--- title: Coralogix Audit description: Monitor user actions, API operations, data access and configuration changes across your Coralogix organization with audit logs, and find every audit event type. url: https://coralogix.com/docs/user-guides/account-management/coralogix-audit/ product: aaa feature: Audit Log feature_id: team-auditing feature_identifier: aaa/team-auditing last_updated: '2026-11-05' --- # Coralogix Audit ## Overview Users with audit permissions can utilize Coralogix audit logs to monitor organizational activity within Coralogix, including all user actions and API operations. This tool empowers you to track actions, ensure compliance, and maintain transparency across your team or organization. Use Coralogix Audit to: * **Audit data access**: every log and metric read or search (via Logs Explorer, DataPrime, Lucene, templates, dashboards, alerts, or API) generates an audit event carrying the query, actor identity, auth type, and source IP. * **Track logins and authentication**: user login events (`user-account.login`) and SSO verification steps are recorded, including the auth type used. * **Monitor team and account associations**: attach and detach events are recorded whenever a team or account is linked to or removed from your tenant. * **Identify internal and service access**: access by internal Coralogix services, OAuth apps, integrations, and API keys is captured with full attribution, including `authType` so you can distinguish interactive users from automated processes. * **Track configuration changes**: before-and-after states are recorded for create, update, and delete operations on every supported resource. * **Create compliance analytics**: query and visualize activity across your account by actor, feature group, auth type, and time range. ## How it works Audit events from your teams (the **source teams**) are routed to a single designated **destination team** (the **audit team**) where they're centralized for querying and analysis. With **Audit v2**, events are logged and delivered to the audit team in real time as they occur (e.g., when a query is executed or an API operation takes place). These events follow a standardized structure, ensuring efficient querying and compliance-focused analysis. This page describes **Audit v2**, the current audit log structure. The earlier structure is covered in [Deprecation of Audit v1 schema](https://coralogix.com/docs/user-guides/latest-updates/deprecations/audit-v1.md). Note Data **ingestion** events (sending logs, metrics, or traces to Coralogix) are not audited due to the volume of requests. Audit coverage applies to read, query, and configuration operations. ## Permissions To view or manage audit team settings, users must have the required permissions: | Resource | Description | System roles | API presets | | ---------------------------- | -------------------------------- | -------------------------- | ----------- | | `TEAM-AUDITING:READCONFIG` | View team audit settings. | Data Admin, Platform Admin | Auditing | | `TEAM-AUDITING:UPDATECONFIG` | Manage your team audit settings. | Data Admin, Platform Admin | Auditing | Membership in the audit team allows you to view audit events. ## Setup ### Access audit settings In the main menu, select **Settings**, then **Audit**. The page opens with the title **Team audit log**. ### Audit log destination card The **Audit log destination** card shows where audit logs from the current team are sent. A badge on the card indicates the current state: | Badge | Meaning | | -------------- | ---------------------------------------------------------------------------- | | Active | Audit logs from this team are sent to the destination shown on the card. | | Inactive | A destination is set, but audit logs from this team aren't being sent to it. | | Not configured | No destination has been set yet. | Note The audit log destination only controls **where** audit logs are routed, not whether audit data is **collected**. Audit data collection and datasets are configured in [Dataspace Management](https://coralogix.com/docs/user-guides/data-layer/dataset-management.md). To configure a destination: 1. Select **Configure audit destination** (first-time setup) or **Change destination** (to swap an existing destination). 2. In the **Change audit log destination** drawer, search for the team you want to use as the destination and select **Set as destination**. 3. In the confirmation dialog, select **Change destination**. Use the toggle on the card to activate or deactivate sending audit logs without changing the destination. Select **View audit history** on the card to open the destination team filtered to events from the current team. You are redirected to [Explore](https://coralogix.com/docs/user-guides/data_exploration.md). ### Team members card The **Team members** card lists members of the **current team** (the source team whose actions are being audited) not members of the destination audit team. For each member you can: * Filter by role or search by name and email. * Select **View user audit logs** to open the destination team filtered to that user's events. If no destination is configured, **View user audit logs** is unavailable. ## Billing & usage The audit team has a daily quota of up to 25 MB and a retention period of 7 days. This quota should generally be sufficient for audit purposes. However, using the [quota management CLI](https://coralogix.com/docs/user-guides/account-management/payment-and-billing/quota-management.md), you can increase it or reallocate it between teams if needed. Configure your [S3 archive](https://coralogix.com/docs/user-guides/data-flow/s3-archive/connect-s3-archive.md) to retain audit logs for longer periods. You can query these logs in [Explore](https://coralogix.com/docs/user-guides/data_exploration.md) or use [Background Queries](https://coralogix.com/docs/user-guides/dataengine/background_queries_v1.md) for long-running queries. ## Audit events structure Events follow a unified structure, comprising an **audit envelope** and an **audit payload**. Payloads are standardized per event type (e.g., `after` for `create`, `before`/`after` for `update`, etc.). ## Audit envelope The envelope structure consists of the following fields: | Field | Description | | ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | `auditVersion` | Audit log structure version (e.g., v2, v3, etc.). | | `eventName` | The name of the event reflects its related features and functionality. | | `cxFeature` | The specific Coralogix feature the event data is related to. | | `cxFeatureGroup` | Stable Coralogix feature groups, used as the subsystem name of each audit event. | | `eventKind` | The type of the event (Action/Update/Delete/Create/Get/List). `eventData` payload structure is determined by this key. | | `endpointInfo` | Provides connection information, like the protocol used to connect to the system, the IP address that sent the request, and the request protocol. | | `authDetails` | Authentication details including the `authType` field (see below) and, depending on auth type, additional fields such as `apiKeyId` or `apiKeyName`. | | `actorDetails` | Details about the actor responsible for the action (organization, user, or team). | | `eventData` | The event payload, which contains details about the resources affected by the event and/or the resources themselves. | | `outcome` | The logical outcome of the actions. Contains the outcome status and failure type if relevant. | **Example** ``` { "endpointInfo":{ "clientInfo":{ "ipAddress": , "userAgent": }, "protocol": "HTTP", "httpDetails": { "statusCode": 200 } }, "cxFeatureGroup": "metrics", "actorDetails": { "actorType": "User", "username": , "teamId": , "teamName": , "orgName": }, "auditVersion": "v2", "eventData": { ... }, "eventKind": "Action", "eventName": "logs-data-api.ReadData", "authDetails": { "authType": , "apiKeyId": , "apiKeyName": , "apiKeyOwnerType": }, "outcome": { "status": "Success", "statusMessage": "200 OK" }, "cxFeature": "metrics.data-api" } ``` ### Authentication types The `authDetails.authType` field identifies how the actor authenticated. Use this field to distinguish interactive users from automated processes when querying audit logs. | `authType` value | Description | | ------------------- | -------------------------------------------------------------------------------------------------------------------- | | `User Login` | Interactive user session authenticated via the Coralogix UI or SSO. | | `Api Key` | Request authenticated with a Coralogix API key. Additional fields: `apiKeyId`, `apiKeyName`, `apiKeyOwnerType`. | | `Oauth2Token` | OAuth 2.0 token issued to a connected app or service-to-service integration. | | `Integration Token` | Token used by a Coralogix-native integration (for example, a Slack app or internal notification job). | | `Internal Context` | Internal Coralogix background service or scheduled job acting on behalf of a team. No user or API key is associated. | ## Audit payload ### Event kind Each event kind has a common payload structure, which is contained in the `eventData` field and is determined by the `eventKind` field. Note Large payloads are converted to strings and contained in the `stringifiedEventData` field for increased indexing efficiency. * **Action** Contains complex event data with varying structure. * **List** Contains a filter field with the resource request. ``` "eventData": { "filter": } ``` * **Get** Contains an identifier of the received resource. ``` "eventData":{ "identifier": } ``` * **Delete** Contains the deleted resource. ``` "eventData": { "data": { "displayName": , "description": , "filters": [ ... ], "id": } } ``` * **Create** Contains the created resource. ``` "eventData": { "data": { "data": { ... }, "name": , "id": } } ``` * **Update** Contains the original and new versions of a resource. ``` "eventData": { "before": { ... }, "after": { ... } } ``` ### Events per feature The following tables list the audit events emitted by each Coralogix feature. For every feature, they show the `eventName`, its corresponding event type, and the `eventKind` that determines the payload structure. Expand a feature to see the events it produces. [Coralogix custom actions](https://coralogix.com/docs/user-guides/data_exploration/custom_actions.md) | **Event Name** | **Event Type** | **Event Kind** | | -------------- | ------------------------------------ | -------------- | | actions.order | ACTION\_EVENT\_TYPE\_ACTION\_ORDER | Action | | actions.list | LIST\_EVENT\_TYPE\_ACTION\_LIST | List | | actions.get | GET\_EVENT\_TYPE\_ACTION\_GET | Get | | actions.delete | DELETE\_EVENT\_TYPE\_ACTION\_DELETE | Delete | | actions.create | CREATE\_EVENT\_TYPE\_ACTION\_CREATE | Create | | actions.update | UPDATE\_EVENT\_TYPE\_ACTION\_REPLACE | Update | Access Policies | **Event Name** | **Event Type** | **Event Kind** | | -------------------------- | ----------------------------------------- | -------------- | | access-policy.create | CREATE\_EVENT\_TYPE\_ACCESS\_POLICY | Create | | access-policy.delete | DELETE\_EVENT\_TYPE\_ACCESS\_POLICY | Delete | | access-policy.update | UPDATE\_EVENT\_TYPE\_ACCESS\_POLICY | Update | | access-policy.list | LIST\_EVENT\_TYPE\_ACCESS\_POLICY | List | | access-policy-targets.list | LIST\_EVENT\_TYPE\_ACCESS\_POLICY\_TARGET | List | [Alerts](https://coralogix.com/docs/user-guides/alerting/introduction-to-alerts.md) | **Event Name** | **Event Type** | **Event Kind** | | -------------- | ---------------------------------- | -------------- | | alert.snooze | ACTION\_EVENT\_TYPE\_ALERT\_SNOOZE | Action | | alerts.list | LIST\_EVENT\_TYPE\_ALERT | List | | ------------- | -------------------------- | ------ | | alerts.get | GET\_EVENT\_TYPE\_ALERT | Get | | alerts.delete | DELETE\_EVENT\_TYPE\_ALERT | Delete | | alerts.create | CREATE\_EVENT\_TYPE\_ALERT | Create | | alerts.update | UPDATE\_EVENT\_TYPE\_ALERT | Update | [Alert Scheduler](https://coralogix.com/docs/developer-portal/apis/data-management/alert-suppression-rules-api.md) | **Event Name** | **Event Type** | **Event Kind** | | ----------------------- | ------------------------------------- | -------------- | | alert\_scheduler.list | LIST\_EVENT\_TYPE\_ALERT\_SCHEDULER | List | | alert\_scheduler.get | GET\_EVENT\_TYPE\_ALERT\_SCHEDULER | Get | | alert\_scheduler.delete | DELETE\_EVENT\_TYPE\_ALERT\_SCHEDULER | Delete | | alert\_scheduler.create | CREATE\_EVENT\_TYPE\_ALERT\_SCHEDULER | Create | | alert\_scheduler.update | UPDATE\_EVENT\_TYPE\_ALERT\_SCHEDULER | Update | [API Keys](https://coralogix.com/docs/user-guides/account-management/api-keys/api-keys.md) | **Event Name** | **Event Type** | **Event Kind** | | -------------------------------------- | ------------------------------------------------ | -------------- | | api-key.get | GET\_EVENT\_TYPE\_API\_KEY | Get | | api-key.delete | DELETE\_EVENT\_TYPE\_API\_KEY | Delete | | api-key.create | CREATE\_EVENT\_TYPE\_API\_KEY | Create | | api-key.update | UPDATE\_EVENT\_TYPE\_API\_KEY | Update | | api-keys.list | LIST\_EVENT\_TYPE\_API\_KEY | List | | team-api-keys-security-settings.update | UPDATE\_EVENT\_TYPE\_API\_KEY\_SECURITY\_SETTING | Update | | api-key-roles.list | LIST\_EVENT\_TYPE\_API\_KEY\_ROLE | List | [APM](https://coralogix.com/docs/user-guides/apm/getting-started/apm-onboarding-tutorial.md) | **Event Name** | **Event Type** | **Event Kind** | | ------------------- | ---------------------------------- | -------------- | | apm.entity.action | ACTION\_EVENT\_TYPE\_APM\_ENTITY | Action | | apm.entity.list | LIST\_EVENT\_TYPE\_APM\_ENTITY | List | | apm.entity.get | GET\_EVENT\_TYPE\_APM\_ENTITY | Get | | apm.entity.delete | DELETE\_EVENT\_TYPE\_APM\_ENTITY | Delete | | apm.entity.create | CREATE\_EVENT\_TYPE\_APM\_ENTITY | Create | | apm.settings.update | UPDATE\_EVENT\_TYPE\_APM\_SETTINGS | Update | | apm.entity.update | UPDATE\_EVENT\_TYPE\_APM\_ENTITY | Update | Archive Setup | **Event Name** | **Event Type** | **Event Kind** | | --------------------------------------- | ------------------------------------------------- | -------------- | | archive-setup.get | GET\_EVENT\_TYPE\_ARCHIVE\_SETUP | Get | | archive-setup.update | UPDATE\_EVENT\_TYPE\_ARCHIVE\_SETUP | Update | | retentions.get | GET\_EVENT\_TYPE\_RETENTIONS | Get | | archive-setup.historical-targets.list | LIST\_EVENT\_TYPE\_ARCHIVE\_HISTORICAL\_TARGETS | List | | archive-setup.historical-targets.update | UPDATE\_EVENT\_TYPE\_ARCHIVE\_HISTORICAL\_TARGETS | Update | | retentions.activate | ACTION\_EVENT\_TYPE\_ACTIVATE\_ARCHIVE\_RETENTION | Action | | retentions.update | UPDATE\_EVENT\_TYPE\_RETENTIONS | Update | Audit Teams | **Event Name** | **Event Type** | **Event Kind** | | --------------------------------- | ------------------------------------------------------ | -------------- | | auditing.attach-team | ACTION\_EVENT\_TYPE\_AUDITING\_ATTACH\_TEAM | Action | | auditing.audit-team.create | CREATE\_EVENT\_TYPE\_AUDITING\_AUDIT\_TEAM | Create | | auditing.audit-team.deactivate | ACTION\_EVENT\_TYPE\_AUDITING\_DEACTIVATE\_AUDIT\_TEAM | Action | | auditing.audit-team.is-configured | ACTION\_EVENT\_TYPE\_AUDITING\_IS\_TEAM\_CONFIGURES | Action | | auditing.audit-teams.list | LIST\_EVENT\_TYPE\_AUDITING\_AUDIT\_TEAMS | List | | auditing.detach-team | ACTION\_EVENT\_TYPE\_AUDITING\_DETACH\_TEAM | Action | [Background Queries](https://coralogix.com/docs/user-guides/dataengine/background_queries_v1.md) | **Event Name** | **Event Type** | **Event Kind** | | --------------------------- | --------------------------------------------------- | -------------- | | background-queries.submit | ACTION\_EVENT\_TYPE\_BACKGROUND\_QUERIES\_SUBMIT | Action | | background-queries.status | ACTION\_EVENT\_TYPE\_BACKGROUND\_QUERIES\_STATUS | Action | | background-queries.get-data | ACTION\_EVENT\_TYPE\_BACKGROUND\_QUERIES\_GET\_DATA | Action | | background-queries.cancel | ACTION\_EVENT\_TYPE\_BACKGROUND\_QUERIES\_CANCEL | Action | [Cases](https://coralogix.com/docs/user-guides/cases/overview.md) | **Event Name** | **Event Type** | **Event Kind** | | ------------------------------------ | ------------------------------------------------------------- | -------------- | | case.acknowledge | ACTION\_EVENT\_TYPE\_CASE\_ACKNOWLEDGE | Action | | case.ai-summary.generate | ACTION\_EVENT\_TYPE\_CASE\_AI\_SUMMARY\_GENERATE | Action | | case.alert-events.get-cases | ACTION\_EVENT\_TYPE\_CASE\_ALERT\_EVENTS\_GET\_CASES | Action | | case.alert-events.get-ids | ACTION\_EVENT\_TYPE\_CASE\_ALERT\_EVENTS\_GET\_IDS | Action | | case.analytics.get-available-filters | ACTION\_EVENT\_TYPE\_CASE\_ANALYTICS\_GET\_AVAILABLE\_FILTERS | Action | | case.analytics.get-metrics | ACTION\_EVENT\_TYPE\_CASE\_ANALYTICS\_GET\_METRICS | Action | | case.analytics.get-overview | ACTION\_EVENT\_TYPE\_CASE\_ANALYTICS\_GET\_OVERVIEW | Action | | case.assign | ACTION\_EVENT\_TYPE\_CASE\_ASSIGN | Action | | case.bulk-acknowledge | ACTION\_EVENT\_TYPE\_CASE\_BULK\_ACKNOWLEDGE | Action | | case.bulk-assign | ACTION\_EVENT\_TYPE\_CASE\_BULK\_ASSIGN | Action | | case.bulk-close | ACTION\_EVENT\_TYPE\_CASE\_BULK\_CLOSE | Action | | case.bulk-priority-override.clear | ACTION\_EVENT\_TYPE\_CASE\_BULK\_CLEAR\_PRIORITY\_OVERRIDE | Action | | case.bulk-priority-override.set | ACTION\_EVENT\_TYPE\_CASE\_BULK\_SET\_PRIORITY\_OVERRIDE | Action | | case.bulk-resolve | ACTION\_EVENT\_TYPE\_CASE\_BULK\_RESOLVE | Action | | case.bulk-unassign | ACTION\_EVENT\_TYPE\_CASE\_BULK\_UNASSIGN | Action | | case.close | ACTION\_EVENT\_TYPE\_CASE\_CLOSE | Action | | case.comments.create | ACTION\_EVENT\_TYPE\_CASE\_COMMENTS\_CREATE | Action | | case.comments.delete | ACTION\_EVENT\_TYPE\_CASE\_COMMENTS\_DELETE | Action | | case.comments.update | ACTION\_EVENT\_TYPE\_CASE\_COMMENTS\_UPDATE | Action | | case.deep-links.get | ACTION\_EVENT\_TYPE\_CASE\_GET\_DEEP\_LINKS | Action | | case.events.get | ACTION\_EVENT\_TYPE\_CASE\_EVENTS\_GET | Action | | case.events.list | ACTION\_EVENT\_TYPE\_CASE\_EVENTS\_LIST | Action | | case.events.sync-external | ACTION\_EVENT\_TYPE\_CASE\_SYNC\_EXTERNAL\_EVENTS | Action | | case.external-references.get | ACTION\_EVENT\_TYPE\_CASE\_GET\_EXTERNAL\_REFERENCES | Action | | case.filter-values.get | ACTION\_EVENT\_TYPE\_CASE\_GET\_FILTER\_VALUES | Action | | case.get | GET\_EVENT\_TYPE\_CASE | Get | | case.grouping-keys.get | ACTION\_EVENT\_TYPE\_CASE\_GET\_GROUPING\_KEYS | Action | | case.list | LIST\_EVENT\_TYPE\_CASE | List | | case.notification-delivery.list | LIST\_EVENT\_TYPE\_CASE\_NOTIFICATION\_DELIVERY | List | | case.priority-override.clear | ACTION\_EVENT\_TYPE\_CASE\_CLEAR\_PRIORITY\_OVERRIDE | Action | | case.priority-override.set | ACTION\_EVENT\_TYPE\_CASE\_SET\_PRIORITY\_OVERRIDE | Action | | case.resolve | ACTION\_EVENT\_TYPE\_CASE\_RESOLVE | Action | | case.system-defaults.get | ACTION\_EVENT\_TYPE\_CASE\_GET\_SYSTEM\_DEFAULTS | Action | | case.unacknowledge | ACTION\_EVENT\_TYPE\_CASE\_UNACKNOWLEDGE | Action | | case.unassign | ACTION\_EVENT\_TYPE\_CASE\_UNASSIGN | Action | | case.update | UPDATE\_EVENT\_TYPE\_CASE | Update | | case.create | CREATE\_EVENT\_TYPE\_CASE | Create | | case.bulk-get | LIST\_EVENT\_TYPE\_CASE\_BULK\_GET | List | | case.link | ACTION\_EVENT\_TYPE\_CASE\_LINK | Action | | case.links.get | GET\_EVENT\_TYPE\_CASE\_LINKS | Get | | case.mute | ACTION\_EVENT\_TYPE\_CASE\_MUTE | Action | | case.unmute | ACTION\_EVENT\_TYPE\_CASE\_UNMUTE | Action | | case.unlink | ACTION\_EVENT\_TYPE\_CASE\_UNLINK | Action | **Case team configuration** | **Event Name** | **Event Type** | **Event Kind** | | --------------------------- | ---------------------------------------------------- | -------------- | | case-team-config.create | CREATE\_EVENT\_TYPE\_CASE\_TEAM\_CONFIG | Create | | case-team-config.delete | DELETE\_EVENT\_TYPE\_CASE\_TEAM\_CONFIG | Delete | | case-team-config.get | GET\_EVENT\_TYPE\_CASE\_TEAM\_CONFIG | Get | | case-team-config.get-active | ACTION\_EVENT\_TYPE\_CASE\_TEAM\_CONFIG\_GET\_ACTIVE | Action | | case-team-config.update | UPDATE\_EVENT\_TYPE\_CASE\_TEAM\_CONFIG | Update | [Cloud Metadata Enrichment](https://coralogix.com/docs/user-guides/enrichment_rules/aws_resource_enrichment.md) | **Event Name** | **Event Type** | **Event Kind** | | -------------------------------- | ------------------------------------------------ | -------------- | | cloud-metadata-enrichment.delete | DELETE\_EVENT\_TYPE\_CLOUD\_METADATA\_ENRICHMENT | Delete | | cloud-metadata-enrichment.create | CREATE\_EVENT\_TYPE\_CLOUD\_METADATA\_ENRICHMENT | Create | | cloud-metadata-enrichment.update | UPDATE\_EVENT\_TYPE\_CLOUD\_METADATA\_ENRICHMENT | Update | [Continuous Profiling](https://coralogix.com/docs/user-guides/continuous-profiling/introduction.md) | **Event Name** | **Event Type** | **Event Kind** | | -------------------------------- | ------------------------------------------------------- | -------------- | | profiles.symbols.upload | ACTION\_EVENT\_TYPE\_PROFILES\_SYMBOLS\_UPLOAD | Action | | profiles.query | ACTION\_EVENT\_TYPE\_PROFILES\_QUERY | Action | | profiles.query.graph | ACTION\_EVENT\_TYPE\_PROFILES\_QUERY\_GRAPH | Action | | profiles.service.overview\.query | ACTION\_EVENT\_TYPE\_PROFILES\_SERVICE\_OVERVIEW\_QUERY | Action | Cora Settings | **Event Name** | **Event Type** | **Event Kind** | | -------------------- | ----------------------------------- | -------------- | | cora.settings.update | UPDATE\_EVENT\_TYPE\_CORA\_SETTINGS | Update | [Custom Enrichment](https://coralogix.com/docs/user-guides/enrichment_rules/custom_enrichment.md) | **Event Name** | **Event Type** | **Event Kind** | | ----------------------------- | --------------------------------------------------- | -------------- | | custom-enrichment.overwrite | ACTION\_EVENT\_TYPE\_OVERWRITE\_CUSTOM\_ENRICHMENTS | Action | | custom-enrichment.delete | DELETE\_EVENT\_TYPE\_CUSTOM\_ENRICHMENT | Delete | | custom-enrichment.create | CREATE\_EVENT\_TYPE\_CUSTOM\_ENRICHMENT | Create | | custom-enrichment.update | UPDATE\_EVENT\_TYPE\_CUSTOM\_ENRICHMENT | Update | | custom-enrichment-data.list | LIST\_EVENT\_TYPE\_CUSTOM\_ENRICHMENT\_DATA | List | | custom-enrichment-data.get | GET\_EVENT\_TYPE\_CUSTOM\_ENRICHMENT\_DATA | Get | | custom-enrichment-data.delete | DELETE\_EVENT\_TYPE\_CUSTOM\_ENRICHMENT\_DATA | Delete | | custom-enrichment-data.create | CREATE\_EVENT\_TYPE\_CUSTOM\_ENRICHMENT\_DATA | Create | | custom-enrichment-data.update | UPDATE\_EVENT\_TYPE\_CUSTOM\_ENRICHMENT\_DATA | Update | [Dashboard Reports](https://coralogix.com/docs/user-guides/custom-dashboards/tutorials/save-a-dashboard-as-a-pdf.md) | **Event Name** | **Event Type** | **Event Kind** | | -------------------------------- | ------------------------------------------------ | -------------- | | dashboard-report.get | GET\_EVENT\_TYPE\_DASHBOARD\_REPORT | Get | | dashboard-report-schedule.list | LIST\_EVENT\_TYPE\_DASHBOARD\_REPORT\_SCHEDULE | List | | dashboard-report-schedule.get | GET\_EVENT\_TYPE\_DASHBOARD\_REPORT\_SCHEDULE | Get | | dashboard-report-schedule.delete | DELETE\_EVENT\_TYPE\_DASHBOARD\_REPORT\_SCHEDULE | Delete | | dashboard-report-schedule.create | CREATE\_EVENT\_TYPE\_DASHBOARD\_REPORT\_SCHEDULE | Create | | dashboard-report-schedule.update | UPDATE\_EVENT\_TYPE\_DASHBOARD\_REPORT\_SCHEDULE | Update | [Dashboards](https://coralogix.com/docs/user-guides/custom-dashboards/introduction.md) | **Event Name** | **Event Type** | **Event Kind** | | ------------------------------------ | ----------------------------------------------------------- | -------------- | | dashboards.list | LIST\_EVENT\_TYPE\_DASHBOARD | List | | dashboards.get | GET\_EVENT\_TYPE\_DASHBOARD | Get | | dashboards.delete | DELETE\_EVENT\_TYPE\_DASHBOARD | Delete | | dashboards.create | CREATE\_EVENT\_TYPE\_DASHBOARD | Create | | dashboards.update | UPDATE\_EVENT\_TYPE\_DASHBOARD | Update | | dashboards.pin | ACTION\_EVENT\_TYPE\_DASHBOARD\_PIN | Action | | dashboards.set-as-default | ACTION\_EVENT\_TYPE\_DASHBOARD\_SET\_AS\_DEFAULT | Action | | dashboards.archive | ACTION\_EVENT\_TYPE\_DASHBOARD\_ARCHIVE | Action | | dashboards.archived.list | LIST\_EVENT\_TYPE\_ARCHIVED\_DASHBOARD | List | | dashboards.list-highlighted-widgets | LIST\_EVENT\_TYPE\_DASHBOARD\_HIGHLIGHTED\_WIDGETS | List | | dashboards.restore | ACTION\_EVENT\_TYPE\_DASHBOARD\_RESTORE | Action | | dashboards.set-highlighted-widgets | ACTION\_EVENT\_TYPE\_DASHBOARD\_SET\_HIGHLIGHTED\_WIDGETS | Action | | dashboards.unpin | ACTION\_EVENT\_TYPE\_DASHBOARD\_UNPIN | Action | | dashboards.unset-highlighted-widgets | ACTION\_EVENT\_TYPE\_DASHBOARD\_UNSET\_HIGHLIGHTED\_WIDGETS | Action | | dashboards.export | ACTION\_EVENT\_TYPE\_DASHBOARD\_EXPORT | Action | | dashboards.move | ACTION\_EVENT\_TYPE\_DASHBOARD\_MOVE | Action | | dashboard-folder.create | CREATE\_EVENT\_TYPE\_DASHBOARD\_FOLDER | Create | | dashboard-folder.update | UPDATE\_EVENT\_TYPE\_DASHBOARD\_FOLDER | Update | | dashboard-folder.delete | DELETE\_EVENT\_TYPE\_DASHBOARD\_FOLDER | Delete | [Data Usage](https://coralogix.com/docs/user-guides/account-management/payment-and-billing/data-usage.md) | **Event Name** | **Event Type** | **Event Kind** | | -------------------------------------- | ----------------------------------------------------- | -------------- | | datausage.get-daily | ACTION\_EVENT\_TYPE\_GET\_DAILY\_DATA\_USAGE | Action | | datausage.export | ACTION\_EVENT\_TYPE\_EXPORT\_DETAILED\_DATA\_USAGE | Action | | datausage.data-usage-to-metrics-enable | ACTION\_EVENT\_TYPE\_DATA\_USAGE\_TO\_METRICS\_ENABLE | Action | Email Filter | **Event Name** | **Event Type** | **Event Kind** | | -------------------- | ---------------------------------- | -------------- | | email\_filter.update | UPDATE\_EVENT\_TYPE\_EMAIL\_FILTER | Update | | email\_filter.create | CREATE\_EVENT\_TYPE\_EMAIL\_FILTER | Create | | email\_filter.list | LIST\_EVENT\_TYPE\_EMAIL\_FILTER | List | [Enrichment](https://coralogix.com/docs/user-guides/enrichment_rules.md) | **Event Name** | **Event Type** | **Event Kind** | | --------------- | ----------------------------- | -------------- | | enrichment.list | LIST\_EVENT\_TYPE\_ENRICHMENT | List | | enrichment.get | GET\_EVENT\_TYPE\_ENRICHMENT | Get | [Events2Metrics](https://coralogix.com/docs/user-guides/monitoring-and-insights/events2metrics.md) | events-2-metrics.list | LIST\_EVENT\_TYPE\_EVENTS\_2\_METRICS | List | | ----------------------- | --------------------------------------- | ------ | | events-2-metrics.get | GET\_EVENT\_TYPE\_EVENTS\_2\_METRICS | Get | | events-2-metrics.delete | DELETE\_EVENT\_TYPE\_EVENTS\_2\_METRICS | Delete | | events-2-metrics.create | CREATE\_EVENT\_TYPE\_EVENTS\_2\_METRICS | Create | | events-2-metrics.update | UPDATE\_EVENT\_TYPE\_EVENTS\_2\_METRICS | Update | [Extensions](https://coralogix.com/docs/integrations/extensions.md) | **Event Name** | **Event Type** | **Event Kind** | | ----------------------------- | ---------------------------------------------------- | -------------- | | extensions.undeploy | ACTION\_EVENT\_TYPE\_EXTENSION\_UNDEPLOY | Action | | extensions.update | ACTION\_EVENT\_TYPE\_EXTENSION\_UPDATE | Action | | extensions.deploy | ACTION\_EVENT\_TYPE\_EXTENSION\_DEPLOY | Action | | extensions.list | LIST\_EVENT\_TYPE\_EXTENSION | List | | extensions.get | GET\_EVENT\_TYPE\_EXTENSION | Get | | extension-testing.initialize | ACTION\_EVENT\_TYPE\_EXTENSION\_TESTING\_INITIALIZE | Action | | extension-testing.cleanup | ACTION\_EVENT\_TYPE\_EXTENSION\_TESTING\_CLEANUP | Action | | extension-testing.test | ACTION\_EVENT\_TYPE\_EXTENSION\_TESTING\_TEST | Action | | integration-extensions.deploy | ACTION\_EVENT\_TYPE\_INTEGRATION\_EXTENSIONS\_DEPLOY | Action | External Events | **Event Name** | **Event Type** | **Event Kind** | | ---------------------- | -------------------------------------------- | -------------- | | external-events.submit | ACTION\_EVENT\_TYPE\_EXTERNAL\_EVENT\_SUBMIT | Action | Folders | **Event Name** | **Event Type** | **Event Kind** | | ---------------------------- | -------------------------------------------- | -------------- | | folder.update | UPDATE\_EVENT\_TYPE\_FOLDER | Update | | folder.create | CREATE\_EVENT\_TYPE\_FOLDER | Create | | folder.delete | DELETE\_EVENT\_TYPE\_FOLDER | Delete | | folder.get | GET\_EVENT\_TYPE\_FOLDER | Get | | folder.list | LIST\_EVENT\_TYPE\_FOLDER | List | | folder.content-policy.create | CREATE\_EVENT\_TYPE\_FOLDER\_CONTENT\_POLICY | Create | | folder.content-policy.delete | DELETE\_EVENT\_TYPE\_FOLDER\_CONTENT\_POLICY | Delete | | folder.content-policy.update | UPDATE\_EVENT\_TYPE\_FOLDER\_CONTENT\_POLICY | Update | [Forwarders](https://coralogix.com/docs/user-guides/data-flow/forwarders.md) | **Event Name** | **Event Type** | **Event Kind** | | ----------------- | ------------------------------------- | -------------- | | forwarders.test | ACTION\_EVENT\_TYPE\_FORWARDERS\_TEST | Action | | forwarders.list | LIST\_EVENT\_TYPE\_FORWARDERS | List | | forwarders.get | GET\_EVENT\_TYPE\_FORWARDERS | Get | | forwarders.delete | DELETE\_EVENT\_TYPE\_FORWARDERS | Delete | | forwarders.create | CREATE\_EVENT\_TYPE\_FORWARDERS | Create | | forwarders.update | UPDATE\_EVENT\_TYPE\_FORWARDERS | Update | Frequent Search Mapping Statistics | **Event Name** | **Event Type** | **Event Kind** | | -------------------------------------- | ------------------------------------------------------- | -------------- | | frequent-search-mapping-statistics.get | GET\_EVENT\_TYPE\_FREQUENT\_SEARCH\_MAPPING\_STATISTICS | Get | [Geo Enrichment](https://coralogix.com/docs/user-guides/enrichment_rules/geo_enrichment.md) | **Event Name** | **Event Type** | **Event Kind** | | --------------------- | ------------------------------------ | -------------- | | geo-enrichment.delete | DELETE\_EVENT\_TYPE\_GEO\_ENRICHMENT | Delete | | geo-enrichment.create | CREATE\_EVENT\_TYPE\_GEO\_ENRICHMENT | Create | | geo-enrichment.update | UPDATE\_EVENT\_TYPE\_GEO\_ENRICHMENT | Update | Group | **Event Name** | **Event Type** | **Event Kind** | | ------------------ | --------------------------------- | -------------- | | group.delete | DELETE\_EVENT\_TYPE\_GROUP | Delete | | group.create | CREATE\_EVENT\_TYPE\_GROUP | Create | | group.update | UPDATE\_EVENT\_TYPE\_GROUP | Update | | group.get | GET\_EVENT\_TYPE\_GROUP | Get | | group.list | LIST\_EVENT\_TYPE\_GROUP | List | | group.members.list | LIST\_EVENT\_TYPE\_GROUP\_MEMBERS | List | | group.roles.list | LIST\_EVENT\_TYPE\_GROUP\_ROLES | List | | group.scope.get | GET\_EVENT\_TYPE\_GROUP\_SCOPE | Get | [Heroku App Attachment](https://coralogix.com/docs/integrations/paas-platforms/heroku.md) | **Event Name** | **Event Type** | **Event Kind** | | ---------------------------- | -------------------------------------------- | -------------- | | heroku-app-attachment.create | CREATE\_EVENT\_TYPE\_HEROKU\_APP\_ATTACHMENT | Create | | heroku-app-attachment.delete | DELETE\_EVENT\_TYPE\_HEROKU\_APP\_ATTACHMENT | Delete | Identity & Login History | **Event Name** | **Event Type** | **Event Kind** | | ----------------- | -------------------------------- | -------------- | | identity.get | GET\_EVENT\_TYPE\_IDENTITY | Get | | login-history.get | GET\_EVENT\_TYPE\_LOGIN\_HISTORY | Get | [Incidents](https://coralogix.com/docs/user-guides/alerting/incidents.md) | **Event Name** | **Event Type** | **Event Kind** | | --------------------- | ------------------------------------------- | -------------- | | incidents.close | ACTION\_EVENT\_TYPE\_INCIDENTS\_CLOSE | Action | | incidents.assign | ACTION\_EVENT\_TYPE\_INCIDENTS\_ASSIGN | Action | | incidents.unassign | ACTION\_EVENT\_TYPE\_INCIDENTS\_UNASSIGN | Action | | incidents.acknowledge | ACTION\_EVENT\_TYPE\_INCIDENTS\_ACKNOWLEDGE | Action | | incidents.list | LIST\_EVENT\_TYPE\_INCIDENTS | List | | incidents.get | GET\_EVENT\_TYPE\_INCIDENTS | Get | [Infrastructure Monitoring](https://coralogix.com/docs/user-guides/infrastructure/infrastructure-explorer/infra-health.md) | **Event Name** | **Event Type** | **Event Kind** | | ----------------------------------- | ----------------------------------- | -------------- | | infrastructure.health-rule.update | UPDATE\_EVENT\_TYPE\_HEALTH\_RULE | Update | | infrastructure.health-policy.update | UPDATE\_EVENT\_TYPE\_HEALTH\_POLICY | Update | | infrastructure.saved-view\.update | UPDATE\_EVENT\_TYPE\_SAVED\_VIEW | Update | | infrastructure.health-rule.create | CREATE\_EVENT\_TYPE\_HEALTH\_RULE | Create | | infrastructure.saved-view\.create | CREATE\_EVENT\_TYPE\_SAVED\_VIEW | Create | | infrastructure.health-rule.delete | DELETE\_EVENT\_TYPE\_HEALTH\_RULE | Delete | | infrastructure.saved-view\.delete | DELETE\_EVENT\_TYPE\_SAVED\_VIEW | Delete | [Investigations](https://coralogix.com/docs/user-guides/investigations/overview.md) | **Event Name** | **Event Type** | **Event Kind** | | --------------------------------- | -------------------------------------------------------- | -------------- | | investigation.list | LIST\_EVENT\_TYPE\_INVESTIGATION | List | | investigation.update | UPDATE\_EVENT\_TYPE\_INVESTIGATION | Update | | investigation.create | CREATE\_EVENT\_TYPE\_INVESTIGATION | Create | | investigation.delete | DELETE\_EVENT\_TYPE\_INVESTIGATION | Delete | | investigation.get | GET\_EVENT\_TYPE\_INVESTIGATION | Get | | investigation.events.create | ACTION\_EVENT\_TYPE\_INVESTIGATION\_EVENTS\_CREATE | Action | | investigation.events.update | ACTION\_EVENT\_TYPE\_INVESTIGATION\_EVENTS\_UPDATE | Action | | investigation.events.delete | ACTION\_EVENT\_TYPE\_INVESTIGATION\_EVENTS\_DELETE | Action | | investigation.events.list | ACTION\_EVENT\_TYPE\_INVESTIGATION\_EVENTS\_LIST | Action | | investigation.participants.add | ACTION\_EVENT\_TYPE\_INVESTIGATION\_PARTICIPANTS\_ADD | Action | | investigation.participants.remove | ACTION\_EVENT\_TYPE\_INVESTIGATION\_PARTICIPANTS\_REMOVE | Action | | investigation.participants.list | ACTION\_EVENT\_TYPE\_INVESTIGATION\_PARTICIPANTS\_LIST | Action | | investigation.postmortem.create | ACTION\_EVENT\_TYPE\_INVESTIGATION\_POSTMORTEM\_CREATE | Action | | investigation.postmortem.patch | ACTION\_EVENT\_TYPE\_INVESTIGATION\_POSTMORTEM\_PATCH | Action | | investigation.postmortem.search | ACTION\_EVENT\_TYPE\_INVESTIGATION\_POSTMORTEM\_SEARCH | Action | Integrations | **Event Name** | **Event Type** | **Event Kind** | | ------------------------------------ | ------------------------------------------------- | -------------- | | integration.check-api-key-permission | ACTION\_EVENT\_TYPE\_CHECK\_API\_KEY\_PERMISSION | Action | | integration.create | CREATE\_EVENT\_TYPE\_INTEGRATION | Create | | integration.definition.get | GET\_EVENT\_TYPE\_INTEGRATION\_DEFINITION | Get | | integration.delete | DELETE\_EVENT\_TYPE\_INTEGRATION | Delete | | integration.details.get | GET\_EVENT\_TYPE\_INTEGRATION\_DETAILS | Get | | integration.generate-token | ACTION\_EVENT\_TYPE\_INTEGRATION\_GENERATE\_TOKEN | Action | | integration.get | GET\_EVENT\_TYPE\_INTEGRATION | Get | | integration.list | LIST\_EVENT\_TYPE\_INTEGRATION | List | | integration.quotas.get | GET\_EVENT\_TYPE\_INTEGRATION\_QUOTAS | Get | | integration.rotate-token | ACTION\_EVENT\_TYPE\_INTEGRATION\_ROTATE\_TOKEN | Action | | integration.rum-app-version.get | GET\_EVENT\_TYPE\_RUM\_APPLICATION\_VERSION\_DATA | Get | | integration.sync-rum-data | ACTION\_EVENT\_TYPE\_INTEGRATION\_SYNC\_RUM\_DATA | Action | | integration.template.get | GET\_EVENT\_TYPE\_INTEGRATION\_TEMPLATE | Get | | integration.test | ACTION\_EVENT\_TYPE\_INTEGRATION\_TEST | Action | | integration.update | UPDATE\_EVENT\_TYPE\_INTEGRATION | Update | Contextual Data Integrations | **Event Name** | **Event Type** | **Event Kind** | | ------------------------------------------ | ----------------------------------------------------------- | -------------- | | contextual-data-integration.create | CREATE\_EVENT\_TYPE\_CONTEXTUAL\_DATA\_INTEGRATION | Create | | contextual-data-integration.definition.get | GET\_EVENT\_TYPE\_CONTEXTUAL\_DATA\_INTEGRATION\_DEFINITION | Get | | contextual-data-integration.delete | DELETE\_EVENT\_TYPE\_CONTEXTUAL\_DATA\_INTEGRATION | Delete | | contextual-data-integration.details.get | GET\_EVENT\_TYPE\_CONTEXTUAL\_DATA\_INTEGRATION\_DETAILS | Get | | contextual-data-integration.list | LIST\_EVENT\_TYPE\_CONTEXTUAL\_DATA\_INTEGRATION | List | | contextual-data-integration.test | ACTION\_EVENT\_TYPE\_CONTEXTUAL\_DATA\_INTEGRATION\_TEST | Action | | contextual-data-integration.update | UPDATE\_EVENT\_TYPE\_CONTEXTUAL\_DATA\_INTEGRATION | Update | **Push-based contextual data integration** | **Event Name** | **Event Type** | **Event Kind** | | --------------------------------------------- | --------------------------------------------------------------- | -------------- | | push-based-contextual-data-integration.update | UPDATE\_EVENT\_TYPE\_PUSH\_BASED\_CONTEXTUAL\_DATA\_INTEGRATION | Update | | push-based-contextual-data-integration.create | CREATE\_EVENT\_TYPE\_PUSH\_BASED\_CONTEXTUAL\_DATA\_INTEGRATION | Create | | push-based-contextual-data-integration.delete | DELETE\_EVENT\_TYPE\_PUSH\_BASED\_CONTEXTUAL\_DATA\_INTEGRATION | Delete | | push-based-contextual-data-integration.list | LIST\_EVENT\_TYPE\_PUSH\_BASED\_CONTEXTUAL\_DATA\_INTEGRATION | List | [Livetail](https://coralogix.com/docs/user-guides/data_exploration/logs/livetail.md) | **Event Name** | **Event Type** | **Event Kind** | | ------------------ | ---------------------------------------- | -------------- | | livetail.subscribe | ACTION\_EVENT\_TYPE\_LIVETAIL\_SUBSCRIBE | Action | [Logs TCO](https://coralogix.com/docs/user-guides/account-management/tco-optimizer.md) | **Event Name** | **Event Type** | **Event Kind** | | --------------- | ------------------------------------- | -------------- | | logs.tco.test | ACTION\_EVENT\_TYPE\_LOGS\_TCO\_TEST | Action | | logs.tco.order | ACTION\_EVENT\_TYPE\_LOGS\_TCO\_ORDER | Action | | logs.tco.list | LIST\_EVENT\_TYPE\_LOGS\_TCO | List | | logs.tco.get | GET\_EVENT\_TYPE\_LOGS\_TCO | Get | | logs.tco.delete | DELETE\_EVENT\_TYPE\_LOGS\_TCO | Delete | | logs.tco.create | CREATE\_EVENT\_TYPE\_LOGS\_TCO | Create | | logs.tco.update | UPDATE\_EVENT\_TYPE\_LOGS\_TCO | Update | **Logs TCO Override** | **Event Name** | **Event Type** | **Event Kind** | | ------------------------ | ---------------------------------------- | -------------- | | logs.tco-override.update | UPDATE\_EVENT\_TYPE\_LOGS\_TCO\_OVERRIDE | Update | | logs.tco-override.create | CREATE\_EVENT\_TYPE\_LOGS\_TCO\_OVERRIDE | Create | | logs.tco-override.delete | DELETE\_EVENT\_TYPE\_LOGS\_TCO\_OVERRIDE | Delete | | logs.tco-override.get | GET\_EVENT\_TYPE\_LOGS\_TCO\_OVERRIDE | Get | | logs.tco-override.list | LIST\_EVENT\_TYPE\_LOGS\_TCO\_OVERRIDE | List | [Logs Parsing Rules](https://coralogix.com/docs/user-guides/data-transformation/parsing/log-parsing-rules.md) | **Event Name** | **Event Type** | **Event Kind** | | ------------------------- | ---------------------------------------------- | -------------- | | logs.parsing-rules.order | ACTION\_EVENT\_TYPE\_LOGS\_RULES\_GROPS\_ORDER | Action | | logs.parsing-rules.list | LIST\_EVENT\_TYPE\_LOGS\_RULES\_GROUP | List | | logs.parsing-rules.get | GET\_EVENT\_TYPE\_LOGS\_RULES\_GROUP | Get | | logs.parsing-rules.delete | DELETE\_EVENT\_TYPE\_LOGS\_RULES\_GROUP | Delete | | logs.parsing-rules.create | CREATE\_EVENT\_TYPE\_LOGS\_RULES\_GROUP | Create | | logs.parsing-rules.update | UPDATE\_EVENT\_TYPE\_LOGS\_RULES\_GROUP | Update | Logs Data API | **Event Name** | **Event Type** | **Event Kind** | | ---------------------------------- | ------------------------------------------------------ | -------------- | | logs-data-api.ReadData | ACTION\_EVENT\_TYPE\_DATA\_API\_READ\_DATA | Action | | logs-data-api.query-results-export | ACTION\_EVENT\_TYPE\_DATA\_API\_QUERY\_RESULTS\_EXPORT | Action | Managed Integrations | **Event Name** | **Event Type** | **Event Kind** | | ------------------------------ | ---------------------------------------------- | -------------- | | managed-integration.status.get | GET\_EVENT\_TYPE\_MANAGED\_INTEGRATION\_STATUS | Get | | managed-integration-key.list | LIST\_EVENT\_TYPE\_MANAGED\_INTEGRATION\_KEYS | List | [Metrics](https://coralogix.com/docs/user-guides/data-query/metrics-api.md) | **Event Name** | **Event Type** | **Event Kind** | | ----------------------------------- | --------------------------------------------------- | -------------- | | metrics.data-api.read | ACTION\_EVENT\_TYPE\_METRICS\_READ\_DATA | Action | | metrics.apm-service-priority.update | ACTION\_EVENT\_TYPE\_APM\_SERVICE\_PRIORITY\_UPDATE | Action | | metrics.priority.update | ACTION\_EVENT\_TYPE\_METRICS\_PRIORITY\_UPDATE | Action | [Notification Center Presets](https://coralogix.com/docs/user-guides/notification-center/presets/introduction.md) | **Event Name** | **Event Type** | **Event Kind** | | ----------------------------------------- | ------------------------------------------------------------------- | -------------- | | notification-center-preset.set-as-default | ACTION\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_PRESET\_SET\_AS\_DEFAULT | Action | | notification-center-preset.delete | DELETE\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_PRESET | Delete | | notification-center-preset.create | CREATE\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_PRESET | Create | | notification-center-preset.update | UPDATE\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_PRESET | Update | | notification-center-preset.get | GET\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_PRESET | Get | | notification-center-preset.list | LIST\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_PRESET | List | [Notification Center Connectors](https://coralogix.com/docs/user-guides/notification-center/connectors.md) | **Event Name** | **Event Type** | **Event Kind** | | ------------------------------------ | ---------------------------------------------------- | -------------- | | notification-center-connector.create | CREATE\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_CONNECTOR | Create | | notification-center-connector.delete | DELETE\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_CONNECTOR | Delete | | notification-center-connector.get | GET\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_CONNECTOR | Get | | notification-center-connector.list | LIST\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_CONNECTOR | List | | notification-center-connector.update | UPDATE\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_CONNECTOR | Update | [Notification Center Routers](https://coralogix.com/docs/user-guides/notification-center/routing/introduction.md) | **Event Name** | **Event Type** | **Event Kind** | | ---------------------------------------- | --------------------------------------------------------- | -------------- | | notification-center-global-router.create | CREATE\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_GLOBAL\_ROUTER | Create | | notification-center-global-router.delete | DELETE\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_GLOBAL\_ROUTER | Delete | | notification-center-global-router.get | GET\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_GLOBAL\_ROUTER | Get | | notification-center-global-router.list | LIST\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_GLOBAL\_ROUTER | List | | notification-center-global-router.update | UPDATE\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_GLOBAL\_ROUTER | Update | [Notification Center Team Settings](https://coralogix.com/docs/user-guides/notification-center/introduction.md) | **Event Name** | **Event Type** | **Event Kind** | | ---------------------------------------- | --------------------------------------------------------- | -------------- | | notification-center-team-settings.update | UPDATE\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_TEAM\_SETTINGS | Update | | notification-center-team-settings.create | CREATE\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_TEAM\_SETTINGS | Create | | notification-center-team-settings.delete | DELETE\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_TEAM\_SETTINGS | Delete | | notification-center-team-settings.get | GET\_EVENT\_TYPE\_NOTIFICATION\_CENTER\_TEAM\_SETTINGS | Get | [OAuth Clients](https://coralogix.com/docs/user-guides/account-management/user-management/oauth-clients.md) | **Event Name** | **Event Type** | **Event Kind** | | ----------------------------------------------- | ----------------------------------------------------------- | -------------- | | oauth2-client.update | UPDATE\_EVENT\_TYPE\_OAUTH2\_CLIENT | Update | | oauth2-client.access-policy.update | UPDATE\_EVENT\_TYPE\_OAUTH2\_CLIENT\_ACCESS\_POLICY | Update | | oauth2-client.create | CREATE\_EVENT\_TYPE\_OAUTH2\_CLIENT | Create | | oauth2-client.access-policy.create | CREATE\_EVENT\_TYPE\_OAUTH2\_CLIENT\_ACCESS\_POLICY | Create | | oauth2-client.delete | DELETE\_EVENT\_TYPE\_OAUTH2\_CLIENT | Delete | | oauth2-client.access-policy.delete | DELETE\_EVENT\_TYPE\_OAUTH2\_CLIENT\_ACCESS\_POLICY | Delete | | oauth2-client.get | GET\_EVENT\_TYPE\_OAUTH2\_CLIENT | Get | | oauth2-client.access-policy.get | GET\_EVENT\_TYPE\_OAUTH2\_CLIENT\_ACCESS\_POLICY | Get | | oauth2-client.list | LIST\_EVENT\_TYPE\_OAUTH2\_CLIENT | List | | oauth2-client.access-policy.list | LIST\_EVENT\_TYPE\_OAUTH2\_CLIENT\_ACCESS\_POLICY | List | | oauth2-client.login-denied | ACTION\_EVENT\_TYPE\_OAUTH2\_CLIENT\_LOGIN\_DENIED | Action | | oauth2-client.delegated-access.started | ACTION\_EVENT\_TYPE\_DELEGATED\_ACCESS\_STARTED | Action | | oauth2-client.delegated-access.teams-discovered | ACTION\_EVENT\_TYPE\_DELEGATED\_ACCESS\_TEAMS\_DISCOVERED | Action | | oauth2-token.exchange | ACTION\_EVENT\_TYPE\_TOKEN\_EXCHANGE | Action | | oauth2-client.token-scope-narrowed | ACTION\_EVENT\_TYPE\_OAUTH2\_CLIENT\_TOKEN\_SCOPE\_NARROWED | Action | | oauth2-client.cimd-acceptance.list | LIST\_EVENT\_TYPE\_OAUTH2\_CLIENT\_CIMD\_ACCEPTANCE | List | | oauth2-client.cimd-acceptance.update | UPDATE\_EVENT\_TYPE\_OAUTH2\_CLIENT\_CIMD\_ACCEPTANCE | Update | **Embedded mode** | **Event Name** | **Event Type** | **Event Kind** | | ----------------------------- | --------------------------------------------- | -------------- | | embedded-config.update | UPDATE\_EVENT\_TYPE\_EMBEDDED\_CONFIG | Update | | embedded-config.secret.update | UPDATE\_EVENT\_TYPE\_EMBEDDED\_CONFIG\_SECRET | Update | | embedded-config.create | CREATE\_EVENT\_TYPE\_EMBEDDED\_CONFIG | Create | | embedded-config.delete | DELETE\_EVENT\_TYPE\_EMBEDDED\_CONFIG | Delete | | embedded-config.get | GET\_EVENT\_TYPE\_EMBEDDED\_CONFIG | Get | | embedded-config.list | LIST\_EVENT\_TYPE\_EMBEDDED\_CONFIG | List | [Olly Analysis Settings](https://coralogix.com/docs/user-guides/olly.md) | **Event Name** | **Event Type** | **Event Kind** | | ------------------------------------------ | -------------------------------------------------------------------- | -------------- | | olly-analysis-settings.update | UPDATE\_EVENT\_TYPE\_OLLY\_ANALYSIS\_SETTINGS | Update | | olly-analysis-settings.create | CREATE\_EVENT\_TYPE\_OLLY\_ANALYSIS\_SETTINGS | Create | | olly-analysis-settings.delete | DELETE\_EVENT\_TYPE\_OLLY\_ANALYSIS\_SETTINGS | Delete | | olly-analysis-settings.get | GET\_EVENT\_TYPE\_OLLY\_ANALYSIS\_SETTINGS | Get | | olly-analysis-settings.get-active | ACTION\_EVENT\_TYPE\_OLLY\_ANALYSIS\_SETTINGS\_GET\_ACTIVE | Action | | olly-analysis-settings.get-system-defaults | ACTION\_EVENT\_TYPE\_OLLY\_ANALYSIS\_SETTINGS\_GET\_SYSTEM\_DEFAULTS | Action | [Organization](https://coralogix.com/docs/user-guides/account-management/organization-management/create-an-organization.md) | **Event Name** | **Event Type** | **Event Kind** | | -------------------------------- | -------------------------------------------------------- | -------------- | | organization.add-domain | ACTION\_EVENT\_TYPE\_ADD\_DOMAIN | Action | | organization.get | GET\_EVENT\_TYPE\_ORGANIZATION | Get | | organization.list | LIST\_EVENT\_TYPE\_ORGANIZATION | List | | organization.move-quota | ACTION\_EVENT\_TYPE\_MOVE\_QUOTA | Action | | organization.settings.get | GET\_EVENT\_TYPE\_ORGANIZATION\_SETTINGS | Get | | organization.settings.update | UPDATE\_EVENT\_TYPE\_ORGANIZATION\_SETTINGS | Update | | organization.update | UPDATE\_EVENT\_TYPE\_ORGANIZATION | Update | | organization.add-user-to-team | ACTION\_EVENT\_TYPE\_ADD\_USER\_TO\_ORG\_TEAM | Action | | organization.create.team | CREATE\_EVENT\_TYPE\_TEAM\_IN\_ORGANIZATION | Create | | organization.domains.get | GET\_EVENT\_TYPE\_ORGANIZATION\_DOMAINS | Get | | organization.remove-domain | ACTION\_EVENT\_TYPE\_REMOVE\_DOMAIN | Action | | organization.users.get | GET\_EVENT\_TYPE\_ORGANIZATION\_USERS | Get | | organization.verify-email-domain | ACTION\_EVENT\_TYPE\_ORGANIZATION\_VERIFY\_EMAIL\_DOMAIN | Action | Organization Groups | **Event Name** | **Event Type** | **Event Kind** | | -------------- | ----------------------------- | -------------- | | org-group.get | GET\_EVENT\_TYPE\_ORG\_GROUP | Get | | org-group.list | LIST\_EVENT\_TYPE\_ORG\_GROUP | List | [Webhooks](https://coralogix.com/docs/user-guides/alerting/outbound-webhooks/generic-outbound-webhooks-alert-webhooks.md) | **Event Name** | **Event Type** | **Event Kind** | | --------------------------- | -------------------------------------------- | -------------- | | outbound-webhook-types.list | LIST\_EVENT\_TYPE\_OUTBOUND\_WEBHOOK\_TYPES | List | | outbound-webhooks.test | ACTION\_EVENT\_TYPE\_OUTBOUND\_WEBHOOK\_TEST | Action | | outbound-webhooks.list | LIST\_EVENT\_TYPE\_OUTBOUND\_WEBHOOK | List | | outbound-webhooks.get | GET\_EVENT\_TYPE\_OUTBOUND\_WEBHOOK | Get | | outbound-webhooks.delete | DELETE\_EVENT\_TYPE\_OUTBOUND\_WEBHOOK | Delete | | outbound-webhooks.create | CREATE\_EVENT\_TYPE\_OUTBOUND\_WEBHOOK | Create | | outbound-webhooks.update | UPDATE\_EVENT\_TYPE\_OUTBOUND\_WEBHOOK | Update | Permission | **Event Name** | **Event Type** | **Event Kind** | | --------------- | ----------------------------- | -------------- | | permission.list | LIST\_EVENT\_TYPE\_PERMISSION | List | [Product Analytics](https://coralogix.com/docs/user-guides/product-analytics/overview.md) | **Event Name** | **Event Type** | **Event Kind** | | -------------------------------------- | --------------------------------------------------------------- | -------------- | | product-analytics.funnel.query | ACTION\_EVENT\_TYPE\_PRODUCT\_ANALYTICS\_FUNNEL\_QUERY | Action | | product-analytics.matching-users.query | ACTION\_EVENT\_TYPE\_PRODUCT\_ANALYTICS\_MATCHING\_USERS\_QUERY | Action | | product-analytics.pathways.query | ACTION\_EVENT\_TYPE\_PRODUCT\_ANALYTICS\_PATHWAYS\_QUERY | Action | | product-analytics.views.query | ACTION\_EVENT\_TYPE\_PRODUCT\_ANALYTICS\_VIEWS\_QUERY | Action | | product-analytics.actions.query | ACTION\_EVENT\_TYPE\_PRODUCT\_ANALYTICS\_ACTIONS\_QUERY | Action | | product-analytics.clicks.query | ACTION\_EVENT\_TYPE\_PRODUCT\_ANALYTICS\_CLICKS\_QUERY | Action | | product-analytics.scroll-map.query | ACTION\_EVENT\_TYPE\_PRODUCT\_ANALYTICS\_SCROLL\_MAP\_QUERY | Action | | product-analytics.funnel.store | ACTION\_EVENT\_TYPE\_PRODUCT\_ANALYTICS\_FUNNEL\_STORE | Action | | product-analytics.funnel.update | ACTION\_EVENT\_TYPE\_PRODUCT\_ANALYTICS\_FUNNEL\_UPDATE | Action | | product-analytics.funnel.delete | ACTION\_EVENT\_TYPE\_PRODUCT\_ANALYTICS\_FUNNEL\_DELETE | Action | | product-analytics.heatmap.store | ACTION\_EVENT\_TYPE\_PRODUCT\_ANALYTICS\_HEATMAP\_STORE | Action | | product-analytics.heatmap.update | ACTION\_EVENT\_TYPE\_PRODUCT\_ANALYTICS\_HEATMAP\_UPDATE | Action | | product-analytics.heatmap.delete | ACTION\_EVENT\_TYPE\_PRODUCT\_ANALYTICS\_HEATMAP\_DELETE | Action | | product-analytics.pathway.store | ACTION\_EVENT\_TYPE\_PRODUCT\_ANALYTICS\_PATHWAY\_STORE | Action | | product-analytics.pathway.update | ACTION\_EVENT\_TYPE\_PRODUCT\_ANALYTICS\_PATHWAY\_UPDATE | Action | | product-analytics.pathway.delete | ACTION\_EVENT\_TYPE\_PRODUCT\_ANALYTICS\_PATHWAY\_DELETE | Action | | product-analytics.set-enabled | ACTION\_EVENT\_TYPE\_PRODUCT\_ANALYTICS\_SET\_ENABLED | Action | Rate Limiter | **Event Name** | **Event Type** | **Event Kind** | | -------------------- | ---------------------------------- | -------------- | | rate-limiter.limited | ACTION\_EVENT\_TYPE\_RATE\_LIMITED | Action | [Recording Rules](https://coralogix.com/docs/user-guides/data-transformation/metric-rules/recording-rules.md) | **Event Name** | **Event Type** | **Event Kind** | | ------------------------------- | ------------------------------------------------ | -------------- | | recording-rule.delete | DELETE\_EVENT\_TYPE\_RECORDING\_RULE | Delete | | recording-rule.create | CREATE\_EVENT\_TYPE\_RECORDING\_RULE | Create | | recording-rule.update | UPDATE\_EVENT\_TYPE\_RECORDING\_RULE | Update | | recording-rule-group.delete | DELETE\_EVENT\_TYPE\_RECORDING\_RULE\_GROUP | Delete | | recording-rule-group.create | CREATE\_EVENT\_TYPE\_RECORDING\_RULE\_GROUP | Create | | recording-rule-group.update | UPDATE\_EVENT\_TYPE\_RECORDING\_RULE\_GROUP | Update | | recording-rule-group-set.delete | DELETE\_EVENT\_TYPE\_RECORDING\_RULE\_GROUP\_SET | Delete | | recording-rule-group-set.create | CREATE\_EVENT\_TYPE\_RECORDING\_RULE\_GROUP\_SET | Create | | recording-rule-group-set.update | UPDATE\_EVENT\_TYPE\_RECORDING\_RULE\_GROUP\_SET | Update | Reserved Schema | **Event Name** | **Event Type** | **Event Kind** | | ------------------------- | ------------------------------------------------- | -------------- | | reserved-schema.update | UPDATE\_EVENT\_TYPE\_RESERVED\_SCHEMA | Update | | reserved-schema.create | CREATE\_EVENT\_TYPE\_RESERVED\_SCHEMA | Create | | reserved-schema.delete | DELETE\_EVENT\_TYPE\_RESERVED\_SCHEMA | Delete | | reserved-schema.get | GET\_EVENT\_TYPE\_RESERVED\_SCHEMA | Get | | audit.reserved-schema.get | ACTION\_EVENT\_GET\_EVENT\_TYPE\_RESERVED\_SCHEMA | Action | [Roles](https://coralogix.com/docs/user-guides/aaa/access-control/permissions.md) | **Event Name** | **Event Type** | **Event Kind** | | -------------- | ------------------------- | -------------- | | role.list | LIST\_EVENT\_TYPE\_ROLE | List | | role.get | GET\_EVENT\_TYPE\_ROLE | Get | | role.delete | DELETE\_EVENT\_TYPE\_ROLE | Delete | | role.create | CREATE\_EVENT\_TYPE\_ROLE | Create | | role.update | UPDATE\_EVENT\_TYPE\_ROLE | Update | [RUM](https://coralogix.com/docs/user-guides/rum/getting-started/real-user-monitoring.md) **[RUM settings](https://coralogix.com/docs/user-guides/rum/getting-started/real-user-monitoring.md)** | **Event Name** | **Event Type** | **Event Kind** | | ------------------- | ---------------------------------- | -------------- | | rum-settings.get | GET\_EVENT\_TYPE\_RUM\_SETTINGS | Get | | rum-settings.update | UPDATE\_EVENT\_TYPE\_RUM\_SETTINGS | Update | | | | | **SDK versions** | **Event Name** | **Event Type** | **Event Kind** | | --------------- | ------------------------------ | -------------- | | sdk-version.get | GET\_EVENT\_TYPE\_SDK\_VERSION | Get | **[Session Recording](https://coralogix.com/docs/user-guides/rum/product-features/session-replay.md)** | **Event Name** | **Event Type** | **Event Kind** | | --------------------- | ------------------------------------ | -------------- | | session-recording.get | GET\_EVENT\_TYPE\_SESSION\_RECORDING | Get | **[Source Map](https://coralogix.com/docs/user-guides/rum/cli/rum-cli.md)** | **Event Name** | **Event Type** | **Event Kind** | | -------------- | ----------------------------- | -------------- | | source-map.get | GET\_EVENT\_TYPE\_SOURCE\_MAP | Get | **[Hide Errors](https://coralogix.com/docs/user-guides/rum/product-features/error-template-view.md)** | **Event Name** | **Event Type** | **Event Kind** | | ------------------ | --------------------------------- | -------------- | | hide-errors.list | LIST\_EVENT\_TYPE\_HIDE\_ERRORS | List | | hide-errors.get | GET\_EVENT\_TYPE\_HIDE\_ERRORS | Get | | hide-errors.delete | DELETE\_EVENT\_TYPE\_HIDE\_ERRORS | Delete | | hide-errors.create | CREATE\_EVENT\_TYPE\_HIDE\_ERRORS | Create | | hide-errors.update | UPDATE\_EVENT\_TYPE\_HIDE\_ERRORS | Update | **[Saved Filters](https://coralogix.com/docs/user-guides/data_exploration/fields.md)** | **Event Name** | **Event Type** | **Event Kind** | | ------------------- | ---------------------------------- | -------------- | | saved-filter.list | LIST\_EVENT\_TYPE\_SAVED\_FILTER | List | | saved-filter.get | GET\_EVENT\_TYPE\_SAVED\_FILTER | Get | | saved-filter.delete | DELETE\_EVENT\_TYPE\_SAVED\_FILTER | Delete | | saved-filter.create | CREATE\_EVENT\_TYPE\_SAVED\_FILTER | Create | | saved-filter.update | UPDATE\_EVENT\_TYPE\_SAVED\_FILTER | Update | **RUM TCO** | **Event Name** | **Event Type** | **Event Kind** | | -------------- | ------------------------------------ | -------------- | | rum.tco.update | UPDATE\_EVENT\_TYPE\_RUM\_TCO | Update | | rum.tco.create | CREATE\_EVENT\_TYPE\_RUM\_TCO | Create | | rum.tco.delete | DELETE\_EVENT\_TYPE\_RUM\_TCO | Delete | | rum.tco.get | GET\_EVENT\_TYPE\_RUM\_TCO | Get | | rum.tco.list | LIST\_EVENT\_TYPE\_RUM\_TCO | List | | rum.tco.order | ACTION\_EVENT\_TYPE\_RUM\_TCO\_ORDER | Action | [SAML](https://coralogix.com/docs/user-guides/account-management/user-management/sso-with-saml.md) | **Event Name** | **Event Type** | **Event Kind** | | ------------------------------------- | -------------------------------------------------------- | -------------- | | saml.user.email-verification-required | ACTION\_EVENT\_TYPE\_SAML\_EMAIL\_VERIFICATION\_REQUIRED | Action | | saml.user.reactivated | ACTION\_EVENT\_TYPE\_SAML\_USER\_REACTIVATED | Action | | saml.user.sso-verification-required | ACTION\_EVENT\_TYPE\_SAML\_SSO\_VERIFICATION\_REQUIRED | Action | Saved Views These events cover saved views across every product area that offers them, including [Infrastructure Explorer](https://coralogix.com/docs/user-guides/infrastructure/infrastructure-explorer/saved-views.md), [Explore](https://coralogix.com/docs/user-guides/monitoring-and-insights/explore-screen/create-and-manage-saved-views.md), [Cases](https://coralogix.com/docs/user-guides/cases/saved-views.md), [Alerts](https://coralogix.com/docs/user-guides/alerting/saved-views.md), and [RUM](https://coralogix.com/docs/user-guides/rum/product-features/rum-saved-views.md). | **Event Name** | **Event Type** | **Event Kind** | | -------------- | ------------------------- | -------------- | | view\.list | LIST\_EVENT\_TYPE\_VIEW | List | | view\.get | GET\_EVENT\_TYPE\_VIEW | Get | | view\.delete | DELETE\_EVENT\_TYPE\_VIEW | Delete | | view\.create | CREATE\_EVENT\_TYPE\_VIEW | Create | | view\.update | UPDATE\_EVENT\_TYPE\_VIEW | Update | **View Folder** Folders are available in Explore, Alerts, and APM. Product areas without folders, such as Infrastructure Explorer, Cases, and RUM, do not emit these events. | **Event Name** | **Event Type** | **Event Kind** | | ------------------ | --------------------------------- | -------------- | | view-folder.list | LIST\_EVENT\_TYPE\_VIEW\_FOLDER | List | | view-folder.get | GET\_EVENT\_TYPE\_VIEW\_FOLDER | Get | | view-folder.delete | DELETE\_EVENT\_TYPE\_VIEW\_FOLDER | Delete | | view-folder.create | CREATE\_EVENT\_TYPE\_VIEW\_FOLDER | Create | | view-folder.update | UPDATE\_EVENT\_TYPE\_VIEW\_FOLDER | Update | [SCIM](https://coralogix.com/docs/user-guides/account-management/user-management/scim.md) | **Event Name** | **Event Type** | **Event Kind** | | ------------------ | ----------------------------------------- | -------------- | | scim.user.delete | ACTION\_EVENT\_TYPE\_SCIM\_DELETE\_USER | Action | | scim.group.replace | ACTION\_EVENT\_TYPE\_SCIM\_REPLACE\_GROUP | Action | | scim.user.create | ACTION\_EVENT\_TYPE\_SCIM\_CREATE\_USER | Action | | scim.user.replace | ACTION\_EVENT\_TYPE\_SCIM\_REPLACE\_USER | Action | | scim.user.update | ACTION\_EVENT\_TYPE\_SCIM\_UPDATE\_USER | Action | | scim.group.delete | ACTION\_EVENT\_TYPE\_SCIM\_DELETE\_GROUP | Action | | scim.group.update | ACTION\_EVENT\_TYPE\_SCIM\_UPDATE\_GROUP | Action | | scim.group.create | ACTION\_EVENT\_TYPE\_SCIM\_CREATE\_GROUP | Action | | scim.user.list | LIST\_EVENT\_SCIM\_USER | List | | scim.group.list | LIST\_EVENT\_SCIM\_GROUP | List | | scim.schema.list | LIST\_EVENT\_SCIM\_SCHEMA | List | | scim.schema.get | GET\_EVENT\_SCIM\_SCHEMA | Get | | scim.user.get | GET\_EVENT\_SCIM\_USER | Get | | scim.group.get | GET\_EVENT\_SCIM\_GROUP | Get | [Scopes](https://coralogix.com/docs/user-guides/account-management/user-management/scopes.md) | **Event Name** | **Event Type** | **Event Kind** | | -------------- | ---------------------------------- | -------------- | | scopes.list | LIST\_EVENT\_TYPE\_SCOPE\_LIST | List | | scopes.get | GET\_EVENT\_TYPE\_SCOPE\_GET | Get | | scopes.delete | DELETE\_EVENT\_TYPE\_SCOPE\_DELETE | Delete | | scopes.create | CREATE\_EVENT\_TYPE\_SCOPE\_CREATE | Create | | scopes.update | UPDATE\_EVENT\_TYPE\_SCOPE\_UPDATE | Update | [Security Enrichments](https://coralogix.com/docs/user-guides/enrichment_rules/unified_threat_intelligence.md) | **Event Name** | **Event Type** | **Event Kind** | | -------------------------- | ----------------------------------------- | -------------- | | security-enrichment.delete | DELETE\_EVENT\_TYPE\_SECURITY\_ENRICHMENT | Delete | | security-enrichment.create | CREATE\_EVENT\_TYPE\_SECURITY\_ENRICHMENT | Create | | security-enrichment.update | UPDATE\_EVENT\_TYPE\_SECURITY\_ENRICHMENT | Update | [Spans and Traces Exploration](https://coralogix.com/docs/user-guides/data_exploration/spans.md) | **Event Name** | **Event Type** | **Event Kind** | | ----------------------------- | -------------------------------------------------------- | -------------- | | service-map.get | ACTION\_EVENT\_TYPE\_SERVICE\_MAP\_GET | Action | | spans.count.get | ACTION\_EVENT\_TYPE\_SPANS\_COUNT | Action | | spans.filters.get | ACTION\_EVENT\_TYPE\_SPANS\_FILTERS | Action | | spans.graphs.get | ACTION\_EVENT\_TYPE\_SPANS\_GRAPHS | Action | | spans.lists.highlights | ACTION\_EVENT\_TYPE\_HIGHLIGHTS\_LIST\_SPANS\_HIGHLIGHTS | Action | | spans.search | ACTION\_EVENT\_TYPE\_SPANS\_SEARCH | Action | | traces.count.get | ACTION\_EVENT\_TYPE\_TRACES\_COUNT\_GET | Action | | traces.get | ACTION\_EVENT\_TYPE\_TRACES\_GET\_TRACE | Action | | traces.latency-percentile.get | ACTION\_EVENT\_TYPE\_TRACES\_LATENCY\_PERCENTILE\_GET | Action | | traces.search | ACTION\_EVENT\_TYPE\_TRACES\_SEARCH | Action | [Spans TCO](https://coralogix.com/docs/user-guides/account-management/tco-optimizer.md) | **Event Name** | **Event Type** | **Event Kind** | | ---------------- | -------------------------------------- | -------------- | | spans.tco.order | ACTION\_EVENT\_TYPE\_SPANS\_TCO\_ORDER | Action | | spans.tco.list | LIST\_EVENT\_TYPE\_SPANS\_TCO | List | | spans.tco.get | GET\_EVENT\_TYPE\_SPANS\_TCO | Get | | spans.tco.delete | DELETE\_EVENT\_TYPE\_SPANS\_TCO | Delete | | spans.tco.create | CREATE\_EVENT\_TYPE\_SPANS\_TCO | Create | | spans.tco.update | UPDATE\_EVENT\_TYPE\_SPANS\_TCO | Update | [Slack Notifications](https://coralogix.com/docs/user-guides/notification-center/destination-types/slack.md) | **Event Name** | **Event Type** | **Event Kind** | | ------------------------- | ---------------------------------------- | -------------- | | slack-notification.update | UPDATE\_EVENT\_TYPE\_SLACK\_NOTIFICATION | Update | | slack-notification.list | LIST\_EVENT\_TYPE\_SLACK\_NOTIFICATION | List | Split Index | **Event Name** | **Event Type** | **Event Kind** | | ------------------ | ------------------------------------- | -------------- | | split-index.create | CREATE\_EVENT\_TYPE\_SPLIT\_INDEX | Create | | split-index.get | GET\_EVENT\_TYPE\_SPLIT\_INDEX\_COUNT | Get | [SLOs](https://coralogix.com/docs/user-guides/slos/introduction.md) | **Event Name** | **Event Type** | **Event Kind** | | -------------- | -------------------------------- | -------------- | | slo.list | LIST\_EVENT\_TYPE\_SLO | List | | slo.batch.get | GET\_EVENT\_TYPE\_SLO\_BATCH | Get | | slo.create | CREATE\_EVENT\_TYPE\_SLO\_CREATE | Create | | slo.delete | DELETE\_EVENT\_TYPE\_SLO | Delete | | slo.update | UPDATE\_EVENT\_TYPE\_SLO | Update | [SSO](https://coralogix.com/docs/user-guides/account-management/user-management/sso-with-saml.md) | **Event Name** | **Event Type** | **Event Kind** | | -------------------------- | ---------------------------------------------- | -------------- | | sso.set-idp-parameters | ACTION\_EVENT\_TYPE\_SSO\_SET\_IDP\_PARAMETERS | Action | | sso.set-active | ACTION\_EVENT\_TYPE\_SSO\_SET\_ACTIVE | Action | | sso.configuration.get | GET\_EVENT\_SSO\_CONFIGURATION | Get | | sso.sp-parameters.get | GET\_EVENT\_SSO\_SP\_PARAMETERS | Get | | sso.config.update | UPDATE\_EVENT\_TYPE\_SAML\_CONFIG | Update | | sso.metadata.update | UPDATE\_EVENT\_TYPE\_SAML\_METADATA | Update | | sso.claimable-domains.list | LIST\_EVENT\_TYPE\_SAML\_CLAIMABLE\_DOMAINS | List | | sso.config-details.get | GET\_EVENT\_TYPE\_SAML\_CONFIG\_DETAILS | Get | | sso.config.create | CREATE\_EVENT\_TYPE\_SAML\_CONFIG | Create | | sso.config.delete | DELETE\_EVENT\_TYPE\_SAML\_CONFIG | Delete | | sso.config.get | GET\_EVENT\_TYPE\_SAML\_CONFIG | Get | | sso.config.list | LIST\_EVENT\_TYPE\_SAML\_CONFIGS | List | | sso.login-events.get | GET\_EVENT\_TYPE\_SAML\_LOGIN\_EVENTS | Get | Streams | **Event Name** | **Event Type** | **Event Kind** | | -------------- | ---------------------------------- | -------------- | | streams.update | UPDATE\_EVENT\_TYPE\_STREAMS | Update | | streams.create | CREATE\_EVENT\_TYPE\_STREAMS | Create | | streams.delete | DELETE\_EVENT\_TYPE\_STREAMS | Delete | | streams.get | GET\_EVENT\_TYPE\_STREAMS | Get | | streams.list | LIST\_EVENT\_TYPE\_STREAMS | List | | streams.test | ACTION\_EVENT\_TYPE\_STREAMS\_TEST | Action | [Team IP Access](https://coralogix.com/docs/user-guides/account-management/user-management/login-access-policy.md) | **Event Name** | **Event Type** | **Event Kind** | | ----------------------- | --------------------------------------------- | -------------- | | team-ip-access.list | LIST\_EVENT\_TYPE\_IP\_FILTER | List | | team-ip-access.delete | DELETE\_EVENT\_TYPE\_IP\_FILTER | Delete | | team-ip-access.create | CREATE\_EVENT\_TYPE\_IP\_FILTER | Create | | team-ip-access.update | UPDATE\_EVENT\_TYPE\_IP\_FILTER | Update | | team-ip-access.blocked | ACTION\_EVENT\_TYPE\_IP\_RESTRICTION\_BLOCKED | Action | | team-ip-access.validate | ACTION\_EVENT\_TYPE\_VALIDATE\_IP\_ACCESS | Action | Team Management | **Event Name** | **Event Type** | **Event Kind** | | ------------------------------------ | ----------------------------------------------------------- | -------------- | | team-landing-page.update | UPDATE\_EVENT\_TYPE\_TEAM\_LANDING\_PAGE | Update | | team-member.remove | ACTION\_EVENT\_TYPE\_TEAM\_MEMBER\_REMOVE | Action | | team-member.unlock | ACTION\_EVENT\_TYPE\_TEAM\_MEMBER\_UNLOCK | Action | | team-member.add | ACTION\_EVENT\_TYPE\_TEAM\_MEMBER\_ADD | Action | | team-member.invite | ACTION\_EVENT\_TYPE\_TEAM\_MEMBER\_INVITE | Action | | team-member.list | LIST\_EVENT\_TEAM\_MEMBER | List | | team-sessions.session-timeout.update | UPDATE\_EVENT\_TYPE\_TEAM\_SESSIONS\_SESSION\_TIMEOUT | Update | | team-sessions.force-logout.update | UPDATE\_EVENT\_TYPE\_TEAM\_SESSIONS\_FORCE\_LOGOUT | Update | | team-url.update | UPDATE\_EVENT\_TYPE\_TEAM\_URL | Update | | team-member.create | CREATE\_EVENT\_TYPE\_TEAM\_MEMBER\_CREATE | Create | | team-member-invite.list | LIST\_EVENT\_TYPE\_TEAM\_MEMBER\_INVITE | List | | team-member.delete | DELETE\_EVENT\_TYPE\_TEAM\_MEMBER | Delete | | team-member.expire-temp-user | ACTION\_EVENT\_TYPE\_TEAM\_MEMBER\_EXPIRE\_TEMP\_USER | Action | | team-member.invite-temp-user | ACTION\_EVENT\_TYPE\_TEAM\_MEMBER\_INVITE\_TEMP\_USER | Action | | team-member.mfa.change-enforcement | ACTION\_EVENT\_TYPE\_TEAM\_MEMBER\_MFA\_CHANGE\_ENFORCEMENT | Action | | team-member.reset-password | ACTION\_EVENT\_RESET\_PASSORD | Action | | team-member.update | UPDATE\_EVENT\_TYPE\_TEAM\_MEMBER\_UPDATE | Update | | team-member.update-active-status | UPDATE\_EVENT\_TYPE\_TEAM\_MEMBER\_UPDATE\_ACTIVE\_STATUS | Update | | team-member-invite.delete | DELETE\_EVENT\_TYPE\_TEAM\_MEMBER\_INVITE | Delete | `team-member.add` is deprecated; use `team-member.create` instead. **Team** | **Event Name** | **Event Type** | **Event Kind** | | --------------------------- | --------------------------------------------------- | -------------- | | team.update | UPDATE\_EVENT\_TYPE\_UPDATE\_TEAM | Update | | team.create | CREATE\_EVENT\_TYPE\_TEAM | Create | | team.delete | DELETE\_EVENT\_TYPE\_TEAM | Delete | | team.get-quota | GET\_EVENT\_TYPE\_TEAM\_GET\_QUOTA | Get | | team.get | GET\_EVENT\_TYPE\_TEAM | Get | | team.list | LIST\_EVENT\_TYPE\_TEAM | List | | team.move-quota | ACTION\_EVENT\_TYPE\_TEAM\_MOVE\_QUOTA | Action | | team.mfa.change-enforcement | ACTION\_EVENT\_TYPE\_TEAM\_MFA\_CHANGE\_ENFORCEMENT | Action | | team.set-daily-quota | ACTION\_EVENT\_TYPE\_TEAM\_SET\_DAILY\_QUOTA | Action | **Team Settings** | **Event Name** | **Event Type** | **Event Kind** | | ------------------------------------ | ------------------------------------------------------- | -------------- | | team-allowed-domains.update | UPDATE\_EVENT\_TYPE\_TEAM\_ALLOWED\_DOMAINS | Update | | team-allowed-domains.create | CREATE\_EVENT\_TYPE\_TEAM\_ALLOWED\_DOMAIN | Create | | team-allowed-domains.delete | DELETE\_EVENT\_TYPE\_TEAM\_ALLOWED\_DOMAIN | Delete | | team-allowed-domains.list | LIST\_EVENT\_TYPE\_TEAM\_ALLOWED\_DOMAINS | List | | team-allowed-domains.csv-upload | ACTION\_EVENT\_TYPE\_TEAM\_ALLOWED\_DOMAIN\_CSV\_UPLOAD | Action | | team-invitation-expiry-policy.update | UPDATE\_EVENT\_TYPE\_TEAM\_INVITATION\_EXPIRY\_POLICY | Update | | team-mfa-enforcement.update | UPDATE\_EVENT\_TYPE\_TEAM\_MFA\_ENFORCEMENT | Update | | team-sorting.update | UPDATE\_EVENT\_TYPE\_TEAM\_DEFAULT\_SORTING | Update | | team-sso-enforcement.update | UPDATE\_EVENT\_TYPE\_TEAM\_SSO\_ENFORCEMENT | Update | **Team Payments** | **Event Name** | **Event Type** | **Event Kind** | | ------------------------- | ------------------------------------------- | -------------- | | team-payments.update | UPDATE\_EVENT\_TYPE\_TEAM\_PAYMENTS | Update | | team-payments.create | CREATE\_EVENT\_TYPE\_TEAM\_PAYMENTS | Create | | team-payments.delete | DELETE\_EVENT\_TYPE\_TEAM\_PAYMENTS | Delete | | team-payments.get | GET\_EVENT\_TYPE\_TEAM\_PAYMENTS | Get | | team-pay-as-you-go.create | CREATE\_EVENT\_TYPE\_TEAM\_PAY\_AS\_YOU\_GO | Create | | team-pay-as-you-go.delete | DELETE\_EVENT\_TYPE\_TEAM\_PAY\_AS\_YOU\_GO | Delete | | team-pay-as-you-go.get | GET\_EVENT\_TYPE\_TEAM\_PAY\_AS\_YOU\_GO | Get | | team-plan.get | GET\_EVENT\_TYPE\_TEAM\_PLAN | Get | Templates | **Event Name** | **Event Type** | **Event Kind** | | -------------------- | ------------------------------------------------- | -------------- | | templates.list.read | ACTION\_EVENT\_TYPE\_TEMPLATES\_READ\_DATA | Action | | templates.count.read | ACTION\_EVENT\_TYPE\_TEMPLATES\_COUNT\_READ\_DATA | Action | | templates-dates.get | GET\_EVENT\_TYPE\_TEMPLATES\_DATES | Get | User Account | **Event Name** | **Event Type** | **Event Kind** | | ---------------------------------------- | ------------------------------------------------------------------ | -------------- | | user-account.login | ACTION\_EVENT\_TYPE\_USER\_ACCOUNT\_LOGIN | Action | | user-account.mfa-complete-enrolment | ACTION\_EVENT\_TYPE\_USER\_ACCOUNT\_MFA\_COMPLETE\_ENROLMENT | Action | | user-account.mfa-regenerate-backup-codes | ACTION\_EVENT\_TYPE\_USER\_ACCOUNT\_MFA\_REGENERATE\_BACKUP\_CODES | Action | | user-account.mfa-start-enrolment | ACTION\_EVENT\_TYPE\_USER\_ACCOUNT\_MFA\_START\_ENROLMENT | Action | | user-account.mfa-unenroll | ACTION\_EVENT\_TYPE\_USER\_ACCOUNT\_MFA\_UNENROLL | Action | | user-account.mfa-verification.lock | ACTION\_EVENT\_TYPE\_USER\_ACCOUNT\_MFA\_VERIFICATION\_LOCK | Action | | user-account.mfa-verification.verify | ACTION\_EVENT\_TYPE\_USER\_ACCOUNT\_MFA\_VERIFICATION\_VERIFY | Action | | user-account.password-change | ACTION\_EVENT\_TYPE\_USER\_ACCOUNT\_PASSWORD\_CHANGE | Action | User Management | **Event Name** | **Event Type** | **Event Kind** | | --------------------------------- | ------------------------------------------------- | -------------- | | user-landing-page.update | UPDATE\_EVENT\_TYPE\_USER\_LANDING\_PAGE | Update | | user-settings.get | GET\_EVENT\_TYPE\_USER\_SETTING | Get | | user-settings.update | UPDATE\_EVENT\_TYPE\_USER\_SETTING | Update | | users-login-methods.update | UPDATE\_EVENT\_TYPE\_USERS\_LOGIN\_METHODS | Update | | user.get | GET\_EVENT\_TYPE\_USER | Get | | user.list | LIST\_EVENT\_TYPE\_USER | List | | user-enterprise-attributes.update | UPDATE\_EVENT\_TYPE\_USER\_ENTERPRISE\_ATTRIBUTES | Update | | users-expiry.update | UPDATE\_EVENT\_TYPE\_USERS\_EXPIRY | Update | | users-login-methods.list | LIST\_EVENT\_TYPE\_USERS\_LOGIN\_METHODS | List | | users-mfa-enforcement.update | UPDATE\_EVENT\_TYPE\_USERS\_MFA\_ENFORCEMENT | Update | | users-statuses.update | UPDATE\_EVENT\_TYPE\_USERS\_STATUSES | Update | | landing-page.get | GET\_EVENT\_TYPE\_LANDING\_PAGE | Get | User Digest | **Event Name** | **Event Type** | **Event Kind** | | ------------------- | --------------------------- | -------------- | | user\_digest.update | UPDATE\_EVENT\_TYPE\_DIGEST | Update | | user\_digest.list | LIST\_EVENT\_TYPE\_DIGEST | List | [Version Benchmarks](https://coralogix.com/docs/user-guides/monitoring-and-insights/version-benchmarks.md) | **Event Name** | **Event Type** | **Event Kind** | | ------------------------- | ---------------------------------------- | -------------- | | version-benchmarks.list | LIST\_EVENT\_TYPE\_VERSION\_BENCHMARKS | List | | version-benchmarks.get | GET\_EVENT\_TYPE\_VERSION\_BENCHMARKS | Get | | version-benchmarks.delete | DELETE\_EVENT\_TYPE\_VERSION\_BENCHMARKS | Delete | | version-benchmarks.create | CREATE\_EVENT\_TYPE\_VERSION\_BENCHMARKS | Create | | version-benchmarks.update | UPDATE\_EVENT\_TYPE\_VERSION\_BENCHMARKS | Update | Webhook Integration | **Event Name** | **Event Type** | **Event Kind** | | -------------------------- | ----------------------------------------- | -------------- | | webhook-integration.update | UPDATE\_EVENT\_TYPE\_WEBHOOK\_INTEGRATION | Update | | webhook-integration.create | CREATE\_EVENT\_TYPE\_WEBHOOK\_INTEGRATION | Create | | webhook-integration.delete | DELETE\_EVENT\_TYPE\_WEBHOOK\_INTEGRATION | Delete | | webhook-integration.list | LIST\_EVENT\_TYPE\_WEBHOOK\_INTEGRATION | List | ## Monitoring audit events To monitor your audit events, take the following steps: 1. Sign in to the team designated as your audit team. 2. View audit events in [Explore](https://coralogix.com/docs/user-guides/data_exploration.md) or [Visual Explorer](https://coralogix.com/docs/user-guides/monitoring-and-insights/visual-explorer.md), or create visualizations in [Custom Dashboards](https://coralogix.com/docs/user-guides/custom-dashboards/introduction.md). ### Monitor & query audit events in Explore Your audit events will appear in the Logs screen in Explore. For any log, click on the left-hand ellipsis and select **Show graph for key** from the dropdown menu. [![auditv2\_explore.png](/docs/assets/images/auditv2_explore-de5a86c99146897e3b2b9a29e95fd12c.webp)](https://coralogix.com/docs/assets/images/auditv2_explore-de5a86c99146897e3b2b9a29e95fd12c.webp) This graph shows the breakdown of actions taken on the organization, team, and user levels for `actorType`. ### Create analytics in Custom Dashboards Create a visual in Custom Dashboards to view audit event analytics. [![auditv2\_analytics1.png](/docs/assets/images/auditv2_analytics1-c1163e6c3bd1c6eea514f38f467f68d6.webp)](https://coralogix.com/docs/assets/images/auditv2_analytics1-c1163e6c3bd1c6eea514f38f467f68d6.webp) In this example, the user has created a pie chart to understand the breakdown of events per Coralogix environment. Here you can see the user query failure errors per Coralogix event. [![auditv2\_analytics2.png](/docs/assets/images/auditv2_analytics2-9e650741148fa67b07dbed8f16a4aeb1.webp)](https://coralogix.com/docs/assets/images/auditv2_analytics2-9e650741148fa67b07dbed8f16a4aeb1.webp)