Audit logs - Event details
When viewing your audit logs, the following events are available:
Event Origin | Event Name | Explanation | ||
---|---|---|---|---|
Action Engine | EXPORT_PARQUET_DISCLAIMER_AGREEMENT_DELETED | The agreement to allow exporting data to parquet files has been withdrawn. | ||
EXPORT_PARQUET_DISCLAIMER_AGREEMENT_SIGNED | The agreement to export data to parquet files has been given (required for Action Engine Connector). | |||
ROUTING_RULE_CREATED | A new routing rule has been created. | |||
ROUTING_RULE_DELETED | A routing rule has been deleted. | |||
ROUTING_RULE_DUPLICATED | An existing routing rule has been duplicated. | |||
ROUTING_RULE_UPDATED | An existing routing rule has been updated. | |||
SKILL_CREATED | A new skill has been created. | |||
SKILL_DELETED | A skill has been deleted. | |||
SKILL_DUPLICATED | An existing skill has been duplicated. | |||
SKILL_INSTALLED | A new skill has been installed. | |||
SKILL_UPDATED | An existing skill has been updated. | |||
Action Flows | ACTIONFLOW_ACTIVATED | Logged when an action flow is enabled/activated and contains:
| ||
ACTIONFLOW_CREATED | Logged when an action flow is created, contains:
| |||
ACTIONFLOW_DEACTIVATED | Logged when an action flow is disabled/deactivated and contains:
| |||
ACTIONFLOW_DRAFT_BLUEPRINT_MODIFIED | Logged when an action flows’ draft configuration is modified, contains:
| |||
ACTIONFLOW_SCHEDULE_MODIFIED | Logged when an Action Flows’ schedule is modified, contains:
| |||
Admin and Settings | ADMIN USER INVITED | An Admin gets invited from the backend into the team. | ||
APPLICATION_KEY_CREATED | A user created a new application key. | |||
APPLICATION_KEY_DELETED | A user deleted an application key. | |||
APPLICATION_KEY_UPDATED | The application key was updated. | |||
APPLICATION_PERMISSIONS_CSV_DOWNLOADED | A user downloaded the permissions CSV from Admin and Settings >Applications. NoteA message is not included with the event. | |||
AUDIT_LOG_CSV_DOWNLOADED | A user downloaded the Audit Log CSV. | |||
AUDIT_LOG_PREFERENCES_UPDATED | A user enabled or disabled the logging of IP address. A user enabled or disabled Days to delete with qty of days stated. | |||
GROUP_CREATED | A group was created. | |||
GROUP_DELETED | A group was deleted. | |||
GROUP_PERMISSIONS_CSV_DOWNLOADED | A user downloaded the permissions CSV from Admin and Settings >Groups. NoteA message is not included with the event. | |||
GROUP_UPDATED | A group was updated. | |||
IP_RESTRICTIONS_RESET | IP restrictions were reset. | |||
IP_RESTRICTIONS_SET | IP restrictions were set. | |||
LOGIN_HISTORY_CSV_DOWNLOADED | A user downloaded the Login History CSV. | |||
LOGIN_HISTORY_DELETED | Login history delete option was selected when turning off the login history. | |||
LOGIN_HISTORY_PREFERENCES_UPDATED | A user-enabled or disabled Login History. A user enabled or disabled Days to delete with qty of days stated. | |||
MEMBER_LOCK_POLICY_UPDATED | Locking policy enabled and or updated. Locking policy user notification enabled and or updated. | |||
OPEN_SIGNUP_UPDATED | A user enabled or disabled Open Sign up and the default group name. | |||
PERMISSIONS_CSV_DOWNLOADED | A user downloaded the permissions CSV from Admin and Settings >Permissions. NoteA message is not included with the event. | |||
PERMISSIONS_UPDATE | A user has updated Celonis Platform permissions. The message will show the subject description, the subject type, and the object description before explaining the new vs. old permission. | |||
SSO_PROVIDER_CREATED | A user created the SSO provider. | |||
SSO_PROVIDER_DELETED | A user deleted the SSO provider. | |||
SSO_PROVIDER_TOGGLED | SSO provider changed. | |||
SSO_PROVIDER_UPDATED | An admin has changed the SSO settings. | |||
STUDIO_ADOPTION_CSV_DOWNLOADED | A user downloaded the studio adoption CSV from Admin and Settings >Platform Adoption >Studio. NoteA message is not included with the event. | |||
TEAM_DELETED | The team was deleted. | |||
TEAM_MEMBERSHIP_CREATED | A user was invited to the team. | |||
TEAM_MEMBERSHIP_DELETED | A user was removed from a team. | |||
TEAM_MEMBERSHIP_UPDATED | A new role was applied to a user. The user was locked (Inactive). The user was unlocked (Active) | |||
TEAM_MEMBERSHIP_WITH_NO_CONFIRMATION_CREATED | A user was invited with no confirmation. | |||
TEAM_UPDATED | Team-specific changes were applied, like changes to the team's privacy. | |||
TRACKING_EVENT_DELETED | A user has deleted all data records from the Studio tracking service | |||
TWO_FACTOR_UPDATED | A user updated two factor: enabled or disabled. | |||
TWO_FACTOR_UPDATED | A user updated two-factor channel: SMS or EMAIL. | |||
UPLINK_CREATED | An uplink connection was created. | |||
UPLINK_DELETED | An uplink connection was deleted. | |||
UPLINK_UPDATED | An uplink connection was updated. | |||
USER_ADOPTION_PREFERENCE_CHANGED | Note: Only if available in admin and settings. Feature toggled on [enabled] and off [disabled] | |||
USER_CHANGE_PASSWORD | A user changed their password. | |||
USER_DELETE_API_KEY | A user deleted an API key. | |||
USER_GENERATE_API_KEY | A user generated an API key. | |||
USER_JOIN_GROUP | A user joined a group or was added to it. | |||
USER_LEFT_GROUP | A user quit a group or was removed from it. | |||
USER_NAME_UPDATED | A user changed their profile name from and to. | |||
USER_PERMISSIONS_CSV_DOWNLOADED | A user downloaded the permissions CSV from Admin and Settings >Users. NoteA message is not included with the event. | |||
USER_TEAM_MEMBERSHIP_ACTIVATED | A user activated his team membership. | |||
USER_TEAM_MEMBERSHIP_ACTIVATED_LINK_GENERATED | A membership link has been generated, allowing the user to access the team. | |||
VARIABLE_ADMIN_PREFERENCES_UPDATED | Granular permissions have been added or removed from the variable admin that either restricts or allows them to invite users, create groups and app keys and also impacts the ability to export CSV’s from within Admin & Settings. | |||
Business Miner | PROCESS_WORKSPACE_PACKAGE_VARIABLE_CREATED | A variable for a given process workspace has been created in Business Miner. | ||
Data Integration | ANALYSIS_EXPORT_AUDIT_LOG_EVENT | Data integration audit log has been exported. | ||
DATA_JOB_CREATED | A data job has been created. | |||
DATA_JOB_DELETED | A data job has been deleted. | |||
DATA_MODEL_CREATED | A data model has been created. | |||
DATA_MODEL_DELETED | A data model has been deleted. | |||
DATA_MODEL_UPDATED | A data model has been renamed. | |||
DATA_POOL_CONNECTION_CONFIGURATION_UPDATED | The data pool connection was updated. | |||
DATA_POOL_CREATED | A data pool has been created. | |||
DATA_POOL_DELETED | A data pool has been deleted. | |||
DATA_POOL_EXPORTED | A data pool has been exported. | |||
DATA_POOL_UPDATED | A data pool has been renamed. | |||
DATA_SOURCE_CREATED | A data connection has been created. | |||
DATA_SOURCE_DELETED | A data connection has been deleted. | |||
PROCESS_INSTALLED | A process has been installed from the Marketplace. | |||
File Uploader | FILE_UPLOAD_SUCCEEDED |
| ||
FILE_UPLOAD_FAILURE | Failed to upload the file into the database | |||
JOB_EXECUTION_SUCCEEDED | Successfully imported the file into the database | |||
JOB_EXECUTION_FAILED | Failed to import the file into the database | |||
JOB_EXECUTION_CANCELLED | Import has been cancelled | |||
Machine Learning | ML_FLOW_DISABLED | The feature is set to disable for the creation of an ML Flow instance (only an alpha feature, not production ready) | ||
ML_FLOW_ENABLED | The feature is set to enable for the creation of an ML Flow instance (only an alpha feature, not production ready) | |||
ML_IMAGE_DISABLED | An ML Image is disabled. | |||
ML_IMAGE_ENABLED | An ML Image is enabled. | |||
ML_KUBERNETES_ENABLED | Team is moved to Kubernetes infra | |||
ML_NOTEBOOK_CREATED | A new machine learning workbench has been created. | |||
ML_NOTEBOOK_DELETED | A machine learning workbench has been deleted. | |||
ML_NOTEBOOK_UPDATED | An existing machine learning workbench has been updated. | |||
ML_PLAN_CHANGED | The dedicated plan changed. | |||
ML_SCHEDULING_CREATED | A new schedule has been created to execute a machine-learning notebook. | |||
ML_SCHEDULING_DELETED | A scheduled execution of a machine learning notebook has been removed. | |||
ML_SCHEDULING_UPDATED | A scheduled execution of a machine learning notebook has been updated. | |||
ML_WORKSPACE_CREATED | A new machine-learning workspace was created. | |||
ML_WORKSPACE_DELETED | A machine learning workspace was deleted. | |||
ML_WORKSPACE_UPDATED | A machine learning workspace updated. | |||
Object-centric data model | OCDM_GRAPH_PUBLISHED | The object-centric data model was published to development. | ||
OCDM_GRAPH_PROMOTED | The object-centric data model was published to development and production. | |||
OCDM_SQL_FACTORY_CREATED | A transformation was created. | |||
OCDM_SQL_FACTORY_UPDATED | A transformation was updated. | |||
OCDM_SQL_FACTORY_DELETED | A transformation was deleted. | |||
OCDM_OBJECT_CREATED | An object type was created. | |||
OCDM_OBJECT_UPDATED | An object type was updated. | |||
OCDM_OBJECT_DELETED | An object type was deleted. | |||
OCDM_EVENT_CREATED | An event type was created. | |||
OCDM_EVENT_UPDATED | An event type was updated. | |||
OCDM_EVENT_DELETED | An event type was deleted. | |||
OCDM_PERSPECTIVE_CREATED | A perspective was created. | |||
OCDM_PERSPECTIVE_UPDATED | A perspective was updated. | |||
OCDM_PERSPECTIVE_DELETED | A perspective was deleted. | |||
OCDM_PROCESS_ENABLED | A Celonis catalog process was enabled. | |||
OCDM_PROCESS_DISABLED | A Celonis catalog process was disabled. | |||
OCDM_PROCESS_DATA_SOURCE_ENABLED | A Celonis catalog process was enabled for a specific data connection. | |||
OCDM_PROCESS_DATA_SOURCE_DISABLED | A Celonis catalog process was disabled for a specific data connection. | |||
Process Automation | AGENT_REGISTERED | An agent has been registered. | ||
CONNECTION_CREATED | A new connection has been created. | |||
CONNECTION_DELETED | A connection has been deleted. | |||
CONNECTION_UPDATED | An existing connection has been updated. | |||
SKILL_CREATED | A skill has been created. | |||
SKILL_DELETED | A skill has been deleted. | |||
SKILL_RENAMED | A skill has been renamed. | |||
WORKFLOW_CREATED | A new workflow has been created. | |||
WORKFLOW_DELETED | A workflow has been deleted. | |||
WORKFLOW_RENAMED | A workflow has been renamed. | |||
Studio | ANALYSIS_EXPORT_AUDIT_LOG_EVENT | Allow CSV export of analysis components in Analysis settings, and the user exports data. | ||
STUDIO_NODE_COPIED | An asset inside a package has been copied in Studio. | |||
STUDIO_NODE_CREATED | An asset inside a package has been created in Studio. | |||
STUDIO_NODE_DELETED | An asset inside a package has been deleted in Studio. | |||
STUDIO_NODE_MOVED | An asset inside a package has been moved in Studio. | |||
STUDIO_NODE_RENAMED | An asset (type is provided inside the message: analysis, knowledge model, skill, view..) inside a package (package key is provided in the message) has been renamed. | |||
STUDIO_NODE_UPDATED | An asset inside a package has been updated/changed in Studio.The message will show the node name and related package, the node type, and the updated asset type. UUID's are also provided in the message. | |||
STUDIO_PACKAGE_DELETED | A package has been deleted from Studio and Apps. | |||
STUDIO_PACKAGE_INSTALLED | A package has been installed from the Marketplace. | |||
STUDIO_PACKAGE_MOVED | A package has been moved from the original location. | |||
STUDIO_PACKAGE_PUBLISHED | A package has been published to Apps | |||
STUDIO_PACKAGE_VARIABLE_CHANGED | A package variable has been changed in Studio. | |||
STUDIO_PACKAGE_VARIABLE_CREATED | A package variable has been created in Studio. | |||
STUDIO_PACKAGE_VARIABLE_DELETED | A package variable has been deleted in Studio. | |||
STUDIO_PACKAGE_VERSION_LOADED | The package switched to a past version in Studio. | |||
STUDIO_SPACE_CREATED | A Studio Space has been created. | |||
STUDIO_SPACE_DELETED | A Studio Space has been deleted. | |||
STUDIO_SPACE_UPDATED | A Studio Space has been updated. | |||
Task Mining | TASK_MINING_BLANK_PROJECT_CREATED | A project has been created in Task Mining. | ||
TASK_MINING_CONFIGURATION_CREATED | A project configuration has been created in Task Mining. | |||
TASK_MINING_CONFIGURATION_DOWNLOADED | A project configuration has been downloaded in Task Mining. | |||
TASK_MINING_CONFIGURATION_UPDATED | A project configuration has been updated in Task Mining. | |||
TASK_MINING_DATA_PROCESSING_TRIGGER_MANUAL | The project data processing was changed to run only after a manual trigger by clicking on run. | |||
TASK_MINING_DATA_PROCESSING_TRIGGER_ON_DATA_PUSH | The project data processing was changed to run only automatically after the Task Mining Clients sent new data. | |||
TASK_MINING_DATA_PROCESSING_TRIGGER_SCHEDULED | The project data processing was changed to run only automatically based on the schedule. | |||
TASK_MINING_LABEL_CREATED | A Task Mining labeling rule has been created. | |||
TASK_MINING_LABEL_DELETED | A Task Mining labeling rule has been deleted. | |||
TASK_MINING_NEW_CONFIGURATION_UPLOADED | A project configuration has been updated by uploading a new one in Task Mining. | |||
TASK_MINING_PROJECT_CONNECTION_UPDATED | The connection to the Task Mining project has been updated. | |||
TASK_MINING_PROJECT_DELETED | A project has been deleted in Task Mining. | |||
TASK_MINING_QUICKSTART_PROJECT_CREATED | A project has been created in Task Mining. | |||
Transformation Center | OBJECTIVE_CREATED | An Objective has been created in Transformation Center. | ||
OBJECTIVE_DELETED | An Objective has been deleted in Transformation Center. | |||
OBJECTIVE_INSTALLED | An Objective has been installed from AppStore in Transformation Center. | |||
OBJECTIVE_KPI_CREATED | A KPI has been created in Transformation Center. | |||
OBJECTIVE_KPI_DELETED | A KPI has been deleted in Transformation Center. | |||
OBJECTIVE_KPI_UPDATED | A KPI has been updated in Transformation Center. | |||
OBJECTIVE_UPDATED | An Objective has been updated in Transformation Center. | |||
REPORTING_CREATED | A report is created that schedules an email to report values on specific KPIs | |||
REPORTING_UPDATED | A report is updated that schedules an email for reporting values on specific KPIs | |||
Trash | PACKAGE_MOVED_TO_TRASH | A package has been moved to Trash | ||
PACKAGE_RESTORED_FROM_TRASH | A package has been restored from trash |
Extensive Data Integration Audit Logs
Note
This feature is not currently available by default for all teams. If you want to use the feature that is not enabled, please reach out to the support team through the support portal.
For customers that have the extensive audit logging for Data Integration enabled, the following events are captured as well:
Event Origin | Event Name | Explanation |
---|---|---|
Data Integration | DATA_JOB_ALERT_DISABLED | A data job alert was deleted |
DATA_JOB_ALERT_ENABLED | A data job alert was enabled to trigger on events such as failures, successes, skips and execution time. | |
DATA_JOB_ALERT_UPDATED | A data job alert was updated | |
DATA_JOB_COPIED | A data job has been copied | |
DATA_JOB_DUPLICATED | A data job has been duplicated. | |
DATA_JOB_MANUALLY_CANCELED | A data job execution has been canceled manually. | |
DATA_JOB_MANUALLY_EXECUTED | A data job execution has been triggered manually. | |
DATA_JOB_UPDATED | A data job got updated, e.g. renamed. | |
DATA_MODEL_ACTIVITY_OR_CASE_TABLE_CHANGED | The data model activity table or case table configuration changed. | |
DATA_MODEL_CALENDAR_DISABLED | The calendar option for a data model got enabled. | |
DATA_MODEL_CUSTOM_CALENDAR_ENABLED | A custom calendar has been enabled for a data model. | |
DATA_MODEL_CUSTOM_CALENDAR_SAVED | A custom calendar has been saved for a data model. | |
DATA_MODEL_DUPLICATED | A data model has been duplicated. | |
DATA_MODEL_FACTORY_CALENDAR_ENABLED | A factory calendar has been enabled for a data model. | |
DATA_MODEL_FACTORY_CALENDAR_SAVED | A factory calendar has been saved for a data model. | |
DATA_MODEL_FOREIGN_KEY_CREATED | A foreign key in the data model has been created. | |
DATA_MODEL_FOREIGN_KEY_DELETED | A foreign key in the data model has been deleted. | |
DATA_MODEL_FOREIGN_KEY_UPDATED | A foreign key in the data model has been changed. | |
DATA_MODEL_LOAD_MANUALLY_CANCELED | A data model load has been canceled manually. | |
DATA_MODEL_MANUAL_LOAD_STARTED | A manual data model load has been triggered. | |
DATA_MODEL_NAME_MAPPINGS_DELETED | A name mapping has been deleted. | |
DATA_MODEL_NAME_MAPPINGS_LOADED | A name mapping has been loaded. | |
DATA_MODEL_PERMISSION_ASSIGNMENT_CREATED | A manual data permission assignment rule has been created. | |
DATA_MODEL_PERMISSION_ASSIGNMENT_DELETED | A manual data permission assignment rule has been deleted. | |
DATA_MODEL_PERMISSION_ASSIGNMENT_UPDATED | A manual data permission assignment rule has been changed. | |
DATA_MODEL_PERMISSION_DISABLED | The data permissions have been disabled for one data model. | |
DATA_MODEL_PERMISSION_ENABLED | The data permissions have been enabled for one data model. | |
DATA_MODEL_PERMISSION_TABLE_APPLIED | A data model permission table has been applied. | |
DATA_MODEL_PERMISSION_TABLE_DELETED | A data model permission table has been deleted. | |
DATA_MODEL_SIGNAL_LINK_CREATED | A signal link has been created. | |
DATA_MODEL_TABLE_DELETED | A data model table has been deleted. | |
DATA_MODEL_TABLES_CREATED | Table(s) have been added to the data model. | |
DATA_POOL_COPIED | A data pool has been copied. | |
DATA_POOL_VERSION_COPIED | A version was copied. | |
DATA_POOL_VERSION_CREATED | A version was created for a data pool. | |
DATA_POOL_VERSION_DELETED | A version was deleted for a data pool. | |
DATA_SOURCE_DUPLICATED | A data connection has been duplicated. | |
DATA_SOURCE_UPDATED | A data connection got updated, e.g. renamed. | |
EXTRACTION_CONFIGURATIONS_UPDATED | An extraction configuration has been changed. | |
FILE_UPLOAD_CREATED | A file upload took place. | |
FILE_UPLOAD_HISTORY_ENTRY_DELETED | A history entry for a former file upload got deleted. | |
JOB_SCHEDULING_CREATED | A data job has been assigned to a schedule. | |
JOB_SCHEDULING_DELETED | A data job has been removed from a schedule. | |
JOB_SCHEDULING_EXECUTION_ORDER_CHANGED | The data job execution order within a schedule has been changed. | |
PARAMETER_CREATED | A parameter has been created. | |
PARAMETER_DELETED | A parameter has been deleted. | |
PARAMETER_UPDATED | A parameter got updated. | |
SCHEDULING_CANCELLED | A schedule has been canceled manually. | |
SCHEDULING_CREATED | A schedule has been created. | |
SCHEDULING_DELETED | A schedule has been deleted. | |
SCHEDULING_DISABLED | A schedule has been disabled. | |
SCHEDULING_ENABLED | A schedule has been enabled. | |
SCHEDULING_FREQUENCY_CHANGED | A schedule's frequency has been changed. | |
SCHEDULING_MANUALLY_EXECUTED | A schedule has been executed manually. | |
SCHEDULING_MODE_CHANGED | A schedule' mode (Full vs Delta) has been changed. | |
SCHEDULING_MONITORING_DISABLED | Monitoring has been disabled on a data job. | |
SCHEDULING_MONITORING_ENABLED | Monitoring has been enabled on a data job. | |
SCHEDULING_RENAMED | A schedule has been renamed. | |
TASK_CREATED | A task, i.e., transformation or extraction, has been created. | |
TASK_DELETED | A task, i.e., transformation or extraction, has been deleted. | |
TASK_DISABLED | A task, i.e., transformation or extraction, has been disabled. | |
TASK_ENABLED | A task, i.e., transformation or extraction, has been enabled. | |
TASK_NAME_OR_DESCRIPTION_UPDATED | A task's name or description has been changed, i.e., transformation or extraction. | |
TASK_ORDER_CHANGED | The task order, i.e., the order of transformations and extractions, has been changed. | |
TRANSFORMATION_CODE_CHANGED | A transformation statement (SQL code) has been changed. |