Skip to content

Audit Events

Audit events are generated by user actions within a workspace. They record project usage, user behavior, and resource changes in real time, including but not limited to:

  • Workspace management events: e.g., changes to basic settings, member permission modifications, deletion of notification targets, license expiration, etc.
  • Feature and service usage events: e.g., creating/modifying/deleting views, creating application detection, disabling a detection library, setting host mute, generating metrics, etc.
  • Billing item events: e.g., project usage approaching the free quota, etc.
  • ...

Audit Event Scope

  • User login and access behavior records
  • User operation behavior records
  • OpenAPI operation behavior records

Querying Audit Events

In a workspace, you can use DQL queries to retrieve audit events:

TAE::re(`.*`):(`*`){ `df_source` IN ['audit'] }

Managing Audit Events

Go to Management > Audit Events to view all user operation events generated in the workspace.

  • In the list, you can search, group, and aggregate events.
  • Use the time widget at the top of the page to view events within different time ranges.
  • Click Settings to create a monitor directly for audit events or export the current audit event list as a CSV.

Grouping and Aggregation

Group by operator to see the total number of aggregated events triggered by users in the workspace within a specific time range.

In grouping mode, you can also view aggregated events. Click an aggregated event to see all audit events triggered by a specific user (operator) on the details page.

Audit Event Details

Click a single event in the operation event list to slide out the event details page, where you can view the trigger time, tag attributes, operator, event content, and more.

You can also use the following fields for custom query analysis:

Field Name
Type Required Description
date Integer Yes Generation time, Unix timestamp in ms
df_date_range Integer Yes Time range, in seconds
df_source String Yes Data source; for audit events, the value is audit
df_status String Yes Status; default value is info for audit events
df_origin String Yes Operation source, used to record the entry point of the operation.
Reference values:
  • front: frontend user operation
  • openapi: operation via OpenAPI
  • manage: operation via the management backend
  • inner: operation via the internal trusted system
    		•
    df_menu String Yes Menu path accessed by the user, e.g., Logs-Explorer
    df_event_id String Yes Unique event ID
    df_title String Yes Title
    df_message String Yes Description
    df_user_id String Yes User ID
    df_user_name String Yes User name
    df_user_email String Yes User email; corresponds to id, name, email in Members
    df_user_team String Yes Current team of the user
    df_role_scope String Yes Current role scope of the user
    df_operation_id String Yes Unique ID of the actual operation item corresponding to the current audit event
    df_operation_name String Yes Name of the menu item corresponding to the operation that generated the current audit event. For example, if an audit event was generated by an operation on a notification policy, this field is the name of that notification policy.
    df_query_typeDQL String Yes Query type
    df_query String Yes DQL query
    df_query_range String Yes DQL query duration, in ms
    df_cost String Yes DQL query time
    df_hit_count String Yes Number of query hits
    df_workspace String Yes Workspace to which the audit event belongs

    Data Storage

    Audit event data is stored independently from the event storage policies of other data in the workspace. Its default retention period is 2 years. You can view and adjust the storage policy via Management > Settings > Change Data Storage Policy.