# Coralogix Audit Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Ftroubleshooting%2Fcoralogix-audit.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Ftroubleshooting%2Fcoralogix-audit.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.) ## Overview[​](#overview "Direct link to Overview") Users with audit permissions can utilize Coralogix audit logs to monitor organizational activity within Coralogix, including all user actions and API operations. This tool empowers you to track actions, ensure compliance, and maintain transparency across your team or organization. Use Coralogix Audit to: * Review infrastructure-related user activities like payment or resource configuration changes. * Track before-and-after states of any system changes. * Monitor API operations during specific timeframes — from the API call, to the resulting action, and its outcome. * Create analytics to evaluate activity across your account by product. ## How it works[​](#how-it-works "Direct link to How it works") Audit events from your teams (the **source teams**) are routed to a single designated **destination team** — the **audit team** — where they're centralized for querying and analysis. With **Audit v2**, events are logged and delivered to the audit team in real time as they occur (e.g., when a query is executed or an API operation takes place). These events follow a standardized structure, ensuring efficient querying and compliance-focused analysis. This page describes **Audit v2**, the current audit log structure. The earlier structure is covered in [Deprecation of Audit v1 schema](https://coralogix.com/docs/docs/user-guides/latest-updates/deprecations/audit-v1/.md). ## Permissions[​](#permissions "Direct link to Permissions") To view or manage audit team settings, users must have the required permissions: | **Resource** | **Action** | **Description** | | ------------- | ------------ | -------------------------- | | team-auditing | ReadConfig | View team audit settings | | team-auditing | UpdateConfig | Manage team audit settings | Membership in the audit team allows you to view audit events. ## Setup[​](#setup "Direct link to Setup") ### Access audit settings[​](#access-audit-settings "Direct link to Access audit settings") In the main menu, select **Settings**, then **Audit**. The page opens with the title **Team audit log**. ### Audit log destination card[​](#audit-log-destination-card "Direct link to Audit log destination card") The **Audit log destination** card shows where audit logs from the current team are sent. A badge on the card indicates the current state: | Badge | Meaning | | -------------- | ---------------------------------------------------------------------------- | | Active | Audit logs from this team are sent to the destination shown on the card. | | Inactive | A destination is set, but audit logs from this team aren't being sent to it. | | Not configured | No destination has been set yet. | Note The audit log destination only controls **where** audit logs are routed — not whether audit data is **collected**. Audit data collection and datasets are configured in [Dataspace Management](https://coralogix.com/docs/docs/user-guides/data-layer/dataset-management/.md). To configure a destination: 1. Select **Configure audit destination** (first-time setup) or **Change destination** (to swap an existing destination). 2. In the **Change audit log destination** drawer, search for the team you want to use as the destination and select **Set as destination**. 3. In the confirmation dialog, select **Change destination**. Use the toggle on the card to activate or deactivate sending audit logs without changing the destination. Select **View audit history** on the card to open the destination team filtered to events from the current team. You are redirected to [Explore](https://coralogix.com/docs/docs/user-guides/data_exploration/.md). ### Team members card[​](#team-members-card "Direct link to Team members card") The **Team members** card lists members of the **current team** — the source team whose actions are being audited — not members of the destination audit team. For each member you can: * Filter by role or search by name and email. * Select **View user audit logs** to open the destination team filtered to that user's events. If no destination is configured, **View user audit logs** is unavailable. ## Billing & usage[​](#billing--usage "Direct link to Billing & usage") The audit team has a daily quota of up to 25 MB and a retention period of 7 days. This quota should generally be sufficient for audit purposes. However, using the [quota management CLI](https://coralogix.com/docs/docs/user-guides/account-management/payment-and-billing/quota-management/.md), you can increase it or reallocate it between teams if needed. Configure your [S3 archive](https://coralogix.com/docs/docs/user-guides/data-flow/s3-archive/connect-s3-archive/.md) to retain audit logs for longer periods. You can query these logs in [Explore](https://coralogix.com/docs/docs/user-guides/data_exploration/.md) or use [Background Queries](https://coralogix.com/docs/docs/user-guides/dataengine/background_queries_v1/.md) for long-running queries. ## Audit events structure[​](#audit-events-structure "Direct link to Audit events structure") Events follow a unified structure, comprising an **audit envelope** and an **audit payload**. Payloads are standardized per event type (e.g., `after` for `create`, `before`/`after` for `update`, etc.). ## Audit envelope[​](#audit-envelope "Direct link to Audit envelope") The envelope structure consists of the following fields: | Field | Description | | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | | `auditVersion` | Audit log structure version (e.g., v2, v3, etc.). | | `eventName` | The name of the event reflects its related features and functionality. | | `cxFeature` | The specific Coralogix feature the event data is related to. | | `cxFeatureGroup` | Stable Coralogix feature groups, used as the subsystem name of each audit event. | | `eventKind` | The type of the event (Action/Update/Delete/Create/Get/List). `eventData` payload structure is determined by this key. | | `endpointInfo` | Provides connection information, like the protocol used to connect to the system, the IP address that sent the request, and the request protocol. | | `authDetails` | Authentication details that depend on the type of authentication (API key, user login, or internal context). | | `actorDetails` | Details about the actor responsible for the action (organization, user, or team). | | `eventData` | The event payload, which contains details about the resources affected by the event and/or the resources themselves. | | `outcome` | The logical outcome of the actions. Contains the outcome status and failure type if relevant. | **Example** ``` { "endpointInfo":{ "clientInfo":{ "ipAddress": , "userAgent": }, "protocol": "HTTP", "httpDetails": { "statusCode": 200 } }, "cxFeatureGroup": "metrics", "actorDetails": { "actorType": "User", "username": , "teamId": , "teamName": , "orgName": }, "auditVersion": "v2", "eventData": { ... }, "eventKind": "Action", "eventName": "logs-data-api.ReadData", "authDetails": { "authType": , "apiKeyId": , "apiKeyName": , "apiKeyOwnerType": }, "outcome": { "status": "Success", "statusMessage": "200 OK" }, "cxFeature": "metrics.data-api" } ``` ## Audit payload[​](#audit-payload "Direct link to Audit payload") ### Event type[​](#event-type "Direct link to Event type") Each event type has a common payload structure, which is contained in the `eventData` field and is determined by the event type (`eventKind` field). Note Large payloads are converted to strings and contained in the `stringifiedEventData` field for increased indexing efficiency. * **Action** Contains complex event data with varying structure. * **List** Contains a filter field with the resource request. ``` "eventData": { "filter": } ``` * **Get** Contains an identifier of the received resource. ``` "eventData":{ "identifier": } ``` * **Delete** Contains the deleted resource. ``` "eventData": { "data": { "displayName": , "description": , "filters": [ ... ], "id": } } ``` * **Create** Contains the created resource. ``` "eventData": { "data": { "data": { ... }, "name": , "id": } } ``` * **Update** Contains the original and new versions of a resource. ``` "eventData": { "before": { ... }, "after": { ... } } ``` ### Event type per feature[​](#event-type-per-feature "Direct link to Event type per feature") The following tables list the audit events emitted by each Coralogix feature. For every feature, they show the `eventName`, its corresponding `eventType`, and the field type (`eventKind`) that determines the payload structure. Expand a feature to see the events it produces. [Coralogix custom actions](https://coralogix.com/docs/docs/user-guides/data_exploration/custom_actions/.md) | **Event Name** | **Event Type** | **Field Type** | | -------------- | ------------------------------------ | -------------- | | actions.order | ACTION\_EVENT\_TYPE\_ACTION\_ORDER | Action | | actions.list | LIST\_EVENT\_TYPE\_ACTION\_LIST | List | | actions.get | GET\_EVENT\_TYPE\_ACTION\_GET | Get | | actions.delete | DELETE\_EVENT\_TYPE\_ACTION\_DELETE | Delete | | actions.create | CREATE\_EVENT\_TYPE\_ACTION\_CREATE | Create | | actions.update | UPDATE\_EVENT\_TYPE\_ACTION\_REPLACE | Update | Access Policies | **Event Name** | **Event Type** | **Field Type** | | -------------------- | ----------------------------------- | -------------- | | access-policy.create | CREATE\_EVENT\_TYPE\_ACCESS\_POLICY | Create | | access-policy.delete | DELETE\_EVENT\_TYPE\_ACCESS\_POLICY | Delete | | access-policy.update | UPDATE\_EVENT\_TYPE\_ACCESS\_POLICY | Update | [Alerts](https://coralogix.com/docs/docs/user-guides/alerting/introduction-to-alerts/.md) | **Event Name** | **Event Type** | **Field Type** | | -------------- | ---------------------------------- | -------------- | | alert.snooze | ACTION\_EVENT\_TYPE\_ALERT\_SNOOZE | Action | | alerts.list | LIST\_EVENT\_TYPE\_ALERT | List | | ------------- | -------------------------- | ------ | | alerts.get | GET\_EVENT\_TYPE\_ALERT | Get | | alerts.delete | DELETE\_EVENT\_TYPE\_ALERT | Delete | | alerts.create | CREATE\_EVENT\_TYPE\_ALERT | Create | | alerts.update | UPDATE\_EVENT\_TYPE\_ALERT | Update | [Alert Scheduler](https://coralogix.com/docs/docs/developer-portal/apis/data-management/alert-suppression-rules-api/.md) | **Event Name** | **Event Type** | **Field Type** | | ----------------------- | ------------------------------------- | -------------- | | alert\_scheduler.list | LIST\_EVENT\_TYPE\_ALERT\_SCHEDULER | List | | alert\_scheduler.get | GET\_EVENT\_TYPE\_ALERT\_SCHEDULER | Get | | alert\_scheduler.delete | DELETE\_EVENT\_TYPE\_ALERT\_SCHEDULER | Delete | | alert\_scheduler.create | CREATE\_EVENT\_TYPE\_ALERT\_SCHEDULER | Create | | alert\_scheduler.update | UPDATE\_EVENT\_TYPE\_ALERT\_SCHEDULER | Update | [API Keys](https://coralogix.com/docs/docs/user-guides/account-management/api-keys/api-keys/.md) | **Event Name** | **Event Type** | **Field Type** | | -------------------------------------- | ------------------------------------------------ | -------------- | | api-key.get | GET\_EVENT\_TYPE\_API\_KEY | Get | | api-key.delete | DELETE\_EVENT\_TYPE\_API\_KEY | Delete | | api-key.create | CREATE\_EVENT\_TYPE\_API\_KEY | Create | | api-key.update | UPDATE\_EVENT\_TYPE\_API\_KEY | Update | | api-keys.list | LIST\_EVENT\_TYPE\_API\_KEY | List | | team-api-keys-security-settings.update | UPDATE\_EVENT\_TYPE\_API\_KEY\_SECURITY\_SETTING | Update | [APM](https://coralogix.com/docs/docs/user-guides/apm/getting-started/apm-onboarding-tutorial/.md) | **Event Name** | **Event Type** | **Field Type** | | ------------------- | ---------------------------------- | -------------- | | apm.entity.action | ACTION\_EVENT\_TYPE\_APM\_ENTITY | Action | | apm.entity.list | LIST\_EVENT\_TYPE\_APM\_ENTITY | List | | apm.entity.get | GET\_EVENT\_TYPE\_APM\_ENTITY | Get | | apm.entity.delete | DELETE\_EVENT\_TYPE\_APM\_ENTITY | Delete | | apm.entity.create | CREATE\_EVENT\_TYPE\_APM\_ENTITY | Create | | apm.settings.update | UPDATE\_EVENT\_TYPE\_APM\_SETTINGS | Update | | apm.entity.update | UPDATE\_EVENT\_TYPE\_APM\_ENTITY | Update | Archive Setup | **Event Name** | **Event Type** | **Field Type** | | -------------------- | ----------------------------------- | -------------- | | archive-setup.get | GET\_EVENT\_TYPE\_ARCHIVE\_SETUP | Get | | archive-setup.update | UPDATE\_EVENT\_TYPE\_ARCHIVE\_SETUP | Update | Audit Teams | **Event Name** | **Event Type** | **Field Type** | | --------------------------------- | ------------------------------------------------------ | -------------- | | auditing.attach-team | ACTION\_EVENT\_TYPE\_AUDITING\_ATTACH\_TEAM | Action | | auditing.audit-team.create | CREATE\_EVENT\_TYPE\_AUDITING\_AUDIT\_TEAM | Create | | auditing.audit-team.deactivate | ACTION\_EVENT\_TYPE\_AUDITING\_DEACTIVATE\_AUDIT\_TEAM | Action | | auditing.audit-team.is-configured | ACTION\_EVENT\_TYPE\_AUDITING\_IS\_TEAM\_CONFIGURES | Action | | auditing.audit-teams.list | LIST\_EVENT\_TYPE\_AUDITING\_AUDIT\_TEAMS | List | | auditing.detach-team | ACTION\_EVENT\_TYPE\_AUDITING\_DETACH\_TEAM | Action | [Cases](https://coralogix.com/docs/docs/user-guides/cases/overview/.md) | **Event Name** | **Event Type** | **Field Type** | | ------------------------------------ | ------------------------------------------------------------- | -------------- | | case.acknowledge | ACTION\_EVENT\_TYPE\_CASE\_ACKNOWLEDGE | Action | | case.ai-summary.generate | ACTION\_EVENT\_TYPE\_CASE\_AI\_SUMMARY\_GENERATE | Action | | case.alert-events.get-cases | ACTION\_EVENT\_TYPE\_CASE\_ALERT\_EVENTS\_GET\_CASES | Action | | case.alert-events.get-ids | ACTION\_EVENT\_TYPE\_CASE\_ALERT\_EVENTS\_GET\_IDS | Action | | case.analytics.get-available-filters | ACTION\_EVENT\_TYPE\_CASE\_ANALYTICS\_GET\_AVAILABLE\_FILTERS | Action | | case.analytics.get-metrics | ACTION\_EVENT\_TYPE\_CASE\_ANALYTICS\_GET\_METRICS | Action | | case.analytics.get-overview | ACTION\_EVENT\_TYPE\_CASE\_ANALYTICS\_GET\_OVERVIEW | Action | | case.assign | ACTION\_EVENT\_TYPE\_CASE\_ASSIGN | Action | | case.bulk-acknowledge | ACTION\_EVENT\_TYPE\_CASE\_BULK\_ACKNOWLEDGE | Action | | case.bulk-assign | ACTION\_EVENT\_TYPE\_CASE\_BULK\_ASSIGN | Action | | case.bulk-close | ACTION\_EVENT\_TYPE\_CASE\_BULK\_CLOSE | Action | | case.bulk-priority-override.clear | ACTION\_EVENT\_TYPE\_CASE\_BULK\_CLEAR\_PRIORITY\_OVERRIDE | Action | | case.bulk-priority-override.set | ACTION\_EVENT\_TYPE\_CASE\_BULK\_SET\_PRIORITY\_OVERRIDE | Action | | case.bulk-resolve | ACTION\_EVENT\_TYPE\_CASE\_BULK\_RESOLVE | Action | | case.bulk-unassign | ACTION\_EVENT\_TYPE\_CASE\_BULK\_UNASSIGN | Action | | case.close | ACTION\_EVENT\_TYPE\_CASE\_CLOSE | Action | | case.comments.create | ACTION\_EVENT\_TYPE\_CASE\_COMMENTS\_CREATE | Action | | case.comments.delete | ACTION\_EVENT\_TYPE\_CASE\_COMMENTS\_DELETE | Action | | case.comments.update | ACTION\_EVENT\_TYPE\_CASE\_COMMENTS\_UPDATE | Action | | case.deep-links.get | ACTION\_EVENT\_TYPE\_CASE\_GET\_DEEP\_LINKS | Action | | case.events.get | ACTION\_EVENT\_TYPE\_CASE\_EVENTS\_GET | Action | | case.events.list | ACTION\_EVENT\_TYPE\_CASE\_EVENTS\_LIST | Action | | case.events.sync-external | ACTION\_EVENT\_TYPE\_CASE\_SYNC\_EXTERNAL\_EVENTS | Action | | case.external-references.get | ACTION\_EVENT\_TYPE\_CASE\_GET\_EXTERNAL\_REFERENCES | Action | | case.filter-values.get | ACTION\_EVENT\_TYPE\_CASE\_GET\_FILTER\_VALUES | Action | | case.get | GET\_EVENT\_TYPE\_CASE | Get | | case.grouping-keys.get | ACTION\_EVENT\_TYPE\_CASE\_GET\_GROUPING\_KEYS | Action | | case.list | LIST\_EVENT\_TYPE\_CASE | List | | case.notification-delivery.list | LIST\_EVENT\_TYPE\_CASE\_NOTIFICATION\_DELIVERY | List | | case.priority-override.clear | ACTION\_EVENT\_TYPE\_CASE\_CLEAR\_PRIORITY\_OVERRIDE | Action | | case.priority-override.set | ACTION\_EVENT\_TYPE\_CASE\_SET\_PRIORITY\_OVERRIDE | Action | | case.resolve | ACTION\_EVENT\_TYPE\_CASE\_RESOLVE | Action | | case.system-defaults.get | ACTION\_EVENT\_TYPE\_CASE\_GET\_SYSTEM\_DEFAULTS | Action | | case.unacknowledge | ACTION\_EVENT\_TYPE\_CASE\_UNACKNOWLEDGE | Action | | case.unassign | ACTION\_EVENT\_TYPE\_CASE\_UNASSIGN | Action | | case.update | UPDATE\_EVENT\_TYPE\_CASE | Update | **Case team configuration** | **Event Name** | **Event Type** | **Field Type** | | --------------------------- | ---------------------------------------------------- | -------------- | | case-team-config.create | CREATE\_EVENT\_TYPE\_CASE\_TEAM\_CONFIG | Create | | case-team-config.delete | DELETE\_EVENT\_TYPE\_CASE\_TEAM\_CONFIG | Delete | | case-team-config.get | GET\_EVENT\_TYPE\_CASE\_TEAM\_CONFIG | Get | | case-team-config.get-active | ACTION\_EVENT\_TYPE\_CASE\_TEAM\_CONFIG\_GET\_ACTIVE | Action | | case-team-config.update | UPDATE\_EVENT\_TYPE\_CASE\_TEAM\_CONFIG | Update | [Cloud Metadata Enrichment](https://coralogix.com/docs/docs/user-guides/enrichment_rules/aws_resource_enrichment/.md) | **Event Name** | **Event Type** | **Field Type** | | -------------------------------- | ------------------------------------------------ | -------------- | | cloud-metadata-enrichment.delete | DELETE\_EVENT\_TYPE\_CLOUD\_METADATA\_ENRICHMENT | Delete | | cloud-metadata-enrichment.create | CREATE\_EVENT\_TYPE\_CLOUD\_METADATA\_ENRICHMENT | Create | | cloud-metadata-enrichment.update | UPDATE\_EVENT\_TYPE\_CLOUD\_METADATA\_ENRICHMENT | Update | [Continuous Profiling](https://coralogix.com/docs/docs/user-guides/continuous-profiling/introduction/.md) | **Event Name** | **Event Type** | **Field Type** | | ----------------------- | ---------------------------------------------- | -------------- | | profiles.symbols.upload | ACTION\_EVENT\_TYPE\_PROFILES\_SYMBOLS\_UPLOAD | Action | | profiles.query | ACTION\_EVENT\_TYPE\_PROFILES\_QUERY | Action | | profiles.query.graph | ACTION\_EVENT\_TYPE\_PROFILES\_QUERY\_GRAPH | Action | [Custom Enrichment](https://coralogix.com/docs/docs/user-guides/enrichment_rules/custom_enrichment/.md) | **Event Name** | **Event Type** | **Field Type** | | ----------------------------- | --------------------------------------------------- | -------------- | | custom-enrichment.overwrite | ACTION\_EVENT\_TYPE\_OVERWRITE\_CUSTOM\_ENRICHMENTS | Action | | custom-enrichment.delete | DELETE\_EVENT\_TYPE\_CUSTOM\_ENRICHMENT | Delete | | custom-enrichment.create | CREATE\_EVENT\_TYPE\_CUSTOM\_ENRICHMENT | Create | | custom-enrichment.update | UPDATE\_EVENT\_TYPE\_CUSTOM\_ENRICHMENT | Update | | custom-enrichment-data.list | LIST\_EVENT\_TYPE\_CUSTOM\_ENRICHMENT\_DATA | List | | custom-enrichment-data.get | GET\_EVENT\_TYPE\_CUSTOM\_ENRICHMENT\_DATA | Get | | custom-enrichment-data.delete | DELETE\_EVENT\_TYPE\_CUSTOM\_ENRICHMENT\_DATA | Delete | | custom-enrichment-data.create | CREATE\_EVENT\_TYPE\_CUSTOM\_ENRICHMENT\_DATA | Create | | custom-enrichment-data.update | UPDATE\_EVENT\_TYPE\_CUSTOM\_ENRICHMENT\_DATA | Update | [Dashboard Reports](https://coralogix.com/docs/docs/user-guides/custom-dashboards/tutorials/save-a-dashboard-as-a-pdf/.md) | **Event Name** | **Event Type** | **Field Type** | | -------------------------------- | ------------------------------------------------ | -------------- | | dashboard-report.get | GET\_EVENT\_TYPE\_DASHBOARD\_REPORT | Get | | dashboard-report-schedule.list | LIST\_EVENT\_TYPE\_DASHBOARD\_REPORT\_SCHEDULE | List | | dashboard-report-schedule.get | GET\_EVENT\_TYPE\_DASHBOARD\_REPORT\_SCHEDULE | Get | | dashboard-report-schedule.delete | DELETE\_EVENT\_TYPE\_DASHBOARD\_REPORT\_SCHEDULE | Delete | | dashboard-report-schedule.create | CREATE\_EVENT\_TYPE\_DASHBOARD\_REPORT\_SCHEDULE | Create | | dashboard-report-schedule.update | UPDATE\_EVENT\_TYPE\_DASHBOARD\_REPORT\_SCHEDULE | Update | [Dashboards](https://coralogix.com/docs/docs/user-guides/custom-dashboards/introduction/.md) | **Event Name** | **Event Type** | **Field Type** | | ----------------- | ------------------------------ | -------------- | | dashboards.list | LIST\_EVENT\_TYPE\_DASHBOARD | List | | dashboards.get | GET\_EVENT\_TYPE\_DASHBOARD | Get | | dashboards.delete | DELETE\_EVENT\_TYPE\_DASHBOARD | Delete | | dashboards.create | CREATE\_EVENT\_TYPE\_DASHBOARD | Create | | dashboards.update | UPDATE\_EVENT\_TYPE\_DASHBOARD | Update | [Data Usage](https://coralogix.com/docs/docs/user-guides/account-management/payment-and-billing/data-usage/.md) | **Event Name** | **Event Type** | **Field Type** | | -------------------------------------- | ----------------------------------------------------- | -------------- | | datausage.get-daily | ACTION\_EVENT\_TYPE\_GET\_DAILY\_DATA\_USAGE | Action | | datausage.export | ACTION\_EVENT\_TYPE\_EXPORT\_DETAILED\_DATA\_USAGE | Action | | datausage.data-usage-to-metrics-enable | ACTION\_EVENT\_TYPE\_DATA\_USAGE\_TO\_METRICS\_ENABLE | Action | [Enrichment](https://coralogix.com/docs/docs/user-guides/enrichment_rules/.md) | **Event Name** | **Event Type** | **Field Type** | | --------------- | ----------------------------- | -------------- | | enrichment.list | LIST\_EVENT\_TYPE\_ENRICHMENT | List | | enrichment.get | GET\_EVENT\_TYPE\_ENRICHMENT | Get | [Events2Metrics](https://coralogix.com/docs/docs/user-guides/monitoring-and-insights/events2metrics/.md) | events-2-metrics.list | LIST\_EVENT\_TYPE\_EVENTS\_2\_METRICS | List | | ----------------------- | --------------------------------------- | ------ | | events-2-metrics.get | GET\_EVENT\_TYPE\_EVENTS\_2\_METRICS | Get | | events-2-metrics.delete | DELETE\_EVENT\_TYPE\_EVENTS\_2\_METRICS | Delete | | events-2-metrics.create | CREATE\_EVENT\_TYPE\_EVENTS\_2\_METRICS | Create | | events-2-metrics.update | UPDATE\_EVENT\_TYPE\_EVENTS\_2\_METRICS | Update | [Extensions](https://coralogix.com/docs/docs/integrations/extensions/.md) | **Event Name** | **Event Type** | **Field Type** | | ------------------- | ---------------------------------------- | -------------- | | extensions.undeploy | ACTION\_EVENT\_TYPE\_EXTENSION\_UNDEPLOY | Action | | extensions.update | ACTION\_EVENT\_TYPE\_EXTENSION\_UPDATE | Action | | extensions.deploy | ACTION\_EVENT\_TYPE\_EXTENSION\_DEPLOY | Action | | extensions.list | LIST\_EVENT\_TYPE\_EXTENSION | List | | extensions.get | GET\_EVENT\_TYPE\_EXTENSION | Get | [Forwarders](https://coralogix.com/docs/docs/user-guides/data-flow/forwarders/.md) | **Event Name** | **Event Type** | **Field Type** | | ----------------- | ------------------------------------- | -------------- | | forwarders.test | ACTION\_EVENT\_TYPE\_FORWARDERS\_TEST | Action | | forwarders.list | LIST\_EVENT\_TYPE\_FORWARDERS | List | | forwarders.get | GET\_EVENT\_TYPE\_FORWARDERS | Get | | forwarders.delete | DELETE\_EVENT\_TYPE\_FORWARDERS | Delete | | forwarders.create | CREATE\_EVENT\_TYPE\_FORWARDERS | Create | | forwarders.update | UPDATE\_EVENT\_TYPE\_FORWARDERS | Update | [Geo Enrichment](https://coralogix.com/docs/docs/user-guides/enrichment_rules/geo_enrichment/.md) | **Event Name** | **Event Type** | **Field Type** | | --------------------- | ------------------------------------ | -------------- | | geo-enrichment.delete | DELETE\_EVENT\_TYPE\_GEO\_ENRICHMENT | Delete | | geo-enrichment.create | CREATE\_EVENT\_TYPE\_GEO\_ENRICHMENT | Create | | geo-enrichment.update | UPDATE\_EVENT\_TYPE\_GEO\_ENRICHMENT | Update | Group | **Event Name** | **Event Type** | **Field Type** | | -------------- | -------------------------- | -------------- | | group.delete | DELETE\_EVENT\_TYPE\_GROUP | Delete | | group.create | CREATE\_EVENT\_TYPE\_GROUP | Create | | group.update | UPDATE\_EVENT\_TYPE\_GROUP | Update | [Incidents](https://coralogix.com/docs/docs/user-guides/alerting/incidents/.md) | **Event Name** | **Event Type** | **Field Type** | | --------------------- | ------------------------------------------- | -------------- | | incidents.close | ACTION\_EVENT\_TYPE\_INCIDENTS\_CLOSE | Action | | incidents.assign | ACTION\_EVENT\_TYPE\_INCIDENTS\_ASSIGN | Action | | incidents.unassign | ACTION\_EVENT\_TYPE\_INCIDENTS\_UNASSIGN | Action | | incidents.acknowledge | ACTION\_EVENT\_TYPE\_INCIDENTS\_ACKNOWLEDGE | Action | | incidents.list | LIST\_EVENT\_TYPE\_INCIDENTS | List | | incidents.get | GET\_EVENT\_TYPE\_INCIDENTS | Get | Integrations | **Event Name** | **Event Type** | **Field Type** | | ------------------------------------ | ------------------------------------------------- | -------------- | | integration.check-api-key-permission | ACTION\_EVENT\_TYPE\_CHECK\_API\_KEY\_PERMISSION | Action | | integration.create | CREATE\_EVENT\_TYPE\_INTEGRATION | Create | | integration.definition.get | GET\_EVENT\_TYPE\_INTEGRATION\_DEFINITION | Get | | integration.delete | DELETE\_EVENT\_TYPE\_INTEGRATION | Delete | | integration.details.get | GET\_EVENT\_TYPE\_INTEGRATION\_DETAILS | Get | | integration.generate-token | ACTION\_EVENT\_TYPE\_INTEGRATION\_GENERATE\_TOKEN | Action | | integration.get | GET\_EVENT\_TYPE\_INTEGRATION | Get | | integration.list | LIST\_EVENT\_TYPE\_INTEGRATION | List | | integration.quotas.get | GET\_EVENT\_TYPE\_INTEGRATION\_QUOTAS | Get | | integration.rotate-token | ACTION\_EVENT\_TYPE\_INTEGRATION\_ROTATE\_TOKEN | Action | | integration.rum-app-version.get | GET\_EVENT\_TYPE\_RUM\_APPLICATION\_VERSION\_DATA | Get | | integration.sync-rum-data | ACTION\_EVENT\_TYPE\_INTEGRATION\_SYNC\_RUM\_DATA | Action | | integration.template.get | GET\_EVENT\_TYPE\_INTEGRATION\_TEMPLATE | Get | | integration.test | ACTION\_EVENT\_TYPE\_INTEGRATION\_TEST | Action | | integration.update | UPDATE\_EVENT\_TYPE\_INTEGRATION | Update | Contextual Data Integrations | **Event Name** | **Event Type** | **Field Type** | | ------------------------------------------ | ----------------------------------------------------------- | -------------- | | contextual-data-integration.create | CREATE\_EVENT\_TYPE\_CONTEXTUAL\_DATA\_INTEGRATION | Create | | contextual-data-integration.definition.get | GET\_EVENT\_TYPE\_CONTEXTUAL\_DATA\_INTEGRATION\_DEFINITION | Get | | contextual-data-integration.delete | DELETE\_EVENT\_TYPE\_CONTEXTUAL\_DATA\_INTEGRATION | Delete | | contextual-data-integration.details.get | GET\_EVENT\_TYPE\_CONTEXTUAL\_DATA\_INTEGRATION\_DETAILS | Get | | contextual-data-integration.list | LIST\_EVENT\_TYPE\_CONTEXTUAL\_DATA\_INTEGRATION | List | | contextual-data-integration.test | ACTION\_EVENT\_TYPE\_CONTEXTUAL\_DATA\_INTEGRATION\_TEST | Action | | contextual-data-integration.update | UPDATE\_EVENT\_TYPE\_CONTEXTUAL\_DATA\_INTEGRATION | Update | [Livetail](https://coralogix.com/docs/docs/user-guides/data_exploration/logs/livetail/.md) | **Event Name** | **Event Type** | **Field Type** | | ------------------ | ---------------------------------------- | -------------- | | livetail.subscribe | ACTION\_EVENT\_TYPE\_LIVETAIL\_SUBSCRIBE | Action | [Logs TCO](https://coralogix.com/docs/docs/user-guides/account-management/tco-optimizer/.md) | **Event Name** | **Event Type** | **Field Type** | | --------------- | ------------------------------------- | -------------- | | logs.tco.test | ACTION\_EVENT\_TYPE\_LOGS\_TCO\_TEST | Action | | logs.tco.order | ACTION\_EVENT\_TYPE\_LOGS\_TCO\_ORDER | Action | | logs.tco.list | LIST\_EVENT\_TYPE\_LOGS\_TCO | List | | logs.tco.get | GET\_EVENT\_TYPE\_LOGS\_TCO | Get | | logs.tco.delete | DELETE\_EVENT\_TYPE\_LOGS\_TCO | Delete | | logs.tco.create | CREATE\_EVENT\_TYPE\_LOGS\_TCO | Create | | logs.tco.update | UPDATE\_EVENT\_TYPE\_LOGS\_TCO | Update | [Logs Parsing Rules](https://coralogix.com/docs/docs/user-guides/data-transformation/parsing/log-parsing-rules/.md) | **Event Name** | **Event Type** | **Field Type** | | ------------------------- | ---------------------------------------------- | -------------- | | logs.parsing-rules.order | ACTION\_EVENT\_TYPE\_LOGS\_RULES\_GROPS\_ORDER | Action | | logs.parsing-rules.list | LIST\_EVENT\_TYPE\_LOGS\_RULES\_GROUP | List | | logs.parsing-rules.get | GET\_EVENT\_TYPE\_LOGS\_RULES\_GROUP | Get | | logs.parsing-rules.delete | DELETE\_EVENT\_TYPE\_LOGS\_RULES\_GROUP | Delete | | logs.parsing-rules.create | CREATE\_EVENT\_TYPE\_LOGS\_RULES\_GROUP | Create | | logs.parsing-rules.update | UPDATE\_EVENT\_TYPE\_LOGS\_RULES\_GROUP | Update | Logs Data API | **Event Name** | **Event Type** | **Field Type** | | ---------------------- | ------------------------------------------ | -------------- | | logs-data-api.ReadData | ACTION\_EVENT\_TYPE\_DATA\_API\_READ\_DATA | Action | [Metrics](https://coralogix.com/docs/docs/user-guides/data-query/metrics-api/.md) | **Event Name** | **Event Type** | **Field Type** | | --------------------- | ---------------------------------------- | -------------- | | metrics.data-api.read | ACTION\_EVENT\_TYPE\_METRICS\_READ\_DATA | Action | [Notification Center Presets](https://coralogix.com/docs/docs/user-guides/notification-center/presets/introduction/.md) | **Event Name** | **Event Type** | **Field Type** | | ----------------------------------------- | ------------------------------------------------------------------- | -------------- | | notification-center-preset.set-as-default | ACTION\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_PRESET\_SET\_AS\_DEFAULT | Action | | notification-center-preset.delete | DELETE\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_PRESET | Delete | | notification-center-preset.create | CREATE\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_PRESET | Create | | notification-center-preset.update | UPDATE\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_PRESET | Update | | notification-center-preset.get | GET\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_PRESET | Get | | notification-center-preset.list | LIST\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_PRESET | List | [Notification Center Connectors](https://coralogix.com/docs/docs/user-guides/notification-center/connectors/.md) | **Event Name** | **Event Type** | **Field Type** | | ------------------------------------ | ---------------------------------------------------- | -------------- | | notification-center-connector.create | CREATE\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_CONNECTOR | Create | | notification-center-connector.delete | DELETE\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_CONNECTOR | Delete | | notification-center-connector.get | GET\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_CONNECTOR | Get | | notification-center-connector.list | LIST\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_CONNECTOR | List | | notification-center-connector.update | UPDATE\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_CONNECTOR | Update | [Notification Center Routers](https://coralogix.com/docs/docs/user-guides/notification-center/routing/introduction/.md) | **Event Name** | **Event Type** | **Field Type** | | ---------------------------------------- | --------------------------------------------------------- | -------------- | | notification-center-global-router.create | CREATE\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_GLOBAL\_ROUTER | Create | | notification-center-global-router.delete | DELETE\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_GLOBAL\_ROUTER | Delete | | notification-center-global-router.get | GET\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_GLOBAL\_ROUTER | Get | | notification-center-global-router.list | LIST\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_GLOBAL\_ROUTER | List | | notification-center-global-router.update | UPDATE\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_GLOBAL\_ROUTER | Update | [Organization](https://coralogix.com/docs/docs/user-guides/account-management/organization-management/create-an-organization/.md) | **Event Name** | **Event Type** | **Field Type** | | ---------------------------- | ------------------------------------------- | -------------- | | organization.add-domain | ACTION\_EVENT\_TYPE\_ADD\_DOMAIN | Action | | organization.move-quota | ACTION\_EVENT\_TYPE\_MOVE\_QUOTA | Action | | organization.settings.get | GET\_EVENT\_TYPE\_ORGANIZATION\_SETTINGS | Get | | organization.settings.update | UPDATE\_EVENT\_TYPE\_ORGANIZATION\_SETTINGS | Update | | organization.update | UPDATE\_EVENT\_TYPE\_ORGANIZATION | Update | [Webhooks](https://coralogix.com/docs/docs/user-guides/alerting/outbound-webhooks/generic-outbound-webhooks-alert-webhooks/.md) | **Event Name** | **Event Type** | **Field Type** | | --------------------------- | -------------------------------------------- | -------------- | | outbound-webhook-types.list | LIST\_EVENT\_TYPE\_OUTBOUND\_WEBHOOK\_TYPES | List | | outbound-webhooks.test | ACTION\_EVENT\_TYPE\_OUTBOUND\_WEBHOOK\_TEST | Action | | outbound-webhooks.list | LIST\_EVENT\_TYPE\_OUTBOUND\_WEBHOOK | List | | outbound-webhooks.get | GET\_EVENT\_TYPE\_OUTBOUND\_WEBHOOK | Get | | outbound-webhooks.delete | DELETE\_EVENT\_TYPE\_OUTBOUND\_WEBHOOK | Delete | | outbound-webhooks.create | CREATE\_EVENT\_TYPE\_OUTBOUND\_WEBHOOK | Create | | outbound-webhooks.update | UPDATE\_EVENT\_TYPE\_OUTBOUND\_WEBHOOK | Update | [Recording Rules](https://coralogix.com/docs/docs/user-guides/data-transformation/metric-rules/recording-rules/.md) | **Event Name** | **Event Type** | **Field Type** | | ------------------------------- | ------------------------------------------------ | -------------- | | recording-rule.delete | DELETE\_EVENT\_TYPE\_RECORDING\_RULE | Delete | | recording-rule.create | CREATE\_EVENT\_TYPE\_RECORDING\_RULE | Create | | recording-rule.update | UPDATE\_EVENT\_TYPE\_RECORDING\_RULE | Update | | recording-rule-group.delete | DELETE\_EVENT\_TYPE\_RECORDING\_RULE\_GROUP | Delete | | recording-rule-group.create | CREATE\_EVENT\_TYPE\_RECORDING\_RULE\_GROUP | Create | | recording-rule-group.update | UPDATE\_EVENT\_TYPE\_RECORDING\_RULE\_GROUP | Update | | recording-rule-group-set.delete | DELETE\_EVENT\_TYPE\_RECORDING\_RULE\_GROUP\_SET | Delete | | recording-rule-group-set.create | CREATE\_EVENT\_TYPE\_RECORDING\_RULE\_GROUP\_SET | Create | | recording-rule-group-set.update | UPDATE\_EVENT\_TYPE\_RECORDING\_RULE\_GROUP\_SET | Update | [Roles](https://coralogix.com/docs/docs/user-guides/aaa/access-control/permissions/.md) | **Event Name** | **Event Type** | **Field Type** | | -------------- | ------------------------- | -------------- | | role.list | LIST\_EVENT\_TYPE\_ROLE | List | | role.get | GET\_EVENT\_TYPE\_ROLE | Get | | role.delete | DELETE\_EVENT\_TYPE\_ROLE | Delete | | role.create | CREATE\_EVENT\_TYPE\_ROLE | Create | | role.update | UPDATE\_EVENT\_TYPE\_ROLE | Update | [RUM](https://coralogix.com/docs/docs/user-guides/rum/getting-started/real-user-monitoring/.md) **[RUM settings](https://coralogix.com/docs/docs/user-guides/rum/getting-started/real-user-monitoring/.md)** | **Event Name** | **Event Type** | **Field Type** | | ------------------- | ---------------------------------- | -------------- | | rum-settings.get | GET\_EVENT\_TYPE\_RUM\_SETTINGS | Get | | rum-settings.update | UPDATE\_EVENT\_TYPE\_RUM\_SETTINGS | Update | | | | | **SDK versions** | **Event Name** | **Event Type** | **Field Type** | | --------------- | ------------------------------ | -------------- | | sdk-version.get | GET\_EVENT\_TYPE\_SDK\_VERSION | Get | **[Session Recording](https://coralogix.com/docs/docs/user-guides/rum/product-features/session-replay/.md)** | **Event Name** | **Event Type** | **Field Type** | | --------------------- | ------------------------------------ | -------------- | | session-recording.get | GET\_EVENT\_TYPE\_SESSION\_RECORDING | Get | **[Source Map](https://coralogix.com/docs/docs/user-guides/rum/sdk-features/source-maps/.md)** | **Event Name** | **Event Type** | **Field Type** | | -------------- | ----------------------------- | -------------- | | source-map.get | GET\_EVENT\_TYPE\_SOURCE\_MAP | Get | **[Hide Errors](https://coralogix.com/docs/docs/user-guides/rum/product-features/error-template-view/.md)** | **Event Name** | **Event Type** | **Field Type** | | ------------------ | --------------------------------- | -------------- | | hide-errors.list | LIST\_EVENT\_TYPE\_HIDE\_ERRORS | List | | hide-errors.get | GET\_EVENT\_TYPE\_HIDE\_ERRORS | Get | | hide-errors.delete | DELETE\_EVENT\_TYPE\_HIDE\_ERRORS | Delete | | hide-errors.create | CREATE\_EVENT\_TYPE\_HIDE\_ERRORS | Create | | hide-errors.update | UPDATE\_EVENT\_TYPE\_HIDE\_ERRORS | Update | **[Saved Filters](https://coralogix.com/docs/docs/user-guides/data_exploration/fields/.md)** | **Event Name** | **Event Type** | **Field Type** | | ------------------- | ---------------------------------- | -------------- | | saved-filter.list | LIST\_EVENT\_TYPE\_SAVED\_FILTER | List | | saved-filter.get | GET\_EVENT\_TYPE\_SAVED\_FILTER | Get | | saved-filter.delete | DELETE\_EVENT\_TYPE\_SAVED\_FILTER | Delete | | saved-filter.create | CREATE\_EVENT\_TYPE\_SAVED\_FILTER | Create | | saved-filter.update | UPDATE\_EVENT\_TYPE\_SAVED\_FILTER | Update | [SAML](https://coralogix.com/docs/docs/user-guides/account-management/user-management/sso-with-saml/.md) | **Event Name** | **Event Type** | **Field Type** | | ------------------------------------- | -------------------------------------------------------- | -------------- | | saml.user.email-verification-required | ACTION\_EVENT\_TYPE\_SAML\_EMAIL\_VERIFICATION\_REQUIRED | Action | | saml.user.reactivated | ACTION\_EVENT\_TYPE\_SAML\_USER\_REACTIVATED | Action | | saml.user.sso-verification-required | ACTION\_EVENT\_TYPE\_SAML\_SSO\_VERIFICATION\_REQUIRED | Action | [SCIM](https://coralogix.com/docs/docs/user-guides/account-management/user-management/scim/.md) | **Event Name** | **Event Type** | **Field Type** | | ------------------ | ----------------------------------------- | -------------- | | scim.user.delete | ACTION\_EVENT\_TYPE\_SCIM\_DELETE\_USER | Action | | scim.group.replace | ACTION\_EVENT\_TYPE\_SCIM\_REPLACE\_GROUP | Action | | scim.user.create | ACTION\_EVENT\_TYPE\_SCIM\_CREATE\_USER | Action | | scim.user.replace | ACTION\_EVENT\_TYPE\_SCIM\_REPLACE\_USER | Action | | scim.user.update | ACTION\_EVENT\_TYPE\_SCIM\_UPDATE\_USER | Action | | scim.group.delete | ACTION\_EVENT\_TYPE\_SCIM\_DELETE\_GROUP | Action | | scim.group.update | ACTION\_EVENT\_TYPE\_SCIM\_UPDATE\_GROUP | Action | | scim.group.create | ACTION\_EVENT\_TYPE\_SCIM\_CREATE\_GROUP | Action | | scim.user.list | LIST\_EVENT\_SCIM\_USER | List | | scim.group.list | LIST\_EVENT\_SCIM\_GROUP | List | | scim.schema.list | LIST\_EVENT\_SCIM\_SCHEMA | List | | scim.schema.get | GET\_EVENT\_SCIM\_SCHEMA | Get | | scim.user.get | GET\_EVENT\_SCIM\_USER | Get | | scim.group.get | GET\_EVENT\_SCIM\_GROUP | Get | [Scopes](https://coralogix.com/docs/docs/user-guides/account-management/user-management/scopes/.md) | **Event Name** | **Event Type** | **Field Type** | | -------------- | ---------------------------------- | -------------- | | scopes.list | LIST\_EVENT\_TYPE\_SCOPE\_LIST | List | | scopes.get | GET\_EVENT\_TYPE\_SCOPE\_GET | Get | | scopes.delete | DELETE\_EVENT\_TYPE\_SCOPE\_DELETE | Delete | | scopes.create | CREATE\_EVENT\_TYPE\_SCOPE\_CREATE | Create | | scopes.update | UPDATE\_EVENT\_TYPE\_SCOPE\_UPDATE | Update | [Security Enrichments](https://coralogix.com/docs/docs/user-guides/enrichment_rules/unified_threat_intelligence/.md) | **Event Name** | **Event Type** | **Field Type** | | -------------------------- | ----------------------------------------- | -------------- | | security-enrichment.delete | DELETE\_EVENT\_TYPE\_SECURITY\_ENRICHMENT | Delete | | security-enrichment.create | CREATE\_EVENT\_TYPE\_SECURITY\_ENRICHMENT | Create | | security-enrichment.update | UPDATE\_EVENT\_TYPE\_SECURITY\_ENRICHMENT | Update | [Spans and Traces Exploration](https://coralogix.com/docs/docs/user-guides/data_exploration/spans/.md) | **Event Name** | **Event Type** | **Field Type** | | ----------------------------- | -------------------------------------------------------- | -------------- | | service-map.get | ACTION\_EVENT\_TYPE\_SERVICE\_MAP\_GET | Action | | spans.count.get | ACTION\_EVENT\_TYPE\_SPANS\_COUNT | Action | | spans.filters.get | ACTION\_EVENT\_TYPE\_SPANS\_FILTERS | Action | | spans.graphs.get | ACTION\_EVENT\_TYPE\_SPANS\_GRAPHS | Action | | spans.lists.highlights | ACTION\_EVENT\_TYPE\_HIGHLIGHTS\_LIST\_SPANS\_HIGHLIGHTS | Action | | spans.search | ACTION\_EVENT\_TYPE\_SPANS\_SEARCH | Action | | traces.count.get | ACTION\_EVENT\_TYPE\_TRACES\_COUNT\_GET | Action | | traces.get | ACTION\_EVENT\_TYPE\_TRACES\_GET\_TRACE | Action | | traces.latency-percentile.get | ACTION\_EVENT\_TYPE\_TRACES\_LATENCY\_PERCENTILE\_GET | Action | | traces.search | ACTION\_EVENT\_TYPE\_TRACES\_SEARCH | Action | [Spans TCO](https://coralogix.com/docs/docs/user-guides/account-management/tco-optimizer/.md) | **Event Name** | **Event Type** | **Field Type** | | ---------------- | -------------------------------------- | -------------- | | spans.tco.order | ACTION\_EVENT\_TYPE\_SPANS\_TCO\_ORDER | Action | | spans.tco.list | LIST\_EVENT\_TYPE\_SPANS\_TCO | List | | spans.tco.get | GET\_EVENT\_TYPE\_SPANS\_TCO | Get | | spans.tco.delete | DELETE\_EVENT\_TYPE\_SPANS\_TCO | Delete | | spans.tco.create | CREATE\_EVENT\_TYPE\_SPANS\_TCO | Create | | spans.tco.update | UPDATE\_EVENT\_TYPE\_SPANS\_TCO | Update | [SSO](https://coralogix.com/docs/docs/user-guides/account-management/user-management/sso-with-saml/.md) | **Event Name** | **Event Type** | **Field Type** | | ---------------------- | ---------------------------------------------- | -------------- | | sso.set-idp-parameters | ACTION\_EVENT\_TYPE\_SSO\_SET\_IDP\_PARAMETERS | Action | | sso.set-active | ACTION\_EVENT\_TYPE\_SSO\_SET\_ACTIVE | Action | | sso.configuration.get | GET\_EVENT\_SSO\_CONFIGURATION | Get | | sso.sp-parameters.get | GET\_EVENT\_SSO\_SP\_PARAMETERS | Get | | sso.config.update | UPDATE\_EVENT\_TYPE\_SAML\_CONFIG | Update | | sso.metadata.update | UPDATE\_EVENT\_TYPE\_SAML\_METADATA | Update | [Team IP Access](https://coralogix.com/docs/docs/user-guides/account-management/user-management/login-access-policy/.md) | **Event Name** | **Event Type** | **Field Type** | | --------------------- | ------------------------------- | -------------- | | team-ip-access.list | LIST\_EVENT\_TYPE\_IP\_FILTER | List | | team-ip-access.delete | DELETE\_EVENT\_TYPE\_IP\_FILTER | Delete | | team-ip-access.create | CREATE\_EVENT\_TYPE\_IP\_FILTER | Create | | team-ip-access.update | UPDATE\_EVENT\_TYPE\_IP\_FILTER | Update | Team Management | **Event Name** | **Event Type** | **Field Type** | | ------------------------------------ | ----------------------------------------------------- | -------------- | | team-landing-page.update | UPDATE\_EVENT\_TYPE\_TEAM\_LANDING\_PAGE | Update | | team-member.remove | ACTION\_EVENT\_TYPE\_TEAM\_MEMBER\_REMOVE | Action | | team-member.unlock | ACTION\_EVENT\_TYPE\_TEAM\_MEMBER\_UNLOCK | Action | | team-member.add | ACTION\_EVENT\_TYPE\_TEAM\_MEMBER\_ADD | Action | | team-member.invite | ACTION\_EVENT\_TYPE\_TEAM\_MEMBER\_INVITE | Action | | team-member.list | LIST\_EVENT\_TEAM\_MEMBER | List | | team-sessions.session-timeout.update | UPDATE\_EVENT\_TYPE\_TEAM\_SESSIONS\_SESSION\_TIMEOUT | Update | | team-sessions.force-logout.update | UPDATE\_EVENT\_TYPE\_TEAM\_SESSIONS\_FORCE\_LOGOUT | Update | | team-url.update | UPDATE\_EVENT\_TYPE\_TEAM\_URL | Update | | team-member.create | CREATE\_EVENT\_TYPE\_TEAM\_MEMBER\_CREATE | Create | `team-member.add` is deprecated; use `team-member.create` instead. Templates | **Event Name** | **Event Type** | **Field Type** | | -------------------- | ------------------------------------------------- | -------------- | | templates.list.read | ACTION\_EVENT\_TYPE\_TEMPLATES\_READ\_DATA | Action | | templates.count.read | ACTION\_EVENT\_TYPE\_TEMPLATES\_COUNT\_READ\_DATA | Action | | templates-dates.get | GET\_EVENT\_TYPE\_TEMPLATES\_DATES | Get | User Account | **Event Name** | **Event Type** | **Field Type** | | ---------------------------------------- | ------------------------------------------------------------------ | -------------- | | user-account.login | ACTION\_EVENT\_TYPE\_USER\_ACCOUNT\_LOGIN | Action | | user-account.mfa-complete-enrolment | ACTION\_EVENT\_TYPE\_USER\_ACCOUNT\_MFA\_COMPLETE\_ENROLMENT | Action | | user-account.mfa-regenerate-backup-codes | ACTION\_EVENT\_TYPE\_USER\_ACCOUNT\_MFA\_REGENERATE\_BACKUP\_CODES | Action | | user-account.mfa-start-enrolment | ACTION\_EVENT\_TYPE\_USER\_ACCOUNT\_MFA\_START\_ENROLMENT | Action | | user-account.mfa-unenroll | ACTION\_EVENT\_TYPE\_USER\_ACCOUNT\_MFA\_UNENROLL | Action | | user-account.mfa-verification.lock | ACTION\_EVENT\_TYPE\_USER\_ACCOUNT\_MFA\_VERIFICATION\_LOCK | Action | | user-account.mfa-verification.verify | ACTION\_EVENT\_TYPE\_USER\_ACCOUNT\_MFA\_VERIFICATION\_VERIFY | Action | | user-account.password-change | ACTION\_EVENT\_TYPE\_USER\_ACCOUNT\_PASSWORD\_CHANGE | Action | User Management | **Event Name** | **Event Type** | **Field Type** | | -------------------------- | ------------------------------------------ | -------------- | | user-landing-page.update | UPDATE\_EVENT\_TYPE\_USER\_LANDING\_PAGE | Update | | user-settings.get | GET\_EVENT\_TYPE\_USER\_SETTING | Get | | user-settings.update | UPDATE\_EVENT\_TYPE\_USER\_SETTING | Update | | users-login-methods.update | UPDATE\_EVENT\_TYPE\_USERS\_LOGIN\_METHODS | Update | [Version Benchmarks](https://coralogix.com/docs/docs/user-guides/monitoring-and-insights/version-benchmarks/.md) | **Event Name** | **Event Type** | **Field Type** | | ------------------------- | ---------------------------------------- | -------------- | | version-benchmarks.list | LIST\_EVENT\_TYPE\_VERSION\_BENCHMARKS | List | | version-benchmarks.get | GET\_EVENT\_TYPE\_VERSION\_BENCHMARKS | Get | | version-benchmarks.delete | DELETE\_EVENT\_TYPE\_VERSION\_BENCHMARKS | Delete | | version-benchmarks.create | CREATE\_EVENT\_TYPE\_VERSION\_BENCHMARKS | Create | | version-benchmarks.update | UPDATE\_EVENT\_TYPE\_VERSION\_BENCHMARKS | Update | [Views](https://coralogix.com/docs/docs/user-guides/monitoring-and-insights/explore-screen/create-and-manage-saved-views/.md) | **Event Name** | **Event Type** | **Field Type** | | -------------- | ------------------------- | -------------- | | view\.list | LIST\_EVENT\_TYPE\_VIEW | List | | view\.get | GET\_EVENT\_TYPE\_VIEW | Get | | view\.delete | DELETE\_EVENT\_TYPE\_VIEW | Delete | | view\.create | CREATE\_EVENT\_TYPE\_VIEW | Create | | view\.update | UPDATE\_EVENT\_TYPE\_VIEW | Update | **[View Folder](https://coralogix.com/docs/docs/user-guides/monitoring-and-insights/explore-screen/create-and-manage-saved-views/.md)** | **Event Name** | **Event Type** | **Field Type** | | ------------------ | --------------------------------- | -------------- | | view-folder.list | LIST\_EVENT\_TYPE\_VIEW\_FOLDER | List | | view-folder.get | GET\_EVENT\_TYPE\_VIEW\_FOLDER | Get | | view-folder.delete | DELETE\_EVENT\_TYPE\_VIEW\_FOLDER | Delete | | view-folder.create | CREATE\_EVENT\_TYPE\_VIEW\_FOLDER | Create | | view-folder.update | UPDATE\_EVENT\_TYPE\_VIEW\_FOLDER | Update | ## Monitoring audit events[​](#monitoring-audit-events "Direct link to Monitoring audit events") To monitor your audit events, take the following steps: 1. Sign in to the team designated as your audit team. 2. View audit events in [Explore](https://coralogix.com/docs/docs/user-guides/data_exploration/.md) or [Visual Explorer](https://coralogix.com/docs/docs/user-guides/monitoring-and-insights/visual-explorer/.md), or create visualizations in [Custom Dashboards](https://coralogix.com/docs/docs/user-guides/custom-dashboards/introduction/.md). ### Monitor & query audit events in Explore[​](#monitor--query-audit-events-in-explore "Direct link to Monitor & query audit events in Explore") Your audit events will appear in the Logs screen in Explore. For any log, click on the left-hand ellipsis and select **Show graph for key** from the dropdown menu. [![auditv2\_explore.png](/docs/assets/images/auditv2_explore-de5a86c99146897e3b2b9a29e95fd12c.webp)](https://coralogix.com/docs/docs/assets/images/auditv2_explore-de5a86c99146897e3b2b9a29e95fd12c.webp) This graph shows the breakdown of actions taken on the organization, team, and user levels for `actorType`. Let’s say an admin is interested in querying users with the most actions taken, grouped by user name and team name. The [DataPrime](https://coralogix.com/docs/docs/dataprime/introduction/welcome-to-the-dataprime-reference/.md) query will look as follows: ``` source logs | filter actorDetails.username != null | filter actorDetails.teamName != null | groupby actorDetails.username as username, actorDetails.teamName as team_name agg count() as count ``` ### Create analytics in Custom Dashboards[​](#create-analytics-in-custom-dashboards "Direct link to Create analytics in Custom Dashboards") Create a visual in Custom Dashboards to view audit event analytics. [![auditv2\_analytics1.png](/docs/assets/images/auditv2_analytics1-c1163e6c3bd1c6eea514f38f467f68d6.webp)](https://coralogix.com/docs/docs/assets/images/auditv2_analytics1-c1163e6c3bd1c6eea514f38f467f68d6.webp) In this example, the user has created a pie chart to understand the breakdown of events per Coralogix environment. Here you can see the user query failure errors per Coralogix event. [![auditv2\_analytics2.png](/docs/assets/images/auditv2_analytics2-9e650741148fa67b07dbed8f16a4aeb1.webp)](https://coralogix.com/docs/docs/assets/images/auditv2_analytics2-9e650741148fa67b07dbed8f16a4aeb1.webp)