Skip to main content

Celonis Product Documentation

Audit Logs

Quick-Start

  • Audit the user activity on your team.

  • Export the audit logs to document and share the audit logs.

  • It is possible to export Audit Logs via API:

    • How to guide via this URL - https://[Your Team]/swagger-ui/index.html?configUrl=/log/v3/api-docs/swagger-config (manually craft it and replace [Your Team] with corresponding team + cluster)

    • See also Application Keys.

Log UI Components

Starting from the top left of the UI going to the right:

  1. Page title and info icon (The info icon explains important information about the UI)

  2. Enable IP address tracking toggle - This feature if enabled will add the IP address in a separate column to the logs and the IP address will be returned when a user makes a change. Note: celonis-service (SYSTEM) changes are not tracked

  3. Search - This feature allows you to search for key words in the "Event" column

  4. Export as CSV - This allows the export of all log files. This CSV is not limited to the last 500 entries like the UI is.

  5. Delete audit logs older than.... - This feature allows the admin to set a time frame for when logs should be deleted so the admin can align to their GDPR needs. The default is "No Deletion"

  6. User ID - This shows the User UUID and email address of the user that made the change.

  7. Event - This is the event category name and informs at a high level what has been changed.

  8. Date - This is the date of the event

  9. Message - This is the detailed response of the change and aligns to the event category name.

  10. IP Address - If enabled (see above) this will add a new column to the log UI that shows the IP address of the user who made the change. Note: This IP address is not the local desktop address, it is the service provider IP address for the user.

  11. Port Number - This feature is only available by request and adds a new column to the audit logs showing the port name. It is recommended not to enable this feature as it always returns 443. However, this is available should customer requirements demand such data.

Log Event Details

Each event corresponds to a single application inside Celonis Execution Management System. For example, CONNECTION_CREATED originates from Process Automation.

This table maps each event to its origin and gives a brief explanation. Audit logs are formatted in standard JSON.

Important

To see all columns in the table, use the scroll bar at the bottom or hide/show columns using Filters.

Event Origin

Event Name

Explanation

Task Mining

TASK_MINING_NEW_CONFIGURATION_UPLOADED

A project configuration has been updated by uploading a new one in Task Mining.

TASK_MINING_CONFIGURATION_DOWNLOADED

A project configuration has been downloaded in Task Mining.

TASK_MINING_CONFIGURATION_UPDATED

A project configuration has been updated in Task Mining.

TASK_MINING_CONFIGURATION_CREATED

A project configuration has been created in Task Mining.

TASK_MINING_QUICKSTART_PROJECT_CREATED

A project has been created in Task Mining.

TASK_MINING_BLANK_PROJECT_CREATED

A project has been created in Task Mining.

TASK_MINING_PROJECT_DELETED

A project has been deleted in Task Mining.

TASK_MINING_PROJECT_CONNECTION_UPDATED

The connection to the Task Mining project has been updated.

Studio

STUDIO_PACKAGE_PUBLISHED

A Package has been published to Apps

STUDIO_PACKAGE_DELETED

A Package has been deleted from Studio and Apps.

STUDIO_PACKAGE_VERSION_LOADED

The package switched to a past version in Studio.

STUDIO_PACKAGE_INSTALLED

A package has been installed from the Marketplace.

STUDIO_PACKAGE_MOVED

A package has been moved from the original location

STUDIO_NODE_RENAMED

An asset (type is provided inside the message: analysis, knowledge model, skill, view..) inside a package (package key is provided in the message) has been renamed.

STUDIO_NODE_DELETED

An asset inside a package has been deleted in Studio.

STUDIO_NODE_COPIED

An asset inside a package has been copied in Studio.

STUDIO_NODE_MOVED

An asset inside a package has been moved in Studio.

STUDIO_NODE_CREATED

An asset inside a package has been created in Studio.

STUDIO_NODE_UPDATED

An asset inside a package has been updated/changed in Studio.

The message will show node name and related package, the node type and asset type that was updated. UUID's are also provided in the message.

STUDIO_PACKAGE_VARIABLE_CREATED

A package variable has been created in Studio.

STUDIO_PACKAGE_VARIABLE_DELETED

A package variable has been deleted in Studio.

STUDIO_PACKAGE_VARIABLE_CHANGED

A package variable has been changed in Studio.

ANALYSIS_EXPORT_AUDIT_LOG_EVENT

Allow CSV exports of analysis components is enabled in Analysis settings and the user exports data.

STUDIO_SPACE_CREATED

A Studio Space has been created

STUDIO_SPACE_DELETED

A Studio Space has been deleted

STUDIO_SPACE_UPDATED

A Studio Space has been updated

Transformation Center

OBJECTIVE_KPI_CREATED

A KPI has been created in Transformation Center.

OBJECTIVE_KPI_UPDATED

A KPI has been updated in Transformation Center.

OBJECTIVE_KPI_DELETED

A KPI has been deleted in Transformation Center.

OBJECTIVE_CREATED

An Objective has been created in Transformation Center.

OBJECTIVE_UPDATED

An Objective has been updated in Transformation Center.

OBJECTIVE_DELETED

An Objective has been deleted in Transformation Center.

OBJECTIVE_INSTALLED

An Objective has been installed from AppStore in Transformation Center.

REPORTING_CREATED

A report is created that schedules an email to report values on certain KPI's

REPORTING_UPDATED

A report is updated that schedules an email to report values on certain KPI's

Machine Learning

ML_NOTEBOOK_CREATED

A new machine learning workbench has been created.

ML_NOTEBOOK_UPDATED

An existing machine learning workbench has been updated.

ML_NOTEBOOK_DELETED

A machine learning workbench has been deleted.

ML_SCHEDULING_CREATED

A new schedule has been created to execute a machine learning notebook.

ML_SCHEDULING_UPDATED

A scheduled execution of a machine learning notebook has been updated.

ML_SCHEDULING_DELETED

A scheduled execution of a machine learning notebook has been removed.

ML_WORKSPACE_CREATED

A new machine learning workspace created

ML_WORKSPACE_UPDATED

A machine learning workspace updated

ML_WORKSPACE_DELETED

A machine learning workspace was deleted

Action Engine

ROUTING_RULE_CREATED

A new routing rule has been created.

ROUTING_RULE_UPDATED

An existing routing rule has been updated.

ROUTING_RULE_DELETED

A routing rule has been deleted.

ROUTING_RULE_DUPLICATED

An existing routing rule has been duplicated.

SKILL_CREATED

A new skill has been created.

SKILL_UPDATED

An existing skill has been updated.

SKILL_DELETED

A skill has been deleted.

SKILL_INSTALLED

A new skill has been installed.

SKILL_DUPLICATED

An existing skill has been duplicated.

Process Automation

WORKFLOW_CREATED

A new workflow has been created.

WORKFLOW_RENAMED

A workflow has been renamed.

WORKFLOW_DELETED

A workflow has been deleted.

CONNECTION_CREATED

A new connection has been created.

CONNECTION_UPDATED

An existing connection has been updated.

CONNECTION_DELETED

A connection has been deleted.

Team Settings

GROUP_CREATED

A group was created

GROUP_UPDATED

A group was updated

GROUP_DELETED

A group was deleted

USER_ADOPTION_PREFERENCE_CHANGED

Note: Only if available in admin and settings.Feature toggled on [enabled] and off [disabled]

USER_JOIN_GROUP,

A user joined group or was added to it

USER_LEFT_GROUP,

A user quit a group or was removed from it

USER_CHANGE_PASSWORD,

A user changed their password

USER_GENERATE_API_KEY,

A user generated an API key

USER_DELETE_API_KEY

A user deleted an API key

USER_TEAM_MEMBERSHIP_ACTIVATED

A user activated his team membership

USER_TEAM_MEMBERSHIP_ACTIVATION_LINK_ GENERATED

A membership link has been generated allowing the user to gain access back to the team

ADMIN USER INVITED

An Admin gets invited from the backend into the team

TEAM_UPDATED

Team-specific changes were applied, like changes to the team's privacy

TEAM_DELETED

The team was deleted

TEAM_MEMBERSHIP_UPDATED

A new role was applied to a user

The user was locked (Inactive)

The user was unlocked (Active)

TEAM_MEMBERSHIP_DELETED

A user was removed from a team

TEAM_MEMBERSHIP_CREATED

A user was invited to the team

TEAM_MEMBERSHIP_WITH_NO_CONFIRMATION_ CREATED

A user was invited with no confirmation

UPLINK_CREATED

An uplink connection was created

UPLINK_UPDATED

An uplink connection was updated

UPLINK_DELETED

An uplink connection was deleted

TWO_FACTOR_UPDATED

A user updated two factor : enabled or disabled

TWO_FACTOR_UPDATED

A user updated two factor channel : SMS or EMAIL

LOGIN_HISTORY_PREFERENCES_UPDATED

A user enabled or disabled Login History

A user enabled or disabled Days to delete with qty of days stated

LOGIN_HISTORY_CSV_DOWNLOADED

A user downloaded the Login History CSV

LOGIN_HISTORY_DELETED

Login history delete option was selected when turning off login history

AUDIT_LOG_PREFERENCES_UPDATED

A user enabled or disabled the logging of IP address

A user enabled or disabled Days to delete with qty of days stated

AUDIT_LOG_CSV_DOWNLOADED

A user downloaded the Audit Log CSV

APPLICATION_KEY_CREATED

A user created a new applications key

APPLICATION_KEY_DELETED

A user deleted an applications key

APPLICATION_KEY_UPDATED

The application key was updated

SSO_PROVIDER_DELETED

A user deleted the SSO provider

SSO_PROVIDER_CREATED

A user created the SSO provider

SSO_PROVIDER_UPDATED

An admin has changed the SSO settings

SSO_PROVIDER_TOGGLED

SSO provider changed

OPEN_SIGNUP_UPDATED

A user enabled or disabled Open Sign up along with default group name

PERMISSIONS_UPDATE

A user has updated EMS permissions. The message will show the subject description, the subject type and the object description before explaining the new vs old permission.

IP_RESTRICTIONS_RESET

IP restrictions reset

IP_RESTRICTIONS_SET

IP restrictions set

MEMBER_LOCK_POLICY_UPDATED

Locking policy enabled and or updated

Locking policy user notification enabled and or updated

Process Analytics

PROCESS_CREATED

A user created a Workspace

PROCESS_UPDATED

A user updated a Workspace

PROCESS_DELETED

A user deleted a Workspace

ANALYSIS_CREATED

A user created an Analysis

ANALYSIS_UPDATED

A user updated an Analysis

ANALYSIS_DELETED

A user deleted an Analysis

APP_INSTALLED

A user installed an App from the App Store

Data Integration

DATA_POOL_CREATED

A data pool has been created.

DATA_POOL_UPDATED

A data pool has been renamed.

DATA_POOL_DELETED

A data pool has been deleted.

DATA_MODEL_CREATED

A data model has been created.

DATA_MODEL_UPDATED

A data model has been renamed.

DATA_MODEL_DELETED

A data model has been deleted.

PROCESS_INSTALLED

A process has been installed from the Marketplace.

DATA_JOB_CREATED

A data job has been created.

DATA_JOB_DELETED

A data job has been deleted.

DATA_SOURCE_CREATED

A data connection has been created.

DATA_SOURCE_DELETED

A data connection has been deleted.

Extensive Data Integration Audit Logs

Feature Availability

This feature is currently not available by default for all teams. Please reach out to the Service Desk if you would like to use the feature and it is not enabled.

For customers that have the extensive audit logging for Data Integration enabled, the following events are captured as well:

Event Origin

Event Name

Explanation

Data Integration

DATA_POOL_COPIED

A data pool has been copied.

DATA_MODEL_PERMISSION_TABLE_APPLIED

A data model permission table has been applied.

DATA_MODEL_PERMISSION_TABLE_DELETED

A data model permission table has been deleted.

DATA_MODEL_PERMISSION_ASSIGNMENT_CREATED

A manual data permission assignment rule has been created.

DATA_MODEL_PERMISSION_ASSIGNMENT_DELETED

A manual data permission assignment rule has been deleted.

DATA_MODEL_PERMISSION_ASSIGNMENT_UPDATED

A manual data permission assignment rule has been changed.

DATA_MODEL_TABLES_CREATED

Table(s) have been added to the data model.

DATA_MODEL_TABLE_DELETED

A data model table has been deleted.

DATA_MODEL_FOREIGN_KEY_UPDATED

A foreign key in the data model has been changed.

DATA_MODEL_FOREIGN_KEY_DELETED

A foreign key in the data model has been deleted.

DATA_MODEL_FOREIGN_KEY_CREATED

A foreign key in the data model has been created.

DATA_MODEL_ACTIVITY_OR_CASE_TABLE_CHANGED

The data model activity table or case table configuration changed.

DATA_MODEL_MANUAL_LOAD_STARTED

A manual data model load has been triggered.

DATA_MODEL_LOAD_MANUALLY_CANCELED

A data model load has been canceled manually.

DATA_MODEL_CUSTOM_CALENDAR_SAVED

A custom calendar has been saved for a data model.

DATA_MODEL_CUSTOM_CALENDAR_ENABLED

A custom calendar has been enabled for a data model.

DATA_MODEL_FACTORY_CALENDAR_SAVED

A factory calendar has been saved for a data model.

DATA_MODEL_FACTORY_CALENDAR_ENABLED

A factory calendar has been enabled for a data model.

DATA_MODEL_CALENDAR_DISABLED

The calendar option for a data model got enabled.

DATA_MODEL_SIGNAL_LINK_CREATED

A signal link has been created.

DATA_MODEL_NAME_MAPPINGS_LOADED

A name mapping has been loaded.

DATA_MODEL_NAME_MAPPINGS_DELETED

A name mapping has been deleted.

DATA_MODEL_DUPLICATED

A data model has been duplicated.

DATA_MODEL_PERMISSION_ENABLED

The data permissions have been enabled for one data model.

DATA_MODEL_PERMISSION_DISABLED

The data permissions have been disabled for one data model.

DATA_JOB_DUPLICATED

A data job has been duplicated.

DATA_JOB_UPDATED

A data job got updated, e.g. renamed.

DATA_JOB_MANUALLY_CANCELED

A data job execution has been canceled manually.

DATA_JOB_MANUALLY_EXECUTED

A data job execution has been triggered manually.

DATA_SOURCE_UPDATED

A data connection got updated, e.g. renamed.

DATA_SOURCE_DUPLICATED

A data connection has been duplicated.

FILE_UPLOAD_CREATED

A file upload took place.

FILE_UPLOAD_HISTORY_ENTRY_DELETED

An history entry for a former file upload got deleted.

TASK_CREATED

A task, i.e. transformation or extraction, has been created.

TASK_DELETED

A task, i.e. transformation or extraction, has been deleted.

TASK_DISABLED

A task, i.e. transformation or extraction, has been disabled.

TASK_ENABLED

A task, i.e. transformation or extraction, has been enabled.

TASK_ORDER_CHANGED

The task order, i.e. order of transformations and extractions, has been changed.

TASK_NAME_OR_DESCRIPTION_UPDATED

A task's, i.e. transformation's or extraction's, name or description has been changed.

EXTRACTION_CONFIGURATIONS_UPDATED

A extraction configuration has been changed.

TRANSFORMATION_CODE_CHANGED

A transformation statement (SQL code) has been changed.

PARAMETER_CREATED

A parameter has been created.

PARAMETER_DELETED

A parameter has been deleted.

PARAMETER_UPDATED

A parameter got updated.

SCHEDULING_CREATED

A schedule has been created.

SCHEDULING_RENAMED

A schedule has been renamed.

SCHEDULING_DELETED

A schedule has been deleted.

SCHEDULING_ENABLED

A schedule has been enabled.

SCHEDULING_DISABLED

A schedule has been disabled.

SCHEDULING_MODE_CHANGED

A schedule' mode (Full vs Delta) has been changed.

SCHEDULING_CANCELLED

A schedule has been canceled manually.

SCHEDULING_FREQUENCY_CHANGED

A schedule's frequency has been changed.

SCHEDULING_MANUALLY_EXECUTED

A schedule has been executed manually.

JOB_SCHEDULING_CREATED

A data job has been assigned to a schedule.

JOB_SCHEDULING_EXECUTION_ORDER_CHANGED

The data job execution order within a schedule has been changed.

JOB_SCHEDULING_DELETED

A data job has been removed from a schedule.