "https://example.com/authorize"
            },
            "user_info_endpoint": {
              "value": "https://example.com/userinfo"
            },
            "grant_type": {
              "value": "oidc"
            },
            "subject": {
              "value": "email"
            },
            "attribute_mapping": {
              "value": "{\"email\": [\"username\", \"email\"], \"given_name\": [\"first_name\"], \"family_name\": [\"last_name\"], \"https://example.com/title\": [\"title\"]}"
            },
            "scope": {
              "value": "openid,profile,email"
            },
            "oauth_provider_end_session_endpoint": {
              "value": "https://example.com/logout?client_id=OdB3sWr74Rhqsh5VrywRhyIjbGWuXryr"
            },
            "client_id": {
              "value": "OdB3sWr74Rhqsh5VrywRhyIjbGWuXryr"
            },
            "redirect_url": {
              "value": "https://example.com/auth/oidc/callback/?config_name=oauth_login_test_config"
            },
            "token_endpoint": {
              "value": "https://example.com/oauth/token"
            },
            "is_logout_supported": {
              "value": true
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "8331639353015385963",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T09:43:17.589448"
  },
  "timestamp": "2023-10-12T09:43:17.589713Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "0af64437-37b3-433e-848d-d1b98ccaa56b",
    "action": "auth_config_method_deleted",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": "oauth_login_test_config",
          "type": "external_auth_configuration"
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "1728267408050124393",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T09:43:20.438469"
  },
  "timestamp": "2023-10-12T09:43:20.456487Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "Unknown",
    "requestid": "9c96b6a2-83ac-4434-bcab-3abd3f8f5b74",
    "action": "login_attempt",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": "oidc",
          "type": "login_authentication_mechanism"
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "3917158863563449450",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T09:58:59.980931"
  },
  "timestamp": "2023-10-12T09:58:59.981201Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "-999999999",
    "requestid": "e811e471-068b-4abf-83db-c837bb53b5af",
    "action": "user_created",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 4,
          "type": "User"
        },
        "additional_info": {
          "auth_type": "oidc"
        },
        "attributes": {
          "added": {
            "is_active": {
              "value": true
            },
            "username": {
              "value": "[EMAIL REDACTED]"
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "4388102010571841269",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T09:59:52.134932"
  },
  "timestamp": "2023-10-12T09:59:52.135204Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "-999999999",
    "requestid": "e811e471-068b-4abf-83db-c837bb53b5af",
    "action": "user_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 4,
          "type": "User Profile"
        },
        "attributes": {
          "updated": {
            "license": {
              "value": 4
            },
            "role": {
              "value": 6
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "4388102010571841269",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T09:59:52.405046"
  },
  "timestamp": "2023-10-12T09:59:52.414654Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "-999999999",
    "requestid": "e811e471-068b-4abf-83db-c837bb53b5af",
    "action": "user_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 4,
          "type": "User"
        },
        "additional_info": {
          "auth_type": "oidc"
        },
        "attributes": {
          "updated": {
            "is_active": {
              "value": true
            },
            "last_name": {
              "value": "Automation1"
            },
            "first_name": {
              "value": "Updated_Firstname"
            },
            "email": {
              "value": "[EMAIL REDACTED]"
            },
            "username": {
              "value": "[EMAIL REDACTED]"
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "4388102010571841269",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T09:59:52.504092"
  },
  "timestamp": "2023-10-12T09:59:52.514528Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "4",
    "requestid": "4a1b6bf2-1d56-4d48-bd83-547d1b3ebdd8",
    "action": "user_logout",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 4,
          "type": "User"
        },
        "additional_info": {
          "auth_type": "oidc"
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "5121145981097685396",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T10:05:29.156086"
  },
  "timestamp": "2023-10-12T10:05:29.156368Z"
}

SAML

{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.authentication.ldap.enabled'])",
    "requestid": "584eeeee-5e11-4c7b-b0c4-464ab6c6b730"
  },
  "level": "EVENT",
  "header": {
    "traceid": "8291655839133883671",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T08:52:19.531774"
  },
  "timestamp": "2023-10-12T08:52:19.539490Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.authentication.builtin.enabled'])",
    "requestid": "584eeeee-5e11-4c7b-b0c4-464ab6c6b730"
  },
  "level": "EVENT",
  "header": {
    "traceid": "8291655839133883671",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T08:52:19.503476"
  },
  "timestamp": "2023-10-12T08:52:19.503725Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.authentication.saml.enabled'])",
    "requestid": "584eeeee-5e11-4c7b-b0c4-464ab6c6b730"
  },
  "level": "EVENT",
  "header": {
    "traceid": "8291655839133883671",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T08:52:19.566092"
  },
  "timestamp": "2023-10-12T08:52:19.572205Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.authentication.oidc.enabled'])",
    "requestid": "584eeeee-5e11-4c7b-b0c4-464ab6c6b730"
  },
  "level": "EVENT",
  "header": {
    "traceid": "8291655839133883671",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T08:52:19.599229"
  },
  "timestamp": "2023-10-12T08:52:19.605082Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.authentication.saml.allow_unsolicited'])",
    "requestid": "c1ff810f-fe53-4443-aa06-e02f92ce60ee"
  },
  "level": "EVENT",
  "header": {
    "traceid": "8643095728368757541",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T08:47:55.673640"
  },
  "timestamp": "2023-10-12T08:47:55.679527Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.authentication.saml.want_response_signed'])",
    "requestid": "c1ff810f-fe53-4443-aa06-e02f92ce60ee"
  },
  "level": "EVENT",
  "header": {
    "traceid": "8643095728368757541",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T08:47:55.572104"
  },
  "timestamp": "2023-10-12T08:47:55.572340Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.authentication.saml.want_assertions_signed'])",
    "requestid": "c1ff810f-fe53-4443-aa06-e02f92ce60ee"
  },
  "level": "EVENT",
  "header": {
    "traceid": "8643095728368757541",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T08:47:55.604201"
  },
  "timestamp": "2023-10-12T08:47:55.610688Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.authentication.saml.use_name_id_as_username'])",
    "requestid": "c1ff810f-fe53-4443-aa06-e02f92ce60ee"
  },
  "level": "EVENT",
  "header": {
    "traceid": "8643095728368757541",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T08:47:55.628590"
  },
  "timestamp": "2023-10-12T08:47:55.634198Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.authentication.saml.force_redirect_binding'])",
    "requestid": "c1ff810f-fe53-4443-aa06-e02f92ce60ee"
  },
  "level": "EVENT",
  "header": {
    "traceid": "8643095728368757541",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T08:47:55.651985"
  },
  "timestamp": "2023-10-12T08:47:55.657002Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.authentication.saml.logout_supported'])",
    "requestid": "c1ff810f-fe53-4443-aa06-e02f92ce60ee"
  },
  "level": "EVENT",
  "header": {
    "traceid": "8643095728368757541",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T08:47:55.696807"
  },
  "timestamp": "2023-10-12T08:47:55.702162Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.authentication.saml.logout_requests_signed'])",
    "requestid": "c1ff810f-fe53-4443-aa06-e02f92ce60ee"
  },
  "level": "EVENT",
  "header": {
    "traceid": "8643095728368757541",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T08:47:55.718426"
  },
  "timestamp": "2023-10-12T08:47:55.725533Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.authentication.saml.name_id_policy_format'])",
    "requestid": "c1ff810f-fe53-4443-aa06-e02f92ce60ee"
  },
  "level": "EVENT",
  "header": {
    "traceid": "8643095728368757541",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T08:47:55.742074"
  },
  "timestamp": "2023-10-12T08:47:55.747526Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.authentication.saml.allow_unknown_attributes'])",
    "requestid": "c1ff810f-fe53-4443-aa06-e02f92ce60ee"
  },
  "level": "EVENT",
  "header": {
    "traceid": "8643095728368757541",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T08:47:55.763783"
  },
  "timestamp": "2023-10-12T08:47:55.769758Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['alation.authentication.saml.entity_id'])",
    "requestid": "c1ff810f-fe53-4443-aa06-e02f92ce60ee"
  },
  "level": "EVENT",
  "header": {
    "traceid": "8643095728368757541",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T08:47:55.786372"
  },
  "timestamp": "2023-10-12T08:47:55.791522Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "138ca135-e282-4dc3-a1ec-143e291e339e",
    "action": "saml_key_pair_generated",
    "outcome": "success"
  },
  "level": "EVENT",
  "header": {
    "traceid": "8935543297980337359",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T08:45:09.342309"
  },
  "timestamp": "2023-10-12T08:45:09.342603Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "362267d7-04f2-4069-8d1d-976f056dd5cb",
    "action": "saml_public.pem_downloaded",
    "outcome": "success"
  },
  "level": "EVENT",
  "header": {
    "traceid": "14862218209604147559",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T08:45:10.632983"
  },
  "timestamp": "2023-10-12T08:45:10.637585Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "91350c98-ebe0-4b1a-8e71-442bf89417b8",
    "action": "saml_idp_metadata_uploaded",
    "outcome": "success"
  },
  "level": "EVENT",
  "header": {
    "traceid": "13500286793418757010",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T08:45:16.702077"
  },
  "timestamp": "2023-10-12T08:45:16.709649Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "Unknown",
    "requestid": "c6583837-4a9c-40ac-bba8-2cf2d8eff02d",
    "action": "login_attempt",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": "saml",
          "type": "login_authentication_mechanism"
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "10693600330416764605",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T11:18:24.951635"
  },
  "timestamp": "2023-10-12T11:18:24.951891Z"
}
{
  "id": "2851",
  "content": {
    "timestamp": "2024-08-27T11:47:23.318+00:00",
    "tags": [
      "dirname:/data1/site_data/logs",
      "source:alationfc",
      "container_name:alationfc",
      "container_id:f9c34ebb58642f5c500784cf44761c235e16deb28d7ce420a3c27da13af2f027",
      "kube_namespace:3d7fad34-3837-40cd-940e-31bc986ca35a",
      "image_tag:19.1.0-84746",
      "env:qa-enterprise-use2",
      "filename:alation-events.log",
      "kube_qos:burstable",
      "service:alationfc",
      "image_id:248135293344.dkr.ecr.us-east-2.amazonaws.com/alationfc@sha256:76e1e6b7fa92ff67b1c6c26c098d2ff6f3c0e9c4898af1774474069f2567d5a9",
      "kube_ownerref_name:alationfc-7894fbd986",
      "pod_name:alationfc-7894fbd986-f766w",
      "kube_container_name:alationfc",
      "kube_deployment:alationfc",
      "tenant:3d7fad34-3837-40cd-940e-31bc986ca35a",
      "kube_replica_set:alationfc-7894fbd986",
      "version:19.1.0-84746",
      "pod_phase:running",
      "short_image:alationfc",
      "kube_ownerref_kind:replicaset",
      "customer:manishranj-log-events",
      "kube_app_name:alationfc",
      "image_name:248135293344.dkr.ecr.us-east-2.amazonaws.com/alationfc",
      "display_container_name:alationfc_alationfc-7894fbd986-f766w",
      "kube_app_instance:t-3d7fad34-3837-40cd-940e-31bc986ca35a-fc-alationfc",
      "datadog.submission_auth:api_key",
      "account_id:874008048685",
      "alpha.rafay.io/nodegroup-name:palation-core-ng-4-v1-24-us-east-2c",
      "alpha.rafay.io/nodegroup-type:managed",
      "availability-zone:us-east-2c",
      "aws_account:874008048685",
      "aws_autoscaling_groupname:eks-palation-core-ng-4-v1-24-us-east-2c-7cc707df-5c58-afd3-99ca-235bae2dd1ce",
      "aws_ec2_fleet-id:fleet-093f5795-4eac-e40d-0c38-83286f4a2b09",
      "aws_ec2launchtemplate_id:lt-0d669e929273ecd6f",
      "aws_ec2launchtemplate_version:1",
      "aws_eks_cluster-name:qa-enterprise-use2",
      "blueprint:infra-terraform-1-24",
      "cloud_provider:aws",
      "cluster_name:qa-enterprise-use2",
      "eks_cluster-name:qa-enterprise-use2",
      "eks_nodegroup-name:palation-core-ng-4-v1-24-us-east-2c",
      "environment:mtqa",
      "iam_profile:eks-7cc707df-5c58-afd3-99ca-235bae2dd1ce",
      "image:ami-02fdef9215bb1f99f",
      "instance-type:m5a.8xlarge",
      "k8s.io/cluster-autoscaler/enabled:true",
      "k8s.io/cluster-autoscaler/node-template/label/node-role.alation.com/catalog:labeled",
      "k8s.io/cluster-autoscaler/node-template/label/node-role.alation.com/catalog_ha:labeled",
      "k8s.io/cluster-autoscaler/qa-enterprise-use2:owned",
      "kernel:none",
      "kube_cluster_name:qa-enterprise-use2",
      "kubernetes.io/cluster/qa-enterprise-use2:owned",
      "name:qa-enterprise-use2-palation-core-ng-4-v1-24-us-east-2c-node",
      "owner:qa-zeus-cluster-infra",
      "project:qa",
      "rafayprojectid:z24x37k",
      "region:us-east-2",
      "security-group:sg-00514680ed1f4b4c4",
      "workspace:mtqa-enterprise-use2"
    ],
    "host": "i-0815050df607be513",
    "service": "alationfc",
    "attributes": {
      "dd": {
        "env": "qa-enterprise-use2"
      },
      "data": {
        "msg": "",
        "action_initiated_by": "Unknown",
        "requestid": "59efab94-762b-403c-905b-b0ef0d0794ef",
        "action": "user_login",
        "outcome": "failure",
        "event_datum": [
          {
            "resource": {
              "id": "saml",
              "type": "login_authentication_mechanism"
            },
            "additional_info": {
              "status_message": "Error during SAML assertion. Please check your SAML settings.",
              "status_name": "SAML error",
              "cause": "error"
            }
          }
        ]
      },
      "header": {
        "traceid": "14069873405874865632",
        "loglevel": "EVENT",
        "tenantid": "12345",
        "instanceurl": "https://example.com",
        "timestamp": "2024-08-27T11:47:22.925210"
      }
    }
  }
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "-999999999",
    "requestid": "d09ef49e-d040-461d-81b0-62a07ff4ab43",
    "action": "user_created",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 6,
          "type": "User"
        },
        "additional_info": {
          "auth_type": "saml"
        },
        "attributes": {
          "added": {
            "is_active": {
              "value": false
            },
            "username": {
              "value": "P[EMAIL REDACTED]"
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "3606400622321803174",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T11:18:35.441379"
  },
  "timestamp": "2023-10-12T11:18:35.441696Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "-999999999",
    "requestid": "d09ef49e-d040-461d-81b0-62a07ff4ab43",
    "action": "user_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 6,
          "type": "User Profile"
        },
        "attributes": {
          "updated": {
            "license": {
              "value": 4
            },
            "role": {
              "value": 6
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "3606400622321803174",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T11:18:35.742623"
  },
  "timestamp": "2023-10-12T11:18:35.755098Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "-999999999",
    "requestid": "d09ef49e-d040-461d-81b0-62a07ff4ab43",
    "action": "user_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 6,
          "type": "User"
        },
        "additional_info": {
          "auth_type": "saml"
        },
        "attributes": {
          "updated": {
            "is_active": {
              "value": false
            },
            "last_name": {
              "value": "Example"
            },
            "first_name": {
              "value": "Example"
            },
            "email": {
              "value": "[EMAIL REDACTED]"
            },
            "username": {
              "value": "[EMAIL REDACTED]"
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "3606400622321803174",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T11:18:35.982579"
  },
  "timestamp": "2023-10-12T11:18:35.993146Z"
}

Compose Events

Available in release 2024.3 and later

Compose Tab of Admin Settings

Each setting has a unique event that is logged when the setting is changed. The event contains the setting name and its new value. Following are some examples.

{
  "data": {
    "action_initiated_by": "1",
    "action": "alation_conf_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "alation_conf",
          "id": "alation.compose.allow_automatic_connection_on_tab_open"
        },
        "attributes": {
        },
        "additional_info": {
        },
        "privileged_command_run": [
        ]
      }
    ],
    "version": null,
    "requestid": null,
    "msg": ""
  },
  "header": {
    "timestamp": "2024-08-14T08:18:35.571691",
    "appname": null,
    "instanceurl": null,
    "tenantid": null,
    "loglevel": "EVENT",
    "traceid": "1017471469372463150"
  },
  "dd.trace_id": "1017471469372463150",
  "dd.span_id": "12683617820945284397",
  "dd.env": ""
}
{
  "data": {
    "action_initiated_by": "1",
    "action": "alation_conf_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "alation_conf",
          "id": "alation.compose.query_export.enabled"
        },
        "attributes": {
        },
        "additional_info": {
        },
        "privileged_command_run": [
        ]
      }
    ],
    "version": null,
    "requestid": null,
    "msg": ""
  },
  "header": {
    "timestamp": "2024-08-14T08:20:07.653356",
    "appname": null,
    "instanceurl": null,
    "tenantid": null,
    "loglevel": "EVENT",
    "traceid": "9787894308986549905"
  },
  "dd.trace_id": "9787894308986549905",
  "dd.span_id": "11202796406027633737",
  "dd.env": ""
}

Compose Tab of Data Source Settings

Each setting has a unique event that is logged when the setting is changed. The event contains the setting name and its new value. Following are some examples.

{
  "data": {
    "action_initiated_by": "1",
    "action": "object_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "Data Source",
          "id": 1
        },
        "attributes": {
          "updated": {
            "allow_export_and_download": {
              "value": true,
              "old_value": false
            },
            "everyone_has_export_and_download_access": {
              "value": true,
              "old_value": false
            },
            "query_result_exporter_groups": {
              "value": [
              ],
              "old_value": [
              ]
            },
            "query_result_exporters": {
              "value": [
              ],
              "old_value": [
              ]
            }
          }
        },
        "additional_info": {
        },
        "privileged_command_run": [
        ]
      }
    ],
    "version": null,
    "requestid": null,
    "msg": ""
  },
  "header": {
    "timestamp": "2024-08-16T14:25:40.497403",
    "appname": null,
    "instanceurl": null,
    "tenantid": null,
    "loglevel": "EVENT",
    "traceid": "25299677736261386"
  },
  "dd.trace_id": "25299677736261386",
  "dd.span_id": "2713153675525935734",
  "dd.env": ""
}
{
  "data": {
    "action_initiated_by": "1",
    "action": "object_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "Data Source",
          "id": "1"
        },
        "attributes": {
          "updated": {
            "allow_preserve_query_result": {
              "value": false,
              "old_value": true
            }
          }
        },
        "additional_info": {
        },
        "privileged_command_run": [
        ]
      }
    ],
    "version": null,
    "requestid": null,
    "msg": ""
  },
  "header": {
    "timestamp": "2024-08-16T14:27:47.283578",
    "appname": null,
    "instanceurl": null,
    "tenantid": null,
    "loglevel": "EVENT",
    "traceid": "675080000347851048"
  },
  "dd.trace_id": "675080000347851048",
  "dd.span_id": "13391033946238044600",
  "dd.env": ""
}
{
  "data": {
    "action_initiated_by": "1",
    "action": "object_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "Data Source",
          "id": "1"
        },
        "attributes": {
          "updated": {
            "result_sharing_permission": {
              "value": 2,
              "old_value": false
            }
          }
        },
        "additional_info": {
        },
        "privileged_command_run": [
        ]
      }
    ],
    "version": null,
    "requestid": null,
    "msg": ""
  },
  "header": {
    "timestamp": "2024-08-16T14:31:56.865284",
    "appname": null,
    "instanceurl": null,
    "tenantid": null,
    "loglevel": "EVENT",
    "traceid": "14308276277991083507"
  },
  "dd.trace_id": "14308276277991083507",
  "dd.span_id": "13043584961632390760",
  "dd.env": ""
}
{
  "data": {
    "action_initiated_by": "1",
    "action": "object_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "Data Source",
          "id": "1"
        },
        "attributes": {
          "updated": {
            "enabled_in_compose": {
              "value": false
            }
          }
        },
        "additional_info": {
        },
        "privileged_command_run": [
        ]
      }
    ],
    "version": null,
    "requestid": null,
    "msg": ""
  },
  "header": {
    "timestamp": "2024-08-16T14:28:18.952382",
    "appname": null,
    "instanceurl": null,
    "tenantid": null,
    "loglevel": "EVENT",
    "traceid": "13603757270310790803"
  },
  "dd.trace_id": "13603757270310790803",
  "dd.span_id": "2287589785832652254",
  "dd.env": ""
}
{
  "data": {
    "action_initiated_by": "1",
    "action": "object_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "OAuth Configuration",
          "id": "2"
        },
        "attributes": {
          "updated": {
            "client_id": {
              "value": "*********",
              "old_value": "*********"
            },
            "client_secret": {
              "value": "*********",
              "old_value": "*********"
            },
            "auth_server": {
              "value": "Three1",
              "old_value": "Three1"
            },
            "token_url": {
              "value": "Four1",
              "old_value": "Four1"
            },
            "expect_jwt": {
              "value": "false",
              "old_value": false
            },
            "username_field": {
              "value": "Seven",
              "old_value": "Seven"
            },
            "default_scope": {
              "value": "Five1",
              "old_value": "Five1"
            },
            "refresh_enabled": {
              "value": "true",
              "old_value": true
            },
            "refresh_scope": {
              "value": "Six1",
              "old_value": "Six1"
            },
            "pkce_enabled": {
              "value": "true",
              "old_value": true
            },
            "ds_id": {
              "value": "1",
              "old_value": 1
            },
            "jdbc_params": {
              "value": {
                "oauth_enablers": "Nine1",
                "access_token_param_name": "Eight1"
              },
              "old_value": {
                "access_token_param_name": "Eight1",
                "oauth_enablers": [
                  "Nine1"
                ]
              }
            }
          }
        },
        "additional_info": {
        },
        "privileged_command_run": [
        ]
      }
    ],
    "version": null,
    "requestid": null,
    "msg": ""
  },
  "header": {
    "timestamp": "2024-08-16T14:30:54.958530",
    "appname": null,
    "instanceurl": null,
    "tenantid": null,
    "loglevel": "EVENT",
    "traceid": "11759125749049874201"
  },
  "dd.trace_id": "11759125749049874201",
  "dd.span_id": "13159436765904752136",
  "dd.env": ""
}

Custom Field Events

Available in release 2024.3.1 and later

{
  "data": {
    "action_initiated_by": "1",
    "action": "field_permission_changed",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "custom_field",
          "id": 6
        },
        "attributes": {
          "updated": {
            "field_permission_changed": {
              "value": {
                "subject_otype": "custom_field",
                "type": "view",
                "subject_id": 6,
                "subject_name": "",
                "rule": []
              },
              "old_value": {
                "type": "view",
                "subject_id": 6,
                "subject_otype": "custom_field",
                "subject_name": "",
                "rule": [
                  {
                    "name": "in_group",
                    "args": [
                      1
                    ]
                  }
                ]
              }
            }
          }
        },
        "additional_info": {},
        "privileged_command_run": []
      }
    ],
    "version": null,
    "requestid": null,
    "msg": "Permission for custom field changed "
  },
  "header": {
    "timestamp": "2024-10-28T10:33:55.799432",
    "appname": null,
    "instanceurl": null,
    "tenantid": null,
    "loglevel": "EVENT",
    "traceid": "4331223552254207818"
  },
  "dd.trace_id": "4331223552254207818",
  "dd.span_id": "8836707918021187114",
  "dd.env": ""
}

Data Source Events

Data Sampling Settings

Available in release 2024.3 and later

{
  "data": {
    "action_initiated_by": "[email protected]",
    "action": "update_config",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "rdbms",
          "id": 2
        },
        "attributes": {
          "updated": {
            "toggle_auto_profiling": {
              "value": false,
              "old_value": true
            }
          }
        },
        "additional_info": {
        },
        "privileged_command_run": [
        ]
      }
    ],
    "version": null,
    "requestid": "b9092bb2-b318-4896-a289-0b066843667b",
    "msg": "rdbms configuration event complete"
  },
  "header": {
    "timestamp": "2024-09-09T12:42:44.675200",
    "appname": null,
    "instanceurl": "https://example.com",
    "tenantid": "12345",
    "loglevel": "EVENT",
    "traceid": "17105453325028196398"
  },
  "dd.trace_id": "17105453325028196398",
  "dd.span_id": "113263135808769643",
  "dd.env": "12345"
}
{
  "data": {
    "action_initiated_by": "1",
    "action": "object_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "Data Source",
          "id": "2"
        },
        "attributes": {
          "updated": {
            "dynamic_sampling": {
              "value": true,
              "old_value": false
            }
          }
        },
        "additional_info": {
        },
        "privileged_command_run": [
        ]
      }
    ],
    "version": null,
    "requestid": "395bcd8e-8cc6-4d5e-b0bd-11c63a54b21e",
    "msg": ""
  },
  "header": {
    "timestamp": "2024-09-09T12:50:50.942574",
    "appname": null,
    "instanceurl": "https://example.com",
    "tenantid": "12345",
    "loglevel": "EVENT",
    "traceid": "4098152286875479168"
  },
  "dd.trace_id": "4098152286875479168",
  "dd.span_id": "11865242117472236121",
  "dd.env": "12345"
}

Data Source Access Settings

Available in release 2023.3.2 and later

{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "9af1fe2a-43ee-4363-b7df-fd253590b2e8",
    "action": "object_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": "2",
          "type": "Data Source"
        },
        "attributes": {
          "updated": {
            "private": {
              "value": [
                "true"
              ]
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "5887267662627565482",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2024-01-11T10:17:03.124989"
  },
  "timestamp": "2024-01-11T10:17:03.125255Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "b99b9feb-13d4-4b9d-9cf7-caeda9b763cd",
    "action": "member_added",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 2,
          "type": "Data Source"
        },
        "attributes": {
          "added": {
            "user_id": {
              "value": 7
            },
            "user_access_level": {
              "value": "viewer"
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "5608334317242302391",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2024-01-11T10:23:23.863292"
  },
  "timestamp": "2024-01-11T10:23:23.863556Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "d2425e85-620a-4f63-a236-c92e0c38c2d4",
    "action": "member_removed",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 2,
          "type": "Data Source"
        },
        "attributes": {
          "deleted": {
            "user_id": {
              "value": 7
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "17911387855262817561",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2024-01-11T10:26:02.569917"
  },
  "timestamp": "2024-01-11T10:26:02.570189Z"
}

Data Source Management

Available in release 2024.3 and later

{
  "data": {
    "action_initiated_by": "[email protected]",
    "action": "create",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "rdbms",
          "id": 2
        },
        "attributes": {
        },
        "additional_info": {
        },
        "privileged_command_run": [
        ]
      }
    ],
    "version": null,
    "requestid": "096eaa28-451c-44b7-85c9-e3d0324ac0b2",
    "msg": "rdbms source create event complete"
  },
  "header": {
    "timestamp": "2024-09-08T17:01:14.670395",
    "appname": null,
    "instanceurl": "https://example.com",
    "tenantid": "12345",
    "loglevel": "EVENT",
    "traceid": "5494515994850988511"
  },
  "dd.trace_id": "5494515994850988511",
  "dd.span_id": "8909152039392842388",
  "dd.env": "12345"
}

Per-Object Parameters

Available in release 2024.3 and later

Each setting on the Per-Object Parameters tab of the data source settings has a unique event that is logged when the setting is changed. The event contains the setting name and its new value. Following are some examples.

{
  "data": {
    "action_initiated_by": "[email protected]",
    "action": "update_data_object_param",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "schema",
          "id": "23"
        },
        "attributes": {
          "updated": {
            "excluded": {
              "value": "false",
              "old_value": true
            }
          }
        },
        "additional_info": {
        },
        "privileged_command_run": [
        ]
      }
    ],
    "version": null,
    "requestid": "aea672e2-30bd-49e4-8763-1660eb6e599a",
    "msg": "Update Data object param completed"
  },
  "header": {
    "timestamp": "2024-09-09T13:08:39.172560",
    "appname": null,
    "instanceurl": "https://example.com",
    "tenantid": "12345",
    "loglevel": "EVENT",
    "traceid": "6647844184291950875"
  },
  "dd.trace_id": "6647844184291950875",
  "dd.span_id": "5874967522646691936",
  "dd.env": "12345"
}
{
  "data": {
    "action_initiated_by": "[email protected]",
    "action": "update_data_object_param",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "schema",
          "id": "23"
        },
        "attributes": {
          "updated": {
            "skip_profiling": {
              "value": "false",
              "old_value": true
            }
          }
        },
        "additional_info": {
        },
        "privileged_command_run": [
        ]
      }
    ],
    "version": null,
    "requestid": "3120dbd3-797a-4383-834c-d35a28e8717a",
    "msg": "Update Data object param completed"
  },
  "header": {
    "timestamp": "2024-09-09T13:09:11.908249",
    "appname": null,
    "instanceurl": "https://example.com",
    "tenantid": "12345",
    "loglevel": "EVENT",
    "traceid": "5429173232611901071"
  },
  "dd.trace_id": "5429173232611901071",
  "dd.span_id": "8480473918271453106",
  "dd.env": "12345"
}

Query Log Ingestion

Available in release 2024.3.1 and later

{
  "data": {
    "action_initiated_by": "[email protected]",
    "action": "update_config",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "rdbms",
          "id": 2
        },
        "attributes": {
          "updated": {
            "toggle_auto_query_import": {
              "value": false,
              "old_value": true
            }
          }
        },
        "additional_info": {
        },
        "privileged_command_run": [
        ]
      }
    ],
    "version": null,
    "requestid": "629e46c5-8acb-44c3-9238-61f3b3fff9ac",
    "msg": "rdbms configuration event complete"
  },
  "header": {
    "timestamp": "2024-09-09T13:25:39.206324",
    "appname": null,
    "instanceurl": "https://example.com",
    "tenantid": "12345",
    "loglevel": "EVENT",
    "traceid": "11762938656767144844"
  },
  "dd.trace_id": "11762938656767144844",
  "dd.span_id": "3984818597598023274",
  "dd.env": "12345"
}
{
  "data": {
    "action_initiated_by": "[email protected]",
    "action": "run_qli_preview",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "rdbms",
          "id": "2"
        },
        "attributes": {
        },
        "additional_info": {
        },
        "privileged_command_run": [
        ]
      }
    ],
    "version": null,
    "requestid": "37ea9649-6294-42bd-a975-b49825c11084",
    "msg": "OCF RDBMS management operation complete"
  },
  "header": {
    "timestamp": "2024-09-18T13:25:22.049880",
    "appname": null,
    "instanceurl": "https://example.com",
    "tenantid": "12345",
    "loglevel": "EVENT",
    "traceid": "3280136090626623149"
  },
  "dd.trace_id": "3280136090626623149",
  "dd.span_id": "4467857501868110587",
  "dd.env": "12345"
}
{
  "data": {
    "action_initiated_by": "[email protected]",
    "action": "import_querylog",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "rdbms",
          "id": 2
        },
        "attributes": {
        },
        "additional_info": {
        },
        "privileged_command_run": [
        ]
      }
    ],
    "version": null,
    "requestid": "94d68387-d01d-4a37-8356-0bda0d899c47",
    "msg": "Query Log Ingestion Job triggered"
  },
  "header": {
    "timestamp": "2024-09-18T13:29:02.243535",
    "appname": null,
    "instanceurl": "https://example.com",
    "tenantid": "12345",
    "loglevel": "EVENT",
    "traceid": "13001347869565097971"
  },
  "dd.trace_id": "13001347869565097971",
  "dd.span_id": "7923478357890618888",
  "dd.env": "12345"
}

Table Access Settings

Available in release 2023.3.2 and later

{
  "data": {
    "msg": "",
    "action_initiated_by": "2",
    "requestid": "242b71a5-ec13-4a2d-b864-5eda775f7151",
    "action": "object_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 7583311,
          "type": "Table"
        },
        "attributes": {
          "updated": {
            "restriction_level_type": {
              "old_value": "EXPLICIT",
              "value": "EXPLICIT"
            },
            "restriction_privacy_type": {
              "old_value": "PUBLIC",
              "value": "PRIVATE"
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "6594866677716156119",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-16T09:31:37.190843"
  },
  "timestamp": "2023-10-16T09:31:37.190999Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "2",
    "requestid": "242b71a5-ec13-4a2d-b864-5eda775f7151",
    "action": "permissions_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 7583311,
          "type": "Table"
        },
        "attributes": {
          "updated": {
            "action": {
              "value": "VIEW"
            },
            "principals": {
              "value": [
                "user:1",
                "user:71",
                "user:3",
                "user:2",
                "user:5",
                "builtin_principal:1"
              ]
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "6594866677716156119",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-16T09:31:37.190411"
  },
  "timestamp": "2023-10-16T09:31:37.190641Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "2",
    "requestid": "c959e158-cc6d-49f7-9fe2-2706de0ec8e4",
    "action": "object_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 7583311,
          "type": "Table"
        },
        "attributes": {
          "updated": {
            "restriction_level_type": {
              "old_value": "INHERIT",
              "value": "EXPLICIT"
            },
            "restriction_privacy_type": {
              "old_value": "PUBLIC",
              "value": "PUBLIC"
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "174973640321785552",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-16T09:28:41.897165"
  },
  "timestamp": "2023-10-16T09:28:41.897292Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "2",
    "requestid": "c959e158-cc6d-49f7-9fe2-2706de0ec8e4",
    "action": "permissions_added",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 7583311,
          "type": "Table"
        },
        "attributes": {
          "added": {
            "action": {
              "value": "VIEW"
            },
            "principals": {
              "value": [
                "user:1",
                "user:2",
                "user:71",
                "user:5",
                "builtin_principal:0",
                "user:3",
                "builtin_principal:1"
              ]
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "174973640321785552",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-16T09:28:41.896716"
  },
  "timestamp": "2023-10-16T09:28:41.896982Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "2",
    "requestid": "6ec3834d-523b-490a-83a5-09a10e183dab",
    "action": "member_added",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 7583311,
          "type": "Table"
        },
        "attributes": {
          "added": {
            "user": {
              "value": [
                16
              ]
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "876470271294430719",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-16T09:33:34.715978"
  },
  "timestamp": "2023-10-16T09:33:34.716108Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "2",
    "requestid": "6ec3834d-523b-490a-83a5-09a10e183dab",
    "action": "permissions_added",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 7583311,
          "type": "Table"
        },
        "attributes": {
          "added": {
            "action": {
              "value": "VIEW"
            },
            "principals": {
              "value": [
                "user:16"
              ]
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "876470271294430719",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-16T09:33:34.715365"
  },
  "timestamp": "2023-10-16T09:33:34.715781Z"
}

Document Hub Events

Available in release 2024.3.3 and later

{
  "data": {
    "action_initiated_by": "[email protected]",
    "action": "granular_update_documentation_object_privacy",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "glossary_v3",
          "id": 1
        },
        "attributes": {
          "updated": {
            "privacy": {
              "value": "TO_PRIVATE"
            }
          }
        },
        "additional_info": {},
        "privileged_command_run": []
      }
    ],
    "version": null,
    "requestid": null,
    "msg": "Granular object privacy settings updated"
  },
  "header": {
    "timestamp": "2024-10-21T19:25:48.472180",
    "appname": null,
    "instanceurl": null,
    "tenantid": null,
    "loglevel": "EVENT",
    "traceid": "12862908661429701826"
  },
  "dd.trace_id": "12862908661429701826",
  "dd.span_id": "5722379082399556322",
  "dd.env": ""
}
{
  "data": {
    "action_initiated_by": "1",
    "action": "permissions_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "Glossary",
          "id": 1
        },
        "attributes": {
          "updated": {
            "action": {
              "value": "VIEW"
            },
            "principals": {
              "value": [
                "user:1",
                "group:1",
                "user:2",
                "group:2"
              ]
            }
          }
        },
        "additional_info": {},
        "privileged_command_run": []
      }
    ],
    "version": null,
    "requestid": null,
    "msg": ""
  },
  "header": {
    "timestamp": "2024-10-21T19:25:48.443658",
    "appname": null,
    "instanceurl": null,
    "tenantid": null,
    "loglevel": "EVENT",
    "traceid": "12862908661429701826"
  },
  "dd.trace_id": "12862908661429701826",
  "dd.span_id": "5722379082399556322",
  "dd.env": ""
}
{
  "data": {
    "action_initiated_by": "1",
    "action": "permissions_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "Glossary",
          "id": 1
        },
        "attributes": {
          "updated": {
            "action": {
              "value": "EDIT"
            },
            "principals": {
              "value": [
                "user:1",
                "group:1",
                "group:2"
              ]
            }
          }
        },
        "additional_info": {},
        "privileged_command_run": []
      }
    ],
    "version": null,
    "requestid": null,
    "msg": ""
  },
  "header": {
    "timestamp": "2024-10-21T19:25:48.457064",
    "appname": null,
    "instanceurl": null,
    "tenantid": null,
    "loglevel": "EVENT",
    "traceid": "12862908661429701826"
  },
  "dd.trace_id": "12862908661429701826",
  "dd.span_id": "5722379082399556322",
  "dd.env": ""
}
{
  "data": {
    "action_initiated_by": "1",
    "action": "permissions_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "Glossary",
          "id": 1
        },
        "attributes": {
          "updated": {
            "action": {
              "value": "CHANGE_MEMBERS"
            },
            "principals": {
              "value": [
                "user:1",
                "group:1",
                "group:2"
              ]
            }
          }
        },
        "additional_info": {},
        "privileged_command_run": []
      }
    ],
    "version": null,
    "requestid": null,
    "msg": ""
  },
  "header": {
    "timestamp": "2024-10-21T19:25:48.469091",
    "appname": null,
    "instanceurl": null,
    "tenantid": null,
    "loglevel": "EVENT",
    "traceid": "12862908661429701826"
  },
  "dd.trace_id": "12862908661429701826",
  "dd.span_id": "5722379082399556322",
  "dd.env": ""
}

File System Events

Available in release 2024.3.2 and later

{
  "data": {
    "action_initiated_by": "[email protected]",
    "action": "fs_update_visibility",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "filesystem",
          "id": 8
        },
        "attributes": {
          "updated": {
            "private": {
              "value": false,
              "old_value": true
            }
          }
        },
        "additional_info": {
        },
        "privileged_command_run": [
        ]
      }
    ],
    "version": null,
    "requestid": "512ab5c9-9c34-46db-adf6-03d101cb4f7f",
    "msg": "Filesystem update event complete"
  },
  "header": {
    "timestamp": "2024-09-10T14:00:30.213553",
    "appname": null,
    "instanceurl": "https://example.com",
    "tenantid": "12345",
    "loglevel": "EVENT",
    "traceid": "9080380969280940132"
  },
  "dd.trace_id": "9080380969280940132",
  "dd.span_id": "8799639066317624330",
  "dd.env": "12345"
}
{
  "data": {
    "action_initiated_by": "[email protected]",
    "action": "member_add",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "filesystem",
          "id": 8
        },
        "attributes": {
          "added": {
            "member_id": {
              "value": "2"
            }
          }
        },
        "additional_info": {
        },
        "privileged_command_run": [
        ]
      }
    ],
    "version": null,
    "requestid": "454ad1ef-eed0-4954-815c-3370ffc2459b",
    "msg": "Filesystem member addition event completed"
  },
  "header": {
    "timestamp": "2024-09-10T13:54:28.479918",
    "appname": null,
    "instanceurl": "https://example.com",
    "tenantid": "12345",
    "loglevel": "EVENT",
    "traceid": "10456636346153472177"
  },
  "dd.trace_id": "10456636346153472177",
  "dd.span_id": "10817751154489721412",
  "dd.env": "12345"
}
{
  "data": {
    "action_initiated_by": "[email protected]",
    "action": "member_update",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "filesystem",
          "id": 8
        },
        "attributes": {
          "updated": {
            "member_id": {
              "value": "2"
            },
            "access_level": {
              "value": "fs_admin",
              "old_value": "viewer"
            }
          }
        },
        "additional_info": {
        },
        "privileged_command_run": [
        ]
      }
    ],
    "version": null,
    "requestid": "22e492d7-ec75-4e7a-b114-34cb2b6fd314",
    "msg": "Filesystem member update event completed"
  },
  "header": {
    "timestamp": "2024-09-10T13:55:11.654737",
    "appname": null,
    "instanceurl": "https://example.com",
    "tenantid": "12345",
    "loglevel": "EVENT",
    "traceid": "12106179479159414207"
  },
  "dd.trace_id": "12106179479159414207",
  "dd.span_id": "17349288282487676762",
  "dd.env": "12345"
}
{
  "data": {
    "action_initiated_by": "[email protected]",
    "action": "member_delete",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "filesystem",
          "id": 8
        },
        "attributes": {
          "deleted": {
            "member_id": {
              "value": "2"
            }
          }
        },
        "additional_info": {
        },
        "privileged_command_run": [
        ]
      }
    ],
    "version": null,
    "requestid": "70cce1c6-079c-49fe-9561-be66e2e3239b",
    "msg": "Filesystem member delete event completed"
  },
  "header": {
    "timestamp": "2024-09-10T13:59:55.068379",
    "appname": null,
    "instanceurl": "https://example.com",
    "tenantid": "12345",
    "loglevel": "EVENT",
    "traceid": "2434378279129307026"
  },
  "dd.trace_id": "2434378279129307026",
  "dd.span_id": "5426236520798080388",
  "dd.env": "12345"
}

License Events

Available in release 2023.3.2 and later

{
  "data": {
    "requester": "964e1d49-3bf0-4138-a71a-7989a184f64e",
    "msg": "Conf updates for $dict_keys(['alation.install.license.path'])",
    "requestid": "382acab3-3b0c-4a36-bbe1-8168c1452c6d"
  },
  "level": "EVENT",
  "header": {
    "traceid": "6741770202165515532",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-13T08:51:47.374009"
  },
  "timestamp": "2023-10-13T08:51:47.374323Z"
}
{
  "data": {
    "requester": "964e1d49-3bf0-4138-a71a-7989a184f64e",
    "msg": "Conf updates for $dict_keys(['alation.install.site_id'])",
    "requestid": "382acab3-3b0c-4a36-bbe1-8168c1452c6d"
  },
  "level": "EVENT",
  "header": {
    "traceid": "6741770202165515532",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-13T08:51:47.435379"
  },
  "timestamp": "2023-10-13T08:51:47.442355Z"
}
{
  "data": {
    "requester": "964e1d49-3bf0-4138-a71a-7989a184f64e",
    "msg": "Conf updates for $dict_keys(['customer.agent.auth_token'])",
    "requestid": "382acab3-3b0c-4a36-bbe1-8168c1452c6d"
  },
  "level": "EVENT",
  "header": {
    "traceid": "6741770202165515532",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-13T08:51:47.460096"
  },
  "timestamp": "2023-10-13T08:51:47.465514Z"
}

Query Events

Available in release 2024.3 and later

Query Management

{
  "data": {
    "action_initiated_by": "1",
    "action": "object_added",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "Query",
          "id": 60
        },
        "attributes": {},
        "additional_info": {},
        "privileged_command_run": []
      }
    ],
    "version": null,
    "requestid": null,
    "msg": ""
  },
  "header": {
    "timestamp": "2024-08-16T09:17:20.878947",
    "appname": null,
    "instanceurl": null,
    "tenantid": null,
    "loglevel": "EVENT",
    "traceid": "4097492132144942798"
  },
  "dd.trace_id": "4097492132144942798",
  "dd.span_id": "8447862410934656198",
  "dd.env": ""
}
{
  "data": {
    "action_initiated_by": "1",
    "action": "object_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "Query",
          "id": 63
        },
        "attributes": {
          "updated": {
            "discarded": {
              "value": true,
              "old_value": false
            }
          }
        },
        "additional_info": {
        },
        "privileged_command_run": [
        ]
      }
    ],
    "version": null,
    "requestid": null,
    "msg": ""
  },
  "header": {
    "timestamp": "2024-08-16T10:19:05.581577",
    "appname": null,
    "instanceurl": null,
    "tenantid": null,
    "loglevel": "EVENT",
    "traceid": "15174689794706902711"
  },
  "dd.trace_id": "15174689794706902711",
  "dd.span_id": "11870250684530872956",
  "dd.env": ""
}
{
  "data": {
    "action_initiated_by": "1",
    "action": "query_explain_run",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "Query",
          "id": "64"
        },
        "attributes": {
        },
        "additional_info": {
          "query_id": 64,
          "session_id": "2024-08-16T14:48:51.599Z#29e8f3faeee0a",
          "uri": "postgresql://host.docker.internal:1234/example",
          "schema_name": null,
          "run_index": 3,
          "stmt_index": 0,
          "stmts": [
            "SELECT * FROM account;"
          ],
          "is_script": false,
          "run_variables": {
          },
          "export_file_format": "csv"
        },
        "privileged_command_run": [
        ]
      }
    ],
    "version": null,
    "requestid": null,
    "msg": ""
  },
  "header": {
    "timestamp": "2024-08-16T14:49:22.768497",
    "appname": null,
    "instanceurl": null,
    "tenantid": null,
    "loglevel": "EVENT",
    "traceid": "13128526231946958115"
  },
  "dd.trace_id": "13128526231946958115",
  "dd.span_id": "5125322532987674574",
  "dd.env": ""
}
{
  "data": {
    "action_initiated_by": "1",
    "action": "object_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "Query",
          "id": 61
        },
        "attributes": {
          "updated": {
            "autosave_content": {
              "value": null,
              "old_value": "select * from account;nSELECT * from public.user;n"
            },
            "cursor_row": {
              "value": 0,
              "old_value": 2
            }
          }
        },
        "additional_info": {},
        "privileged_command_run": []
      }
    ],
    "version": null,
    "requestid": null,
    "msg": ""
  },
  "header": {
    "timestamp": "2024-08-16T09:26:46.834647",
    "appname": null,
    "instanceurl": null,
    "tenantid": null,
    "loglevel": "EVENT",
    "traceid": "7180237462891065562"
  },
  "dd.trace_id": "7180237462891065562",
  "dd.span_id": "3460991975786812815",
  "dd.env": ""
}
{
  "data": {
    "action_initiated_by": "1",
    "action": "object_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "Query",
          "id": "62"
        },
        "attributes": {
          "updated": {
            "everyone_permission": {
              "value": 0,
              "old_value": 0
            },
            "viewers": {
              "value": [
              ],
              "old_value": [
              ]
            },
            "runners": {
              "value": [
                2
              ],
              "old_value": [
                2
              ]
            },
            "collaborators": {
              "value": [
              ],
              "old_value": [
              ]
            },
            "viewer_groups": {
              "value": [
              ],
              "old_value": [
              ]
            },
            "runner_groups": {
              "value": [
              ],
              "old_value": [
              ]
            },
            "collaborator_groups": {
              "value": [
                1
              ],
              "old_value": [
              ]
            },
            "owner": {
              "value": 1,
              "old_value": 1
            }
          }
        },
        "additional_info": {
        },
        "privileged_command_run": [
        ]
      }
    ],
    "version": null,
    "requestid": null,
    "msg": ""
  },
  "header": {
    "timestamp": "2024-08-16T14:34:38.507306",
    "appname": null,
    "instanceurl": null,
    "tenantid": null,
    "loglevel": "EVENT",
    "traceid": "6683910967986479360"
  },
  "dd.trace_id": "6683910967986479360",
  "dd.span_id": "2863219286849147000",
  "dd.env": ""
}

Query Execution

{
  "data": {
    "action_initiated_by": "1",
    "action": "query_run_initiated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "Query",
          "id": "62"
        },
        "attributes": {
        },
        "additional_info": {
          "sandbox_id": "compose-shared",
          "session_id": "2024-08-16T09:25:17.170Z#761fd53bcad2",
          "run_id": 2,
          "stmt_index": 0,
          "stmts": [
            "select * from account;",
            "SELECT * from public.user;"
          ],
          "client_addr": "192.168.65.1",
          "schedule_id": null,
          "export_file_format": "csv",
          "uri": "postgresql://host.docker.internal:1234/example"
        },
        "privileged_command_run": [
        ]
      }
    ],
    "version": null,
    "requestid": null,
    "msg": ""
  },
  "header": {
    "timestamp": "2024-08-16T14:45:06.430740",
    "appname": null,
    "instanceurl": null,
    "tenantid": null,
    "loglevel": "EVENT",
    "traceid": "9767998803333002109"
  },
  "dd.trace_id": "9767998803333002109",
  "dd.span_id": "3540183202931206243",
  "dd.env": ""
}
{
  "data": {
    "action_initiated_by": "1",
    "action": "query_result_exported",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "Query",
          "id": 58
        },
        "attributes": {
        },
        "additional_info": {
          "download_type": "QUERY_EXPORT"
        },
        "privileged_command_run": [
        ]
      }
    ],
    "version": null,
    "requestid": null,
    "msg": ""
  },
  "header": {
    "timestamp": "2024-08-16T15:19:30.918081",
    "appname": null,
    "instanceurl": null,
    "tenantid": null,
    "loglevel": "EVENT",
    "traceid": "9389207397292558313"
  },
  "dd.trace_id": "9389207397292558313",
  "dd.span_id": "10243660021263513183",
  "dd.env": ""
}
{
  "data": {
    "action_initiated_by": "1",
    "action": "object_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "Result",
          "id": "382"
        },
        "attributes": {
          "updated": {
            "oid": {
              "value": 382
            },
            "otype": {
              "value": "execution_result"
            },
            "added_user_ids": {
              "value": [
              ]
            },
            "removed_user_ids": {
              "value": [
              ]
            },
            "added_group_profile_ids": {
              "value": [
              ]
            },
            "removed_group_ids": {
              "value": [
              ]
            },
            "public": {
              "value": true
            }
          }
        },
        "additional_info": {
        },
        "privileged_command_run": [
        ]
      }
    ],
    "version": null,
    "requestid": null,
    "msg": ""
  },
  "header": {
    "timestamp": "2024-08-16T10:56:06.112214",
    "appname": null,
    "instanceurl": null,
    "tenantid": null,
    "loglevel": "EVENT",
    "traceid": "4078285374862209847"
  },
  "dd.trace_id": "4078285374862209847",
  "dd.span_id": "11210079498453591073",
  "dd.env": ""
}

Scheduled Queries

{
  "data": {
    "action_initiated_by": "1",
    "action": "object_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "scheduledqueryrun",
          "id": 6
        },
        "attributes": {
          "updated": {
            "cron": {
              "value": "0 0 * * 0"
            },
            "enabled": {
              "value": true
            },
            "cron_type": {
              "value": 0
            },
            "timezone": {
              "value": "Asia/Calcutta"
            }
          }
        },
        "additional_info": {},
        "privileged_command_run": []
      }
    ],
    "version": null,
    "requestid": null,
    "msg": ""
  },
  "header": {
    "timestamp": "2024-08-16T15:25:00.833611",
    "appname": null,
    "instanceurl": null,
    "tenantid": null,
    "loglevel": "EVENT",
    "traceid": "13219117563083175882"
  },
  "dd.trace_id": "13219117563083175882",
  "dd.span_id": "13382573531172960528",
  "dd.env": ""
}
{
  "data": {
    "action_initiated_by": "1",
    "action": "object_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "scheduledqueryrun",
          "id": 6
        },
        "attributes": {
          "updated": {
            "saved_connection_id": {
              "value": 1
            },
            "db_credential_id": {
              "value": 1
            }
          }
        },
        "additional_info": {},
        "privileged_command_run": []
      }
    ],
    "version": null,
    "requestid": null,
    "msg": ""
  },
  "header": {
    "timestamp": "2024-08-16T15:25:26.701908",
    "appname": null,
    "instanceurl": null,
    "tenantid": null,
    "loglevel": "EVENT",
    "traceid": "9085381698301931734"
  },
  "dd.trace_id": "9085381698301931734",
  "dd.span_id": "11909180243952133884",
  "dd.env": ""
}
{
  "data": {
    "action_initiated_by": "1",
    "action": "site_settings_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "type": "SiteSettings",
          "id": "misc_settings"
        },
        "attributes": {},
        "additional_info": {},
        "privileged_command_run": []
      }
    ],
    "version": null,
    "requestid": null,
    "msg": ""
  },
  "header": {
    "timestamp": "2024-08-16T09:13:01.479146",
    "appname": null,
    "instanceurl": null,
    "tenantid": null,
    "loglevel": "EVENT",
    "traceid": "12430602201886344499"
  },
  "dd.trace_id": "12430602201886344499",
  "dd.span_id": "8558194373459731690",
  "dd.env": ""
}

Reply via Email Setting Events

Available in release 2023.3.2 and later

{
  "data": {
    "requester": "e817cb79-02ad-4edf-ba1d-d88cdcd953c7",
    "msg": "Conf updates for $dict_keys(['alation.email.reply_to_email_auth_mode'])",
    "requestid": "dfde6154-d9e7-4a6c-9fc8-1936771acfa9"
  },
  "level": "EVENT",
  "header": {
    "traceid": "11952163920937687963",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-13T07:15:20.427590"
  },
  "timestamp": "2023-10-13T07:15:20.427805Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "2",
    "requestid": "dfde6154-d9e7-4a6c-9fc8-1936771acfa9",
    "action": "mailbox_created",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 1,
          "type": "MailboxSettings"
        },
        "additional_info": {
          "mailbox_name": "reply"
        },
        "attributes": {
          "added": {
            "server": {
              "value": "imap.gmail.com"
            },
            "password": {
              "value": "*********"
            },
            "port": {
              "value": 993
            },
            "use_ssl": {
              "value": true
            },
            "username": {
              "value": "*********"
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "11952163920937687963",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-13T07:15:20.426803"
  },
  "timestamp": "2023-10-13T07:15:20.427201Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "2",
    "requestid": "2a0cc9f1-ff1f-4de3-b91f-b118100f40b3",
    "action": "mailbox_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 1,
          "type": "OAuth2MailboxSettings"
        },
        "additional_info": {
          "mailbox_name": "reply"
        },
        "attributes": {
          "updated": {
            "tenant_id": {
              "value": "12345"
            },
            "address": {
              "value": "[EMAIL REDACTED]"
            },
            "client_secret": {
              "value": "*********"
            },
            "type": {
              "value": "microsoft-oauth2"
            },
            "client_id": {
              "value": "1a149025-5f0c-4727-b059-963f814f0af9"
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "11375198845599647726",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-13T07:04:18.123216"
  },
  "timestamp": "2023-10-13T07:04:18.124602Z"
}
{
  "data": {
    "requester": "e817cb79-02ad-4edf-ba1d-d88cdcd953c7",
    "msg": "Conf updates for $dict_keys(['alation.email.reply_to_email_auth_mode'])",
    "requestid": "2a0cc9f1-ff1f-4de3-b91f-b118100f40b3"
  },
  "level": "EVENT",
  "header": {
    "traceid": "11375198845599647726",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-13T07:04:18.125722"
  },
  "timestamp": "2023-10-13T07:04:18.126351Z"
}
{
  "data": {
    "requester": "e817cb79-02ad-4edf-ba1d-d88cdcd953c7",
    "msg": "Conf updates for $dict_keys(['alation.email.reply_to_email'])",
    "requestid": "2a0cc9f1-ff1f-4de3-b91f-b118100f40b3"
  },
  "level": "EVENT",
  "header": {
    "traceid": "11375198845599647726",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-13T07:04:18.232264"
  },
  "timestamp": "2023-10-13T07:04:18.232812Z"
}
{
  "data": {
    "requester": "e817cb79-02ad-4edf-ba1d-d88cdcd953c7",
    "msg": "Conf updates for $dict_keys(['alation.email.email_intent_tracking_mode'])",
    "requestid": "2a0cc9f1-ff1f-4de3-b91f-b118100f40b3"
  },
  "level": "EVENT",
  "header": {
    "traceid": "11375198845599647726",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-13T07:04:18.322268"
  },
  "timestamp": "2023-10-13T07:04:18.322753Z"
}
{
  "data": {
    "requester": "e817cb79-02ad-4edf-ba1d-d88cdcd953c7",
    "msg": "Conf updates for $dict_keys(['alation.email.enable_reply_via_email'])",
    "requestid": "2a0cc9f1-ff1f-4de3-b91f-b118100f40b3"
  },
  "level": "EVENT",
  "header": {
    "traceid": "11375198845599647726",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-13T07:04:18.346846"
  },
  "timestamp": "2023-10-13T07:04:18.347588Z"
}

User Events

Available in release 2023.3.2 and later

Active Users

{
  "data": {
    "msg": "",
    "action_initiated_by": "3",
    "requestid": "1ddb24a9-7af8-4b63-9521-ab3a74c898ee",
    "action": "user_login",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 3,
          "type": "User"
        },
        "additional_info": {
          "auth_type": "iam",
          "username": "[EMAIL REDACTED]"
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "15403306291714374411",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-11T10:14:36.994733"
  },
  "timestamp": "2023-10-11T10:14:36.994987Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "3",
    "requestid": "981d80e7-b9fc-43a2-97ec-77ed3c74eb59",
    "action": "user_logout",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 3,
          "type": "User"
        },
        "additional_info": {
          "auth_type": "builtin"
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "14534297855189533273",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-11T10:12:32.565148"
  },
  "timestamp": "2023-10-11T10:12:32.565514Z"
}

New Users

{
  "data": {
    "msg": "",
    "action_initiated_by": "2",
    "requestid": "0677feda-50eb-4a8e-89ce-c0222f5fcea1",
    "action": "user_created",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 2,
          "type": "User"
        },
        "additional_info": {
          "auth_type": "builtin"
        },
        "attributes": {
          "added": {
            "is_admin": {
              "value": false
            },
            "password": {
              "value": "******"
            },
            "email": {
              "value": "[EMAIL REDACTED]"
            },
            "username": {
              "value": "[EMAIL REDACTED]"
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "9407706094485254793",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-11T09:27:48.799213"
  },
  "timestamp": "2023-10-11T09:27:48.803488Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "-999999999",
    "requestid": "db98f33e-9a91-4430-9e35-9773ae0100a2",
    "action": "user_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 3,
          "type": "User"
        },
        "additional_info": {
          "auth_type": "iam"
        },
        "attributes": {
          "updated": {
            "password": {
              "value": "*********"
            },
            "is_active": {
              "value": false
            },
            "last_name": {
              "value": ""
            },
            "first_name": {
              "value": "test1"
            },
            "email": {
              "value": "[EMAIL REDACTED]"
            },
            "username": {
              "value": "[EMAIL REDACTED]"
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "1391273607894563861",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-11T09:34:53.949252"
  },
  "timestamp": "2023-10-11T09:34:53.953562Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "3",
    "requestid": "db98f33e-9a91-4430-9e35-9773ae0100a2",
    "action": "user_created",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 3,
          "type": "User"
        },
        "additional_info": {
          "auth_type": "builtin"
        },
        "attributes": {
          "added": {
            "is_admin": {
              "value": false
            },
            "password": {
              "value": "******"
            },
            "email": {
              "value": "[EMAIL REDACTED]"
            },
            "username": {
              "value": "[EMAIL REDACTED]"
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "1391273607894563861",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-11T09:34:53.953734"
  },
  "timestamp": "2023-10-11T09:34:53.957439Z"
}
{
  "data": {
    "msg": "Incorrect credentials.",
    "action_initiated_by": "[EMAIL REDACTED]",
    "requestid": "b1193909-e793-430d-a813-a5b8f64d349e",
    "action": "login_attempt",
    "outcome": "failure",
    "event_datum": [
      {
        "resource": {
          "id": "[EMAIL REDACTED]",
          "type": "User"
        },
        "additional_info": {
          "auth_type": "iam",
          "cause": "failure"
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "2878765699590220658",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-11T09:59:35.278734"
  },
  "timestamp": "2023-10-11T09:59:35.279102Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "8f03f6a0-9aef-45ff-a324-6926716451aa",
    "action": "user_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 3,
          "type": "User"
        },
        "attributes": {
          "updated": {
            "is_active": {
              "value": true
            },
            "username": {
              "value": "[EMAIL REDACTED]"
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "1230527837286322392",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-11T10:04:19.077502"
  },
  "timestamp": "2023-10-11T10:04:19.077740Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "8f03f6a0-9aef-45ff-a324-6926716451aa",
    "action": "user_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 3,
          "type": "User Profile"
        },
        "attributes": {
          "updated": {
            "license": {
              "old_value": 3,
              "value": 0
            },
            "role": {
              "old_value": 3,
              "value": 2
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "1230527837286322392",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-11T10:04:19.077898"
  },
  "timestamp": "2023-10-11T10:04:19.082616Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "8f03f6a0-9aef-45ff-a324-6926716451aa",
    "action": "user_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 3,
          "type": "User Profile"
        },
        "attributes": {
          "updated": {
            "is_suspended": {
              "old_value": false,
              "value": false
            }
          }
        }
      },
      {
        "resource": {
          "id": 3,
          "type": "User"
        },
        "attributes": {
          "updated": {
            "is_active": {
              "old_value": false,
              "value": true
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "1230527837286322392",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-11T10:04:19.082810"
  },
  "timestamp": "2023-10-11T10:04:19.086735Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "8254f6cb-a3e1-4fc4-8056-8630ae839532",
    "action": "user_email_confirmation_bypassed",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 3,
          "type": "User"
        },
        "attributes": {
          "updated": {
            "is_email_confirmed": {
              "old_value": false,
              "value": true
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "12439941891485787286",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-11T10:09:24.012387"
  },
  "timestamp": "2023-10-11T10:09:24.018495Z"
}

Suspended Users

{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "4e56af0f-5568-4f91-bc63-83bcac098706",
    "action": "user_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 2,
          "type": "User Profile"
        },
        "attributes": {
          "updated": {
            "is_suspended": {
              "old_value": false,
              "value": true
            }
          }
        }
      },
      {
        "resource": {
          "id": 2,
          "type": "User"
        },
        "attributes": {
          "updated": {
            "is_active": {
              "old_value": true,
              "value": false
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "8599703654445705160",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T05:39:07.434703"
  },
  "timestamp": "2023-10-12T05:39:07.439761Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "e665a225-1b2c-494b-9b85-2b46be29ba5c",
    "action": "user_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 2,
          "type": "User Profile"
        },
        "attributes": {
          "updated": {
            "is_suspended": {
              "old_value": true,
              "value": false
            }
          }
        }
      },
      {
        "resource": {
          "id": 2,
          "type": "User"
        },
        "attributes": {
          "updated": {
            "is_active": {
              "old_value": false,
              "value": true
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "12589866207479997532",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T05:43:27.177718"
  },
  "timestamp": "2023-10-12T05:43:27.185001Z"
}
{
  "data": {
    "msg": "Incorrect credentials.",
    "action_initiated_by": "[EMAIL REDACTED]",
    "requestid": "c05975a0-aa57-443c-98f7-a1dbb2d42d8b",
    "action": "login_attempt",
    "outcome": "failure",
    "event_datum": [
      {
        "resource": {
          "id": "[EMAIL REDACTED]",
          "type": "User"
        },
        "additional_info": {
          "auth_type": "iam",
          "cause": "failure"
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "12742145379023205923",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T05:41:49.920093"
  },
  "timestamp": "2023-10-12T05:41:49.920485Z"
}

User Details

{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "2c8a161c-f47f-45b6-8ee5-41e681925922",
    "action": "user_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 2,
          "type": "User Profile"
        },
        "attributes": {
          "updated": {
            "license": {
              "old_value": 0,
              "value": 2
            },
            "role": {
              "old_value": 0,
              "value": 1
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "224886999813638724",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T06:00:53.773851"
  },
  "timestamp": "2023-10-12T06:00:53.774117Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "3",
    "requestid": "ffe58a63-4b03-4712-af96-1324100d5069",
    "action": "user_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 3,
          "type": "User"
        },
        "attributes": {
          "updated": {
            "is_active": {
              "value": true
            },
            "email": {
              "value": "[EMAIL REDACTED]"
            },
            "username": {
              "value": "[EMAIL REDACTED]"
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "9486457816820188812",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-11T13:02:29.574237"
  },
  "timestamp": "2023-10-11T13:02:29.574562Z"
}

User Group Events

Available in release 2023.3.2 and later

{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "977245c8-5ae2-47d1-99e9-a7ad545ca671",
    "action": "group_created",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 8,
          "type": "Group"
        },
        "additional_info": {
          "is_builtin": false
        },
        "attributes": {
          "added": {
            "name": {
              "value": "gp1"
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "4735433933777978896",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T11:23:25.047496"
  },
  "timestamp": "2023-10-12T11:23:25.047761Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "f16b6ff0-48ae-4e13-9e61-5613c50c114a",
    "action": "group_updated",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 8,
          "type": "Group"
        },
        "additional_info": {
          "is_builtin": false
        },
        "attributes": {
          "updated": {
            "name": {
              "value": "gp2"
            },
            "target_role": {
              "value": 4
            }
          }
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "8318969528400998178",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T11:44:25.708809"
  },
  "timestamp": "2023-10-12T11:44:25.723631Z"
}
{
  "data": {
    "msg": "",
    "action_initiated_by": "1",
    "requestid": "67b13fc6-b820-449f-aff2-11efe34f79ac",
    "action": "group_deleted",
    "outcome": "success",
    "event_datum": [
      {
        "resource": {
          "id": 8,
          "type": "Group"
        },
        "additional_info": {
          "is_builtin": false
        }
      }
    ]
  },
  "level": "EVENT",
  "header": {
    "traceid": "11715392827207108647",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-13T08:30:12.265957"
  },
  "timestamp": "2023-10-13T08:30:12.273421Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['user_group_management.use_groups_to_manage_user_status'])",
    "requestid": "e3f23df9-b6ed-4bce-bcde-3bc21df63adc"
  },
  "level": "EVENT",
  "header": {
    "traceid": "14240283422153213586",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T11:49:19.317277"
  },
  "timestamp": "2023-10-12T11:49:19.328394Z"
}
{
  "data": {
    "requester": "e2aa96d6-1fda-4ddf-89df-957731b2a5ba",
    "msg": "Conf updates for $dict_keys(['user_group_management.use_groups_to_manage_user_status'])",
    "requestid": "e3f23df9-b6ed-4bce-bcde-3bc21df63adc"
  },
  "level": "EVENT",
  "header": {
    "traceid": "14240283422153213586",
    "loglevel": "EVENT",
    "tenantid": "12345",
    "instanceurl": "https://example.com",
    "timestamp": "2023-10-12T11:49:19.317277"
  },
  "timestamp": "2023-10-12T11:49:19.328394Z"
}