---
title: Aaa.audit_events
description: Query the `aaa.audit_events` system dataset to track who did what and when across Coralogix features, API usage, and errors.
url: https://coralogix.com/docs/user-guides/data-layer/system_dataspace/aaa_audit-events/
product: dataengine
feature: Dataset Management
feature_id: dataspace-dataset-mgmt
feature_identifier: dataengine/dataspace-dataset-mgmt
last_updated: '2026-11-02'
---

# `aaa.audit_events`

Note

The payload schema for `aaa.audit_events` is coming soon.

## Purpose

The **audit events** dataset captures a complete trail of actions across Coralogix features by combining a consistent envelope with an action-specific payload so teams can **prove who did what and when**, monitor API usage and errors, investigate security and compliance issues, and reconstruct resource changes over time.

## Schema description

Every event carries the standard log envelope: engine metadata in `$m`, labels in `$l`, and the action-specific payload in `$d`. The payload fields aren't published yet.

| Field                 | Type               | Required | Description                                                                                              |
| --------------------- | ------------------ | -------- | -------------------------------------------------------------------------------------------------------- |
| `$d`                  | object             | Yes      | Entity-type-specific payload — shape defined by each entity type's schema                                |
| `$l`                  | map                | Yes      | User labels: free-form string-to-string map                                                              |
| `$l.<key>`            | string             | No       |                                                                                                          |
| `$m`                  | object             | Yes      | Engine metadata                                                                                          |
| `$m.cxEventId`        | string (uuid)      | Yes      | Globally unique event id                                                                                 |
| `$m.ingressTimestamp` | string (date-time) | Yes      | Time the event was ingested                                                                              |
| `$m.priorityClass`    | string             | Yes      | Defines the feature-set enabled for the event<!-- --> <!-- -->One of: `high`, `medium`, `low`.           |
| `$m.severity`         | string             | Yes      | Event severity level<!-- --> <!-- -->One of: `Verbose`, `Debug`, `Info`, `Warning`, `Error`, `Critical`. |
| `$m.timestamp`        | string (date-time) | Yes      | Event timestamp                                                                                          |

## Next steps

Review alert evaluation and trigger metadata with [`alerts.history`](https://coralogix.com/docs/user-guides/data-layer/system_dataspace/alerts-history.md).