Skip to main content

Celonis Product Documentation

Audit logs - Event details

When viewing your audit logs, the following events are available:

Event Origin

Event Name

Explanation

Action Engine

EXPORT_PARQUET_DISCLAIMER_AGREEMENT_DELETED

The agreement to allow exporting data to parquet files has been withdrawn.

EXPORT_PARQUET_DISCLAIMER_AGREEMENT_SIGNED

The agreement to export data to parquet files has been given (required for Action Engine Connector).

ROUTING_RULE_CREATED

A new routing rule has been created.

ROUTING_RULE_DELETED

A routing rule has been deleted.

ROUTING_RULE_DUPLICATED

An existing routing rule has been duplicated.

ROUTING_RULE_UPDATED

An existing routing rule has been updated.

SKILL_CREATED

A new skill has been created.

SKILL_DELETED

A skill has been deleted.

SKILL_DUPLICATED

An existing skill has been duplicated.

SKILL_INSTALLED

A new skill has been installed.

SKILL_UPDATED

An existing skill has been updated.

Action Flows

ACTIONFLOW_ACTIVATED

Logged when an action flow is enabled/activated and contains:

  • Base message with extra properties.

  • Type - the type of the schedule, for example, indefinitely, once, or yearly.

  • Interval - the interval between executions, has a value assigned only when the type is indefinitely.

ACTIONFLOW_CREATED

Logged when an action flow is created, contains:

  • Base message.

  • Diff payload with newValue set.

ACTIONFLOW_DEACTIVATED

Logged when an action flow is disabled/deactivated and contains:

  • When deactivated manually (by a user), contains Base message.

  • When deactivated automatically (by the engine), contains base message with extra properties:

  • Reason - describing invalidation/deactivation reason.

  • Max_errors_count - describing the maximum amount of errors allowed.

ACTIONFLOW_DRAFT_BLUEPRINT_MODIFIED

Logged when an action flows’ draft configuration is modified, contains:

  • Base message.

  • Diff payload with oldValue and newValue set.

ACTIONFLOW_SCHEDULE_MODIFIED

Logged when an Action Flows’ schedule is modified, contains:

  • Base message with extra properties.

  • Type - the type of the schedule, for example, indefinitely, once, or yearly.

  • Interval - the interval between executions, has a value assigned only when the type is indefinitely.

Admin and Settings

ADMIN USER INVITED

An Admin gets invited from the backend into the team.

APPLICATION_KEY_CREATED

A user created a new application key.

APPLICATION_KEY_DELETED

A user deleted an application key.

APPLICATION_KEY_UPDATED

The application key was updated.

APPLICATION_PERMISSIONS_CSV_DOWNLOADED

A user downloaded the permissions CSV from Admin and Settings >Applications.

Note

A message is not included with the event.

AUDIT_LOG_CSV_DOWNLOADED

A user downloaded the Audit Log CSV.

AUDIT_LOGS_DELETED

Audit logs deletion feature was configured and the logs were deleted.

AUDIT_LOG_PREFERENCES_UPDATED

A user enabled or disabled the logging of IP address.

A user enabled or disabled Days to delete with qty of days stated.

GROUP_CREATED

A group was created.

GROUP_DELETED

A group was deleted.

GROUP_PERMISSIONS_CSV_DOWNLOADED

A user downloaded the permissions CSV from Admin and Settings >Groups.

Note

A message is not included with the event.

GROUP_UPDATED

A group was updated.

IP_RESTRICTIONS_RESET

IP restrictions were reset.

IP_RESTRICTIONS_SET

IP restrictions were set.

LOGIN_HISTORY_CSV_DOWNLOADED

A user downloaded the Login History CSV.

LOGIN_HISTORY_DELETED

Login history delete option was selected when turning off the login history.

LOGIN_HISTORY_PREFERENCES_UPDATED

A user-enabled or disabled Login History.

A user enabled or disabled Days to delete with qty of days stated.

MEMBER_LOCK_POLICY_UPDATED

Locking policy enabled and or updated.

Locking policy user notification enabled and or updated.

OPEN_SIGNUP_UPDATED

A user enabled or disabled Open Sign up and the default group name.

PERMISSIONS_CSV_DOWNLOADED

A user downloaded the permissions CSV from Admin and Settings >Permissions.

Note

A message is not included with the event.

PERMISSIONS_UPDATE

A user has updated Celonis Platform permissions. The message will show the subject description, the subject type, and the object description before explaining the new vs. old permission.

SSO_PROVIDER_CREATED

A user created the SSO provider.

SSO_PROVIDER_DELETED

A user deleted the SSO provider.

SSO_PROVIDER_TOGGLED

SSO provider changed.

SSO_PROVIDER_UPDATED

An admin has changed the SSO settings.

STUDIO_ADOPTION_CSV_DOWNLOADED

A user downloaded the studio adoption CSV from Admin and Settings >Platform Adoption >Studio.

Note

A message is not included with the event.

TEAM_DELETED

The team was deleted.

TEAM_MEMBERSHIP_CREATED

A user was invited to the team.

TEAM_MEMBERSHIP_DELETED

A user was removed from a team.

TEAM_MEMBERSHIP_UPDATED

A new role was applied to a user.

The user was locked (Inactive).

The user was unlocked (Active)

TEAM_MEMBERSHIP_WITH_NO_CONFIRMATION_CREATED

A user was invited with no confirmation.

TEAM_UPDATED

Team-specific changes were applied, like changes to the team's privacy.

TRACKING_EVENT_DELETED

A user has deleted all data records from the Studio tracking service

TWO_FACTOR_UPDATED

A user updated two factor: enabled or disabled.

TWO_FACTOR_UPDATED

A user updated two-factor channel: SMS or EMAIL.

UPLINK_CREATED

An uplink connection was created.

UPLINK_DELETED

An uplink connection was deleted.

UPLINK_UPDATED

An uplink connection was updated.

USER_ADOPTION_PREFERENCE_CHANGED

Note: Only if available in admin and settings. Feature toggled on [enabled] and off [disabled]

USER_CHANGE_PASSWORD

A user changed their password.

USER_DELETE_API_KEY

A user deleted an API key.

USER_GENERATE_API_KEY

A user generated an API key.

USER_JOIN_GROUP

A user joined a group or was added to it.

USER_LEFT_GROUP

A user quit a group or was removed from it.

USER_NAME_UPDATED

A user changed their profile name from and to.

USER_PERMISSIONS_CSV_DOWNLOADED

A user downloaded the permissions CSV from Admin and Settings >Users.

Note

A message is not included with the event.

USER_TEAM_MEMBERSHIP_ACTIVATED

A user activated his team membership.

USER_TEAM_MEMBERSHIP_ACTIVATED_LINK_GENERATED

A membership link has been generated, allowing the user to access the team.

USER_TEAM_MEMBERSHIP_ACTIVATED_LINK_GENERATED

A membership link has been generated, allowing the user to access the team.

Business Miner

PROCESS_WORKSPACE_NODE_UPDATED

A Business Miner node (Process Workspace or Exploration) has been updated.

Data Integration

ANALYSIS_EXPORT_AUDIT_LOG_EVENT

Data integration audit log has been exported.

CUSTOM_EXTRACTION_EXECUTED

Added when a custom extraction is executed.

CUSTOM_EXTRACTION_METADATA_EXECUTED

Added when a metadata query for a custom extraction is executed.

CUSTOM_EXTRACTION_PREVIEW_EXECUTED

Added when a preview query for a custom extraction is executed.

DATA_JOB_CREATED

A data job has been created.

DATA_JOB_DELETED

A data job has been deleted.

DATA_MODEL_CREATED

A data model has been created.

DATA_MODEL_DELETED

A data model has been deleted.

DATA_MODEL_UPDATED

A data model has been renamed.

DATA_POOL_CONNECTION_CONFIGURATION_UPDATED

The data pool connection was updated.

DATA_POOL_CREATED

A data pool has been created.

DATA_POOL_DELETED

A data pool has been deleted.

DATA_POOL_EXPORTED

A data pool has been exported.

DATA_POOL_UPDATED

A data pool has been renamed.

DATA_SOURCE_CREATED

A data connection has been created.

DATA_SOURCE_DELETED

A data connection has been deleted.

DATA_SOURCE_EXPORTED

A data source was shared with other data pools in the same team.

DATA_SOURCE_IMPORTED

A shared data source was imported into a target data pool.

PROCESS_INSTALLED

A process has been installed from the Marketplace.

File Uploader

FILE_UPLOAD_SUCCEEDED

Successfully uploaded the file to Celonis Platform.

FILE_UPLOAD_FAILURE

Failed to upload the file into the database

JOB_EXECUTION_CANCELLED

Import has been cancelled

JOB_EXECUTION_FAILED

Failed to import the file into the database

JOB_EXECUTION_SUCCEEDED

Successfully imported the file into the database

Machine Learning

ML_FLOW_DISABLED

The feature is set to disable for the creation of an ML Flow instance (only an alpha feature, not production ready)

ML_FLOW_ENABLED

The feature is set to enable for the creation of an ML Flow instance (only an alpha feature, not production ready)

ML_IMAGE_DISABLED

An ML Image is disabled.

ML_IMAGE_ENABLED

An ML Image is enabled.

ML_KUBERNETES_ENABLED

Team is moved to Kubernetes infra

ML_NOTEBOOK_CREATED

A new machine learning workbench has been created.

ML_NOTEBOOK_DELETED

A machine learning workbench has been deleted.

ML_NOTEBOOK_UPDATED

An existing machine learning workbench has been updated.

ML_PLAN_CHANGED

The dedicated plan changed.

ML_SCHEDULING_CREATED

A new schedule has been created to execute a machine-learning notebook.

ML_SCHEDULING_DELETED

A scheduled execution of a machine learning notebook has been removed.

ML_SCHEDULING_UPDATED

A scheduled execution of a machine learning notebook has been updated.

ML_WORKSPACE_CREATED

A new machine-learning workspace was created.

ML_WORKSPACE_DELETED

A machine learning workspace was deleted.

ML_WORKSPACE_UPDATED

A machine learning workspace updated.

Object-centric data model

OCDM_GRAPH_PUBLISHED

The object-centric data model was published to development.

OCDM_GRAPH_PROMOTED

The object-centric data model was published to development and production.

OCDM_SQL_FACTORY_CREATED

A transformation was created.

OCDM_SQL_FACTORY_UPDATED

A transformation was updated.

OCDM_SQL_FACTORY_DELETED

A transformation was deleted.

OCDM_OBJECT_CREATED

An object type was created.

OCDM_OBJECT_UPDATED

An object type was updated.

OCDM_OBJECT_DELETED

An object type was deleted.

OCDM_OBJECT_RENAMED

An object type was renamed.

OCDM_OBJECT_RENAMED_RELATED_OBJECT_UPDATED

An object was updated due to the rename of a related object.

OCDM_OBJECT_RENAMED_RELATED_FIELD_EXTENSION_UPDATED

The extension of a Celonis object was updated due to the rename of a related object.

OCDM_OBJECT_RENAMED_RELATED_EVENT_UPDATED

An event was updated due to the rename of a related object.

OCDM_OBJECT_RENAMED_RELATED_SQL_FACTORY_UPDATED

A transformation was updated due to the rename of a related object.

OCDM_OBJECT_RENAMED_RELATED_PERSPECTIVE_UPDATED

A perspective was updated due to the rename of a related object.

OCDM_OBJECT_RENAMED_RELATED_EVENT_FIELD_EXTENSION_UPDATED

The extension of a Celonis event was updated due to the rename of a related object.

OCDM_EVENT_CREATED

An event type was created.

OCDM_EVENT_RENAMED

An even type was renamed.

OCDM_EVENT_RENAMED_RELATED_SQL_FACTORY_UPDATED

A transformation was updated due to the rename of a related event.

OCDM_EVENT_RENAMED_RELATED_PERSPECTIVE_UPDATED

A perspective was updated due to the rename of a related event.

OCDM_EVENT_UPDATED

An event type was updated.

OCDM_EVENT_DELETED

An event type was deleted.

OCDM_PERSPECTIVE_CREATED

A perspective was created.

OCDM_PERSPECTIVE_UPDATED

A perspective was updated.

OCDM_PERSPECTIVE_DELETED

A perspective was deleted.

OCDM_PROCESS_ENABLED

A Celonis catalog process was enabled.

OCDM_PROCESS_DISABLED

A Celonis catalog process was disabled.

OCDM_PROCESS_DATA_SOURCE_ENABLED

A Celonis catalog process was enabled for a specific data connection

OCDM_PROCESS_DATA_SOURCE_DISABLED

A Celonis catalog process was disabled for a specific data connection.

Process Automation

AGENT_REGISTERED

An agent has been registered.

CONNECTION_CREATED

A new connection has been created.

CONNECTION_DELETED

A connection has been deleted.

CONNECTION_UPDATED

An existing connection has been updated.

SKILL_CREATED

A skill has been created.

SKILL_DELETED

A skill has been deleted.

SKILL_RENAMED

A skill has been renamed.

WORKFLOW_CREATED

A new workflow has been created.

WORKFLOW_DELETED

A workflow has been deleted.

WORKFLOW_RENAMED

A workflow has been renamed.

Studio

ANALYSIS_EXPORT_AUDIT_LOG_EVENT

Allow CSV export of analysis components in Analysis settings, and the user exports data.

STUDIO_INPUT_VARIABLE_CREATED

A variable for an asset has been created in Studio.

STUDIO_INPUT_VARIABLE_DELETED

A variable for an asset has been deleted in Studio.

STUDIO_INPUT_VARIABLE_UPDATED

A variable for an asset has been updated in Studio.

STUDIO_INPUT_VARIABLE_VALUE_BATCH_RESET

A variable value has changed.

STUDIO_INPUT_VARIABLE_VALUE_CHANGED

A variable value has changed

STUDIO_INPUT_VARIABLE_VALUE_RESET

A variable value has been reset to default value.

STUDIO_NODE_COPIED

An asset inside a package has been copied in Studio.

STUDIO_NODE_CREATED

An asset inside a package has been created in Studio.

STUDIO_NODE_DELETED

An asset inside a package has been deleted in Studio.

STUDIO_NODE_DUPLICATED

A studio node (asset, package or folder) has been duplicated.

STUDIO_NODE_MOVED

An asset inside a package has been moved in Studio.

STUDIO_NODE_RENAMED

An asset (type is provided inside the message: analysis, knowledge model, skill, view..) inside a package (package key is provided in the message) has been renamed.

STUDIO_NODE_UPDATED

An asset inside a package has been updated/changed in Studio.The message will show the node name and related package, the node type, and the updated asset type. UUID's are also provided in the message.

STUDIO_PACKAGE_DELETED

A package has been deleted from Studio and Apps.

STUDIO_PACKAGE_INSTALLED

A package has been installed from the Marketplace.

STUDIO_PACKAGE_IMPORTED

A package node has been imported in Studio (via content-cli or team-to-team copy).

STUDIO_PACKAGE_MOVED

A package has been moved from the original location.

STUDIO_PACKAGE_MOVED_TO_TRASH

A package has been moved to trash.

STUDIO_PACKAGE_PUBLISHED

A package has been published to Apps

STUDIO_PACKAGE_VARIABLE_CHANGED

A package variable has been changed in Studio.

STUDIO_PACKAGE_VARIABLE_CREATED

A package variable has been created in Studio.

STUDIO_PACKAGE_VARIABLE_DELETED

A package variable has been deleted in Studio.

STUDIO_PACKAGE_VERSION_LOADED

The package switched to a past version in Studio.

STUDIO_SPACE_CREATED

A Studio Space has been created.

STUDIO_SPACE_DELETED

A Studio Space has been deleted.

STUDIO_SPACE_UPDATED

A Studio Space has been updated.

Task Mining

TASK_MINING_BLANK_PROJECT_CREATED

A project has been created in Task Mining.

TASK_MINING_CONFIGURATION_CREATED

A project configuration has been created in Task Mining.

TASK_MINING_CONFIGURATION_DOWNLOADED

A project configuration has been downloaded in Task Mining.

TASK_MINING_CONFIGURATION_UPDATED

A project configuration has been updated in Task Mining.

TASK_MINING_DATA_PROCESSING_TRIGGER_MANUAL

The project data processing was changed to run only after a manual trigger by clicking on run.

TASK_MINING_DATA_PROCESSING_TRIGGER_ON_DATA_PUSH

The project data processing was changed to run only automatically after the Task Mining Clients sent new data.

TASK_MINING_DATA_PROCESSING_TRIGGER_SCHEDULED

The project data processing was changed to run only automatically based on the schedule.

TASK_MINING_LABEL_CREATED

A Task Mining labeling rule has been created.

TASK_MINING_LABEL_DELETED

A Task Mining labeling rule has been deleted.

TASK_MINING_NEW_CONFIGURATION_UPLOADED

A project configuration has been updated by uploading a new one in Task Mining.

TASK_MINING_PROJECT_CONNECTION_UPDATED

The connection to the Task Mining project has been updated.

TASK_MINING_PROJECT_DELETED

A project has been deleted in Task Mining.

TASK_MINING_QUICKSTART_PROJECT_CREATED

A project has been created in Task Mining.

Team To Team Copy

TEAM_TO_TEAM_COPY_CONFIGURATION_CREATED

A copy configuration has been created.

TEAM_TO_TEAM_COPY_CONFIGURATION_DELETED

A copy configuration has been deleted.

TEAM_TO_TEAM_COPY_CONFIGURATION_UPDATED

A copy configuration has been updated.

TEAM_TO_TEAM_COPY_AUTHORIZED_TEAM_AUTHORIZED

An authorized team has been updated.

TEAM_TO_TEAM_COPY_AUTHORIZED_TEAM_CREATED

An authorized team has been created.

TEAM_TO_TEAM_COPY_AUTHORIZED_TEAM_DELETED

An authorized team has been deleted.

TEAM_TO_TEAM_COPY_SCHEDULING_CREATED

A scheduling has been created.

TEAM_TO_TEAM_COPY_SCHEDULING_DELETED

A scheduling has been deleted.

TEAM_TO_TEAM_COPY_SCHEDULING_UPDATED

A scheduling has been updated.

Transformation Center

OBJECTIVE_CREATED

An Objective has been created in Transformation Center.

OBJECTIVE_DELETED

An Objective has been deleted in Transformation Center.

OBJECTIVE_INSTALLED

An Objective has been installed from AppStore in Transformation Center.

OBJECTIVE_UPDATED

An Objective has been updated in Transformation Center.

OBJECTIVE_KPI_CREATED

A KPI has been created in Transformation Center.

OBJECTIVE_KPI_DELETED

A KPI has been deleted in Transformation Center.

OBJECTIVE_KPI_UPDATED

A KPI has been updated in Transformation Center.

REPORTING_CREATED

A report is created that schedules an email to report values on specific KPI's

REPORTING_UPDATED

A report is updated that schedules an email to report values on specific KPI's

Trash

PACKAGE_MOVED_TO_TRASH

A package has been moved to Trash

PACKAGE_RESTORED_FROM_TRASH

A package has been restored from trash

Extensive Data Integration Audit Logs

Note

This feature is not currently available by default for all teams. If you want to use the feature that is not enabled, please reach out to the support team through the support portal.

For customers that have the extensive audit logging for Data Integration enabled, the following events are captured as well:

Event Origin

Event Name

Explanation

Data Integration

DATA_JOB_ALERT_DISABLED

A data job alert was deleted

DATA_JOB_ALERT_ENABLED

A data job alert was enabled to trigger on events such as failures, successes, skips and execution time.

DATA_JOB_ALERT_UPDATED

A data job alert was updated

DATA_JOB_COPIED

A data job has been copied

DATA_JOB_DUPLICATED

A data job has been duplicated.

DATA_JOB_MANUALLY_CANCELED

A data job execution has been canceled manually.

DATA_JOB_MANUALLY_EXECUTED

A data job execution has been triggered manually.

DATA_JOB_UPDATED

A data job got updated, e.g. renamed.

DATA_MODEL_ACTIVITY_OR_CASE_TABLE_CHANGED

The data model activity table or case table configuration changed.

DATA_MODEL_CALENDAR_DISABLED

The calendar option for a data model got enabled.

DATA_MODEL_CUSTOM_CALENDAR_ENABLED

A custom calendar has been enabled for a data model.

DATA_MODEL_CUSTOM_CALENDAR_SAVED

A custom calendar has been saved for a data model.

DATA_MODEL_DUPLICATED

A data model has been duplicated.

DATA_MODEL_FACTORY_CALENDAR_ENABLED

A factory calendar has been enabled for a data model.

DATA_MODEL_FACTORY_CALENDAR_SAVED

A factory calendar has been saved for a data model.

DATA_MODEL_FOREIGN_KEY_CREATED

A foreign key in the data model has been created.

DATA_MODEL_FOREIGN_KEY_DELETED

A foreign key in the data model has been deleted.

DATA_MODEL_FOREIGN_KEY_UPDATED

A foreign key in the data model has been changed.

DATA_MODEL_LOAD_MANUALLY_CANCELED

A data model load has been canceled manually.

DATA_MODEL_MANUAL_LOAD_STARTED

A manual data model load has been triggered.

DATA_MODEL_NAME_MAPPINGS_DELETED

A name mapping has been deleted.

DATA_MODEL_NAME_MAPPINGS_LOADED

A name mapping has been loaded.

DATA_MODEL_PERMISSION_ASSIGNMENT_CREATED

A manual data permission assignment rule has been created.

DATA_MODEL_PERMISSION_ASSIGNMENT_DELETED

A manual data permission assignment rule has been deleted.

DATA_MODEL_PERMISSION_ASSIGNMENT_UPDATED

A manual data permission assignment rule has been changed.

DATA_MODEL_PERMISSION_DISABLED

The data permissions have been disabled for one data model.

DATA_MODEL_PERMISSION_ENABLED

The data permissions have been enabled for one data model.

DATA_MODEL_PERMISSION_TABLE_APPLIED

A data model permission table has been applied.

DATA_MODEL_PERMISSION_TABLE_DELETED

A data model permission table has been deleted.

DATA_MODEL_SIGNAL_LINK_CREATED

A signal link has been created.

DATA_MODEL_TABLE_DELETED

A data model table has been deleted.

DATA_MODEL_TABLES_CREATED

Table(s) have been added to the data model.

DATA_POOL_COPIED

A data pool has been copied.

DATA_POOL_VERSION_COPIED

A version was copied.

DATA_POOL_VERSION_CREATED

A version was created for a data pool.

DATA_POOL_VERSION_DELETED

A version was deleted for a data pool.

DATA_SOURCE_DUPLICATED

A data connection has been duplicated.

DATA_SOURCE_UPDATED

A data connection got updated, e.g. renamed.

EXTRACTION_CONFIGURATIONS_UPDATED

An extraction configuration has been changed.

FILE_UPLOAD_CREATED

A file upload took place.

FILE_UPLOAD_HISTORY_ENTRY_DELETED

A history entry for a former file upload got deleted.

JOB_SCHEDULING_CREATED

A data job has been assigned to a schedule.

JOB_SCHEDULING_DELETED

A data job has been removed from a schedule.

JOB_SCHEDULING_EXECUTION_ORDER_CHANGED

The data job execution order within a schedule has been changed.

PARAMETER_CREATED

A parameter has been created.

PARAMETER_DELETED

A parameter has been deleted.

PARAMETER_UPDATED

A parameter got updated.

SCHEDULING_CANCELLED

A schedule has been canceled manually.

SCHEDULING_CREATED

A schedule has been created.

SCHEDULING_DELETED

A schedule has been deleted.

SCHEDULING_DISABLED

A schedule has been disabled.

SCHEDULING_ENABLED

A schedule has been enabled.

SCHEDULING_FREQUENCY_CHANGED

A schedule's frequency has been changed.

SCHEDULING_MANUALLY_EXECUTED

A schedule has been executed manually.

SCHEDULING_MODE_CHANGED

A schedule' mode (Full vs Delta) has been changed.

SCHEDULING_MONITORING_DISABLED

Monitoring has been disabled on a data job.

SCHEDULING_MONITORING_ENABLED

Monitoring has been enabled on a data job.

SCHEDULING_RENAMED

A schedule has been renamed.

TASK_CREATED

A task, i.e., transformation or extraction, has been created.

TASK_DELETED

A task, i.e., transformation or extraction, has been deleted.

TASK_DISABLED

A task, i.e., transformation or extraction, has been disabled.

TASK_ENABLED

A task, i.e., transformation or extraction, has been enabled.

TASK_NAME_OR_DESCRIPTION_UPDATED

A task's name or description has been changed, i.e., transformation or extraction.

TASK_ORDER_CHANGED

The task order, i.e., the order of transformations and extractions, has been changed.

TRANSFORMATION_CODE_CHANGED

A transformation statement (SQL code) has been changed.