Audit Logs
Quick-Start
Audit the user activity on your team.
Export the audit logs to the document and share the audit logs.
It is possible to export Audit Logs via API:
How to guide via this URL - https://[Your Team]/swagger-ui/index.html?configUrl=/log/v3/api-docs/swagger-config (manually craft it and replace [Your Team] with corresponding team + cluster)
See also Application Keys.
Log UI Components
Starting from the top left of the UI, going to the right:
Page title and info icon (The info icon explains essential information about the UI)
Enable IP address tracking toggle - This feature will add the IP address in a separate column to the logs, and the IP address will be returned when a user changes. Note: celonis-service (SYSTEM) changes are not tracked
Search - This feature allows you to search for keywords in the "Event" column
Export as CSV - This allows the export of all log files. This CSV is not limited to the last 500 entries like the UI is.
Delete audit logs older than.... - This feature allows the admin to set a time frame for when logs should be deleted so the admin can align to their GDPR needs. The default is "No Deletion"
User ID - This shows the User UUID and email address of the user that made the change.
Event - This is the event category name and informs at a high level what has been changed.
Date - This is the date of the event
Message - This detailed response to the change aligns with the event category name.
IP Address - If enabled (see above), this will add a new column to the log UI that shows the IP address of the user who made the change. Note: This IP address is not the local desktop address. It is the service provider's IP address for the user.
Port Number - This feature is only available by request and adds a new column to the audit logs showing the port name. It is recommended not to enable this feature as it always returns 443. However, this is available should customer requirements demand such data.
Log Event Details
Each event corresponds to a single application inside Celonis Execution Management System. For example, CONNECTION_CREATED originates from Process Automation.
This table maps each event to its origin and gives a brief explanation. Audit logs are formatted in standard JSON.
Important
To see all columns in the table, use the scroll bar at the bottom or hide/show columns using Filters.
Event Origin | Event Name | Explanation |
|---|---|---|
Task Mining | TASK_MINING_NEW_CONFIGURATION_UPLOADED | A project configuration has been updated by uploading a new one in Task Mining. |
TASK_MINING_CONFIGURATION_DOWNLOADED | A project configuration has been downloaded in Task Mining. | |
TASK_MINING_CONFIGURATION_UPDATED | A project configuration has been updated in Task Mining. | |
TASK_MINING_CONFIGURATION_CREATED | A project configuration has been created in Task Mining. | |
TASK_MINING_QUICKSTART_PROJECT_CREATED | A project has been created in Task Mining. | |
TASK_MINING_BLANK_PROJECT_CREATED | A project has been created in Task Mining. | |
TASK_MINING_PROJECT_DELETED | A project has been deleted in Task Mining. | |
TASK_MINING_PROJECT_CONNECTION_UPDATED | The connection to the Task Mining project has been updated. | |
TASK_MINING_DATA_PROCESSING_TRIGGER_MANUAL | The project data processing was changed to run only after a manual trigger by clicking on run. | |
TASK_MINING_DATA_PROCESSING_TRIGGER_ON_DATA_PUSH | The project data processing was changed to run only automatically after the Task Mining Clients sent new data. | |
TASK_MINING_DATA_PROCESSING_TRIGGER_SCHEDULED | The project data processing was changed to run only automatically based on the schedule. | |
Studio | STUDIO_PACKAGE_PUBLISHED | A Package has been published to Apps |
STUDIO_PACKAGE_DELETED | A Package has been deleted from Studio and Apps. | |
STUDIO_PACKAGE_VERSION_LOADED | The package switched to a past version in Studio. | |
STUDIO_PACKAGE_INSTALLED | A package has been installed from the Marketplace. | |
STUDIO_PACKAGE_MOVED | A package has been moved from the original location. | |
STUDIO_NODE_RENAMED | An asset (type is provided inside the message: analysis, knowledge model, skill, view..) inside a package (package key is provided in the message) has been renamed. | |
STUDIO_NODE_DELETED | An asset inside a package has been deleted in Studio. | |
STUDIO_NODE_COPIED | An asset inside a package has been copied in Studio. | |
STUDIO_NODE_MOVED | An asset inside a package has been moved in Studio. | |
STUDIO_NODE_CREATED | An asset inside a package has been created in Studio. | |
STUDIO_NODE_UPDATED | An asset inside a package has been updated/changed in Studio. The message will show the node name and related package, the node type, and the updated asset type. UUID's are also provided in the message. | |
STUDIO_PACKAGE_VARIABLE_CREATED | A package variable has been created in Studio. | |
STUDIO_PACKAGE_VARIABLE_DELETED | A package variable has been deleted in Studio. | |
STUDIO_PACKAGE_VARIABLE_CHANGED | A package variable has been changed in Studio. | |
ANALYSIS_EXPORT_AUDIT_LOG_EVENT | Allow CSV export of analysis components in Analysis settings, and the user exports data. | |
STUDIO_SPACE_CREATED | A Studio Space has been created. | |
STUDIO_SPACE_DELETED | A Studio Space has been deleted. | |
STUDIO_SPACE_UPDATED | A Studio Space has been updated. | |
Transformation Center | OBJECTIVE_KPI_CREATED | A KPI has been created in Transformation Center. |
OBJECTIVE_KPI_UPDATED | A KPI has been updated in Transformation Center. | |
OBJECTIVE_KPI_DELETED | A KPI has been deleted in Transformation Center. | |
OBJECTIVE_CREATED | An Objective has been created in Transformation Center. | |
OBJECTIVE_UPDATED | An Objective has been updated in Transformation Center. | |
OBJECTIVE_DELETED | An Objective has been deleted in Transformation Center. | |
OBJECTIVE_INSTALLED | An Objective has been installed from AppStore in Transformation Center. | |
REPORTING_CREATED | A report is created that schedules an email to report values on specific KPIs | |
REPORTING_UPDATED | A report is updated that schedules an email for reporting values on specific KPIs | |
Machine Learning | ML_NOTEBOOK_CREATED | A new machine learning workbench has been created. |
ML_NOTEBOOK_UPDATED | An existing machine learning workbench has been updated. | |
ML_NOTEBOOK_DELETED | A machine learning workbench has been deleted. | |
ML_SCHEDULING_CREATED | A new schedule has been created to execute a machine-learning notebook. | |
ML_SCHEDULING_UPDATED | A scheduled execution of a machine learning notebook has been updated. | |
ML_SCHEDULING_DELETED | A scheduled execution of a machine learning notebook has been removed. | |
ML_WORKSPACE_CREATED | A new machine-learning workspace was created. | |
ML_WORKSPACE_UPDATED | A machine learning workspace updated. | |
ML_WORKSPACE_DELETED | A machine learning workspace was deleted. | |
ML_FLOW_ENABLED | The feature is set to enable for the creation of an ML Flow instance (only an alpha feature, not production ready) | |
ML_FLOW_DISABLED | The feature is set to disable for the creation of an ML Flow instance (only an alpha feature, not production ready) | |
ML_IMAGE_ENABLED | An ML Image is enabled. | |
ML_IMAGE_DISABLED | An ML Image is disabled. | |
ML_KUBERNETES_ENABLED | Team is moved to Kubernetes infra | |
ML_PLAN_CHANGED | The dedicated plan changed. | |
Action Engine | ROUTING_RULE_CREATED | A new routing rule has been created. |
ROUTING_RULE_UPDATED | An existing routing rule has been updated. | |
ROUTING_RULE_DELETED | A routing rule has been deleted. | |
ROUTING_RULE_DUPLICATED | An existing routing rule has been duplicated. | |
SKILL_CREATED | A new skill has been created. | |
SKILL_UPDATED | An existing skill has been updated. | |
SKILL_DELETED | A skill has been deleted. | |
SKILL_INSTALLED | A new skill has been installed. | |
SKILL_DUPLICATED | An existing skill has been duplicated. | |
EXPORT_PARQUET_DISCLAIMER_AGREEMENT_SIGNED | The agreement to export data to parquet files has been given (required for Action Engine Connector). | |
EXPORT_PARQUET_DISCLAIMER_AGREEMENT_DELETED | The agreement to allow exporting data to parquet files has been withdrawn. | |
Process Automation | WORKFLOW_CREATED | A new workflow has been created. |
WORKFLOW_RENAMED | A workflow has been renamed. | |
WORKFLOW_DELETED | A workflow has been deleted. | |
CONNECTION_CREATED | A new connection has been created. | |
CONNECTION_UPDATED | An existing connection has been updated. | |
CONNECTION_DELETED | A connection has been deleted. | |
SKILL_CREATED | A skill has been created. | |
SKILL_RENAMED | A skill has been renamed. | |
SKILL_DELETED | A skill has been deleted. | |
AGENT_REGISTERED | An agent has been registered. | |
Team Settings | GROUP_CREATED | A group was created |
GROUP_UPDATED | A group was updated | |
GROUP_DELETED | A group was deleted | |
USER_ADOPTION_PREFERENCE_CHANGED | Note: Only if available in admin and settings. Feature toggled on [enabled] and off [disabled] | |
USER_JOIN_GROUP, | A user joined a group or was added to it. | |
USER_LEFT_GROUP, | A user quit a group or was removed from it. | |
USER_CHANGE_PASSWORD, | A user changed their password. | |
USER_GENERATE_API_KEY, | A user-generated API key. | |
USER_DELETE_API_KEY | A user deleted an API key. | |
USER_TEAM_MEMBERSHIP_ACTIVATED | A user activated his team membership. | |
USER_TEAM_MEMBERSHIP_ACTIVATION_LINK_ GENERATED | A membership link has been generated, allowing the user to access the team. | |
ADMIN USER INVITED | An Admin gets invited from the backend into the team. | |
TEAM_UPDATED | Team-specific changes were applied, like changes to the team's privacy. | |
TEAM_DELETED | The team was deleted. | |
TEAM_MEMBERSHIP_UPDATED | A new role was applied to a user. The user was locked (Inactive) The user was unlocked (Active) | |
TEAM_MEMBERSHIP_DELETED | A user was removed from a team. | |
TEAM_MEMBERSHIP_CREATED | A user was invited to the team. | |
TEAM_MEMBERSHIP_WITH_NO_CONFIRMATION_ CREATED | A user was invited with no confirmation. | |
UPLINK_CREATED | An uplink connection was created. | |
UPLINK_UPDATED | An uplink connection was updated. | |
UPLINK_DELETED | An uplink connection was deleted. | |
TWO_FACTOR_UPDATED | A user updated two factor: enabled or disabled. | |
TWO_FACTOR_UPDATED | A user updated two-factor channel: SMS or EMAIL. | |
LOGIN_HISTORY_PREFERENCES_UPDATED | A user-enabled or disabled Login History A user enabled or disabled Days to delete with qty of days stated | |
LOGIN_HISTORY_CSV_DOWNLOADED | A user downloaded the Login History CSV. | |
LOGIN_HISTORY_DELETED | Login history delete option was selected when turning off the login history. | |
AUDIT_LOG_PREFERENCES_UPDATED | A user enabled or disabled the logging of IP address. A user enabled or disabled Days to delete with qty of days stated | |
AUDIT_LOG_CSV_DOWNLOADED | A user downloaded the Audit Log CSV. | |
APPLICATION_KEY_CREATED | A user created a new application key. | |
APPLICATION_KEY_DELETED | A user deleted an application key. | |
APPLICATION_KEY_UPDATED | The application key was updated. | |
SSO_PROVIDER_DELETED | A user deleted the SSO provider. | |
SSO_PROVIDER_CREATED | A user created the SSO provider. | |
SSO_PROVIDER_UPDATED | An admin has changed the SSO settings. | |
SSO_PROVIDER_TOGGLED | SSO provider changed | |
OPEN_SIGNUP_UPDATED | A user enabled or disabled Open Sign up and the default group name. | |
PERMISSIONS_UPDATE | A user has updated EMS permissions. The message will show the subject description, the subject type, and the object description before explaining the new vs. old permission. | |
IP_RESTRICTIONS_RESET | IP restrictions reset | |
IP_RESTRICTIONS_SET | IP restrictions set | |
MEMBER_LOCK_POLICY_UPDATED | Locking policy enabled and or updated. Locking policy user notification enabled and or updated. | |
Process Analytics | PROCESS_CREATED | A user created a Workspace. |
PROCESS_UPDATED | A user updated a Workspace. | |
PROCESS_DELETED | A user deleted a Workspace. | |
ANALYSIS_CREATED | A user created an Analysis. | |
ANALYSIS_UPDATED | A user updated an Analysis. | |
ANALYSIS_DELETED | A user deleted an Analysis. | |
APP_INSTALLED | A user installed an App from the Marketplace. | |
Data Integration | ANALYSIS_EXPORT_AUDIT_LOG_EVENT | Data integration audit log has been exported. |
DATA_POOL_CONNECTION_CONFIGURATION_UPDATED | The data pool connection was updated. | |
DATA_POOL_CREATED | A data pool has been created. | |
DATA_POOL_UPDATED | A data pool has been renamed. | |
DATA_POOL_DELETED | A data pool has been deleted. | |
DATA_POOL_EXPORTED | A data pool has been exported. | |
DATA_MODEL_CREATED | A data model has been created. | |
DATA_MODEL_UPDATED | A data model has been renamed. | |
DATA_MODEL_DELETED | A data model has been deleted. | |
PROCESS_INSTALLED | A process has been installed from the Marketplace. | |
DATA_JOB_CREATED | A data job has been created. | |
DATA_JOB_DELETED | A data job has been deleted. | |
DATA_SOURCE_CREATED | A data connection has been created. | |
DATA_SOURCE_DELETED | A data connection has been deleted. |
Extensive Data Integration Audit Logs
Feature Availability
This feature is currently not available by default for all teams. Please reach out to the Service Desk if you want to use the feature that is not enabled.
For customers that have the extensive audit logging for Data Integration enabled, the following events are captured as well:
Event Origin | Event Name | Explanation |
|---|---|---|
Data Integration | DATA_POOL_COPIED | A data pool has been copied. |
DATA_MODEL_PERMISSION_TABLE_APPLIED | A data model permission table has been applied. | |
DATA_MODEL_PERMISSION_TABLE_DELETED | A data model permission table has been deleted. | |
DATA_MODEL_PERMISSION_ASSIGNMENT_CREATED | A manual data permission assignment rule has been created. | |
DATA_MODEL_PERMISSION_ASSIGNMENT_DELETED | A manual data permission assignment rule has been deleted. | |
DATA_MODEL_PERMISSION_ASSIGNMENT_UPDATED | A manual data permission assignment rule has been changed. | |
DATA_MODEL_TABLES_CREATED | Table(s) have been added to the data model. | |
DATA_MODEL_TABLE_DELETED | A data model table has been deleted. | |
DATA_MODEL_FOREIGN_KEY_UPDATED | A foreign key in the data model has been changed. | |
DATA_MODEL_FOREIGN_KEY_DELETED | A foreign key in the data model has been deleted. | |
DATA_MODEL_FOREIGN_KEY_CREATED | A foreign key in the data model has been created. | |
DATA_MODEL_ACTIVITY_OR_CASE_TABLE_CHANGED | The data model activity table or case table configuration changed. | |
DATA_MODEL_MANUAL_LOAD_STARTED | A manual data model load has been triggered. | |
DATA_MODEL_LOAD_MANUALLY_CANCELED | A data model load has been canceled manually. | |
DATA_MODEL_CUSTOM_CALENDAR_SAVED | A custom calendar has been saved for a data model. | |
DATA_MODEL_CUSTOM_CALENDAR_ENABLED | A custom calendar has been enabled for a data model. | |
DATA_MODEL_FACTORY_CALENDAR_SAVED | A factory calendar has been saved for a data model. | |
DATA_MODEL_FACTORY_CALENDAR_ENABLED | A factory calendar has been enabled for a data model. | |
DATA_MODEL_CALENDAR_DISABLED | The calendar option for a data model got enabled. | |
DATA_MODEL_SIGNAL_LINK_CREATED | A signal link has been created. | |
DATA_MODEL_NAME_MAPPINGS_LOADED | A name mapping has been loaded. | |
DATA_MODEL_NAME_MAPPINGS_DELETED | A name mapping has been deleted. | |
DATA_MODEL_DUPLICATED | A data model has been duplicated. | |
DATA_MODEL_PERMISSION_ENABLED | The data permissions have been enabled for one data model. | |
DATA_MODEL_PERMISSION_DISABLED | The data permissions have been disabled for one data model. | |
DATA_JOB_DUPLICATED | A data job has been duplicated. | |
DATA_JOB_COPIED | A data job has been copied | |
DATA_JOB_UPDATED | A data job got updated, e.g. renamed. | |
DATA_JOB_MANUALLY_CANCELED | A data job execution has been canceled manually. | |
DATA_JOB_MANUALLY_EXECUTED | A data job execution has been triggered manually. | |
DATA_JOB_ALERT_UPDATED | A data job alert was updated | |
DATA_JOB_ALERT_ENABLED | A data job alert was enabled to trigger on events such as failures, successes, skips and execution time. | |
DATA_JOB_ALERT_DISABLED | A data job alert was deleted | |
DATA_SOURCE_UPDATED | A data connection got updated, e.g. renamed. | |
DATA_SOURCE_DUPLICATED | A data connection has been duplicated. | |
FILE_UPLOAD_CREATED | A file upload took place. | |
FILE_UPLOAD_HISTORY_ENTRY_DELETED | A history entry for a former file upload got deleted. | |
TASK_CREATED | A task, i.e., transformation or extraction, has been created. | |
TASK_DELETED | A task, i.e., transformation or extraction, has been deleted. | |
TASK_DISABLED | A task, i.e., transformation or extraction, has been disabled. | |
TASK_ENABLED | A task, i.e., transformation or extraction, has been enabled. | |
TASK_ORDER_CHANGED | The task order, i.e., the order of transformations and extractions, has been changed. | |
TASK_NAME_OR_DESCRIPTION_UPDATED | A task's name or description has been changed, i.e., transformation or extraction. | |
EXTRACTION_CONFIGURATIONS_UPDATED | An extraction configuration has been changed. | |
TRANSFORMATION_CODE_CHANGED | A transformation statement (SQL code) has been changed. | |
PARAMETER_CREATED | A parameter has been created. | |
PARAMETER_DELETED | A parameter has been deleted. | |
PARAMETER_UPDATED | A parameter got updated. | |
SCHEDULING_CREATED | A schedule has been created. | |
SCHEDULING_RENAMED | A schedule has been renamed. | |
SCHEDULING_DELETED | A schedule has been deleted. | |
SCHEDULING_ENABLED | A schedule has been enabled. | |
SCHEDULING_DISABLED | A schedule has been disabled. | |
SCHEDULING_MODE_CHANGED | A schedule' mode (Full vs Delta) has been changed. | |
SCHEDULING_CANCELLED | A schedule has been canceled manually. | |
SCHEDULING_FREQUENCY_CHANGED | A schedule's frequency has been changed. | |
SCHEDULING_MANUALLY_EXECUTED | A schedule has been executed manually. | |
SCHEDULING_MONITORING_DISABLED | Monitoring has been disabled on a data job. | |
SCHEDULING_MONITORING_ENABLED | Monitoring has been enabled on a data job. | |
JOB_SCHEDULING_CREATED | A data job has been assigned to a schedule. | |
JOB_SCHEDULING_EXECUTION_ORDER_CHANGED | The data job execution order within a schedule has been changed. | |
JOB_SCHEDULING_DELETED | A data job has been removed from a schedule. | |
DATA_POOL_VERSION_CREATED | A version was created for a data pool. | |
DATA_POOL_VERSION_DELETED | A version was deleted for a data pool. | |
DATA_POOL_VERSION_COPIED | A version was copied. |