Skip to main content

Celonis Product Documentation

Audit Logs

Quick-Start

  • Audit the user activity on your team.

  • Export the audit logs to the document and share the audit logs.

  • It is possible to export Audit Logs via API:

    • How to guide via this URL - https://[Your Team]/swagger-ui/index.html?configUrl=/log/v3/api-docs/swagger-config (manually craft it and replace [Your Team] with corresponding team + cluster)

    • See also Application Keys.

Log UI Components

Starting from the top left of the UI, going to the right:

  1. Page title and info icon (The info icon explains essential information about the UI)

  2. Enable IP address tracking toggle - This feature will add the IP address in a separate column to the logs, and the IP address will be returned when a user changes. Note: celonis-service (SYSTEM) changes are not tracked

  3. Search - This feature allows you to search for keywords in the "Event" column

  4. Export as CSV - This allows the export of all log files. This CSV is not limited to the last 500 entries like the UI is.

  5. Delete audit logs older than.... - This feature allows the admin to set a time frame for when logs should be deleted so the admin can align to their GDPR needs. The default is "No Deletion"

  6. User ID - This shows the User UUID and email address of the user that made the change.

  7. Event - This is the event category name and informs at a high level what has been changed.

  8. Date - This is the date of the event

  9. Message - This detailed response to the change aligns with the event category name.

  10. IP Address - If enabled (see above), this will add a new column to the log UI that shows the IP address of the user who made the change. Note: This IP address is not the local desktop address. It is the service provider's IP address for the user.

  11. Port Number - This feature is only available by request and adds a new column to the audit logs showing the port name. It is recommended not to enable this feature as it always returns 443. However, this is available should customer requirements demand such data.

Log Event Details

Each event corresponds to a single application inside Celonis Execution Management System. For example, CONNECTION_CREATED originates from Process Automation.

This table maps each event to its origin and gives a brief explanation. Audit logs are formatted in standard JSON.

Important

To see all columns in the table, use the scroll bar at the bottom or hide/show columns using Filters.

Event Origin

Event Name

Explanation

Task Mining

TASK_MINING_NEW_CONFIGURATION_UPLOADED

A project configuration has been updated by uploading a new one in Task Mining.

TASK_MINING_CONFIGURATION_DOWNLOADED

A project configuration has been downloaded in Task Mining.

TASK_MINING_CONFIGURATION_UPDATED

A project configuration has been updated in Task Mining.

TASK_MINING_CONFIGURATION_CREATED

A project configuration has been created in Task Mining.

TASK_MINING_QUICKSTART_PROJECT_CREATED

A project has been created in Task Mining.

TASK_MINING_BLANK_PROJECT_CREATED

A project has been created in Task Mining.

TASK_MINING_PROJECT_DELETED

A project has been deleted in Task Mining.

TASK_MINING_PROJECT_CONNECTION_UPDATED

The connection to the Task Mining project has been updated.

TASK_MINING_DATA_PROCESSING_TRIGGER_MANUAL

The project data processing was changed to run only after a manual trigger by clicking on run.

TASK_MINING_DATA_PROCESSING_TRIGGER_ON_DATA_PUSH

The project data processing was changed to run only automatically after the Task Mining Clients sent new data.

TASK_MINING_DATA_PROCESSING_TRIGGER_SCHEDULED

The project data processing was changed to run only automatically based on the schedule.

Studio

STUDIO_PACKAGE_PUBLISHED

A Package has been published to Apps

STUDIO_PACKAGE_DELETED

A Package has been deleted from Studio and Apps.

STUDIO_PACKAGE_VERSION_LOADED

The package switched to a past version in Studio.

STUDIO_PACKAGE_INSTALLED

A package has been installed from the Marketplace.

STUDIO_PACKAGE_MOVED

A package has been moved from the original location.

STUDIO_NODE_RENAMED

An asset (type is provided inside the message: analysis, knowledge model, skill, view..) inside a package (package key is provided in the message) has been renamed.

STUDIO_NODE_DELETED

An asset inside a package has been deleted in Studio.

STUDIO_NODE_COPIED

An asset inside a package has been copied in Studio.

STUDIO_NODE_MOVED

An asset inside a package has been moved in Studio.

STUDIO_NODE_CREATED

An asset inside a package has been created in Studio.

STUDIO_NODE_UPDATED

An asset inside a package has been updated/changed in Studio.

The message will show the node name and related package, the node type, and the updated asset type. UUID's are also provided in the message.

STUDIO_PACKAGE_VARIABLE_CREATED

A package variable has been created in Studio.

STUDIO_PACKAGE_VARIABLE_DELETED

A package variable has been deleted in Studio.

STUDIO_PACKAGE_VARIABLE_CHANGED

A package variable has been changed in Studio.

ANALYSIS_EXPORT_AUDIT_LOG_EVENT

Allow CSV export of analysis components in Analysis settings, and the user exports data.

STUDIO_SPACE_CREATED

A Studio Space has been created.

STUDIO_SPACE_DELETED

A Studio Space has been deleted.

STUDIO_SPACE_UPDATED

A Studio Space has been updated.

Transformation Center

OBJECTIVE_KPI_CREATED

A KPI has been created in Transformation Center.

OBJECTIVE_KPI_UPDATED

A KPI has been updated in Transformation Center.

OBJECTIVE_KPI_DELETED

A KPI has been deleted in Transformation Center.

OBJECTIVE_CREATED

An Objective has been created in Transformation Center.

OBJECTIVE_UPDATED

An Objective has been updated in Transformation Center.

OBJECTIVE_DELETED

An Objective has been deleted in Transformation Center.

OBJECTIVE_INSTALLED

An Objective has been installed from AppStore in Transformation Center.

REPORTING_CREATED

A report is created that schedules an email to report values on specific KPIs

REPORTING_UPDATED

A report is updated that schedules an email for reporting values on specific KPIs

Machine Learning

ML_NOTEBOOK_CREATED

A new machine learning workbench has been created.

ML_NOTEBOOK_UPDATED

An existing machine learning workbench has been updated.

ML_NOTEBOOK_DELETED

A machine learning workbench has been deleted.

ML_SCHEDULING_CREATED

A new schedule has been created to execute a machine-learning notebook.

ML_SCHEDULING_UPDATED

A scheduled execution of a machine learning notebook has been updated.

ML_SCHEDULING_DELETED

A scheduled execution of a machine learning notebook has been removed.

ML_WORKSPACE_CREATED

A new machine-learning workspace was created.

ML_WORKSPACE_UPDATED

A machine learning workspace updated.

ML_WORKSPACE_DELETED

A machine learning workspace was deleted.

ML_FLOW_ENABLED

The feature is set to enable for the creation of an ML Flow instance (only an alpha feature, not production ready)

ML_FLOW_DISABLED

The feature is set to disable for the creation of an ML Flow instance (only an alpha feature, not production ready)

ML_IMAGE_ENABLED

An ML Image is enabled.

ML_IMAGE_DISABLED

An ML Image is disabled.

ML_KUBERNETES_ENABLED

Team is moved to Kubernetes infra

ML_PLAN_CHANGED

The dedicated plan changed.

Action Engine

ROUTING_RULE_CREATED

A new routing rule has been created.

ROUTING_RULE_UPDATED

An existing routing rule has been updated.

ROUTING_RULE_DELETED

A routing rule has been deleted.

ROUTING_RULE_DUPLICATED

An existing routing rule has been duplicated.

SKILL_CREATED

A new skill has been created.

SKILL_UPDATED

An existing skill has been updated.

SKILL_DELETED

A skill has been deleted.

SKILL_INSTALLED

A new skill has been installed.

SKILL_DUPLICATED

An existing skill has been duplicated.

EXPORT_PARQUET_DISCLAIMER_AGREEMENT_SIGNED

The agreement to export data to parquet files has been given (required for Action Engine Connector).

EXPORT_PARQUET_DISCLAIMER_AGREEMENT_DELETED

The agreement to allow exporting data to parquet files has been withdrawn.

Process Automation

WORKFLOW_CREATED

A new workflow has been created.

WORKFLOW_RENAMED

A workflow has been renamed.

WORKFLOW_DELETED

A workflow has been deleted.

CONNECTION_CREATED

A new connection has been created.

CONNECTION_UPDATED

An existing connection has been updated.

CONNECTION_DELETED

A connection has been deleted.

SKILL_CREATED

A skill has been created.

SKILL_RENAMED

A skill has been renamed.

SKILL_DELETED

A skill has been deleted.

AGENT_REGISTERED

An agent has been registered.

Team Settings

GROUP_CREATED

A group was created

GROUP_UPDATED

A group was updated

GROUP_DELETED

A group was deleted

USER_ADOPTION_PREFERENCE_CHANGED

Note: Only if available in admin and settings. Feature toggled on [enabled] and off [disabled]

USER_JOIN_GROUP,

A user joined a group or was added to it.

USER_LEFT_GROUP,

A user quit a group or was removed from it.

USER_CHANGE_PASSWORD,

A user changed their password.

USER_GENERATE_API_KEY,

A user-generated API key.

USER_DELETE_API_KEY

A user deleted an API key.

USER_TEAM_MEMBERSHIP_ACTIVATED

A user activated his team membership.

USER_TEAM_MEMBERSHIP_ACTIVATION_LINK_ GENERATED

A membership link has been generated, allowing the user to access the team.

ADMIN USER INVITED

An Admin gets invited from the backend into the team.

TEAM_UPDATED

Team-specific changes were applied, like changes to the team's privacy.

TEAM_DELETED

The team was deleted.

TEAM_MEMBERSHIP_UPDATED

A new role was applied to a user.

The user was locked (Inactive)

The user was unlocked (Active)

TEAM_MEMBERSHIP_DELETED

A user was removed from a team.

TEAM_MEMBERSHIP_CREATED

A user was invited to the team.

TEAM_MEMBERSHIP_WITH_NO_CONFIRMATION_ CREATED

A user was invited with no confirmation.

UPLINK_CREATED

An uplink connection was created.

UPLINK_UPDATED

An uplink connection was updated.

UPLINK_DELETED

An uplink connection was deleted.

TWO_FACTOR_UPDATED

A user updated two factor: enabled or disabled.

TWO_FACTOR_UPDATED

A user updated two-factor channel: SMS or EMAIL.

LOGIN_HISTORY_PREFERENCES_UPDATED

A user-enabled or disabled Login History

A user enabled or disabled Days to delete with qty of days stated

LOGIN_HISTORY_CSV_DOWNLOADED

A user downloaded the Login History CSV.

LOGIN_HISTORY_DELETED

Login history delete option was selected when turning off the login history.

AUDIT_LOG_PREFERENCES_UPDATED

A user enabled or disabled the logging of IP address.

A user enabled or disabled Days to delete with qty of days stated

AUDIT_LOG_CSV_DOWNLOADED

A user downloaded the Audit Log CSV.

APPLICATION_KEY_CREATED

A user created a new application key.

APPLICATION_KEY_DELETED

A user deleted an application key.

APPLICATION_KEY_UPDATED

The application key was updated.

SSO_PROVIDER_DELETED

A user deleted the SSO provider.

SSO_PROVIDER_CREATED

A user created the SSO provider.

SSO_PROVIDER_UPDATED

An admin has changed the SSO settings.

SSO_PROVIDER_TOGGLED

SSO provider changed

OPEN_SIGNUP_UPDATED

A user enabled or disabled Open Sign up and the default group name.

PERMISSIONS_UPDATE

A user has updated EMS permissions. The message will show the subject description, the subject type, and the object description before explaining the new vs. old permission.

IP_RESTRICTIONS_RESET

IP restrictions reset

IP_RESTRICTIONS_SET

IP restrictions set

MEMBER_LOCK_POLICY_UPDATED

Locking policy enabled and or updated.

Locking policy user notification enabled and or updated.

Process Analytics

PROCESS_CREATED

A user created a Workspace.

PROCESS_UPDATED

A user updated a Workspace.

PROCESS_DELETED

A user deleted a Workspace.

ANALYSIS_CREATED

A user created an Analysis.

ANALYSIS_UPDATED

A user updated an Analysis.

ANALYSIS_DELETED

A user deleted an Analysis.

APP_INSTALLED

A user installed an App from the Marketplace.

Data Integration

ANALYSIS_EXPORT_AUDIT_LOG_EVENT

Data integration audit log has been exported.

DATA_POOL_CONNECTION_CONFIGURATION_UPDATED

The data pool connection was updated.

DATA_POOL_CREATED

A data pool has been created.

DATA_POOL_UPDATED

A data pool has been renamed.

DATA_POOL_DELETED

A data pool has been deleted.

DATA_POOL_EXPORTED

A data pool has been exported.

DATA_MODEL_CREATED

A data model has been created.

DATA_MODEL_UPDATED

A data model has been renamed.

DATA_MODEL_DELETED

A data model has been deleted.

PROCESS_INSTALLED

A process has been installed from the Marketplace.

DATA_JOB_CREATED

A data job has been created.

DATA_JOB_DELETED

A data job has been deleted.

DATA_SOURCE_CREATED

A data connection has been created.

DATA_SOURCE_DELETED

A data connection has been deleted.

Extensive Data Integration Audit Logs

Feature Availability

This feature is currently not available by default for all teams. Please reach out to the Service Desk if you want to use the feature that is not enabled.

For customers that have the extensive audit logging for Data Integration enabled, the following events are captured as well:

Event Origin

Event Name

Explanation

Data Integration

DATA_POOL_COPIED

A data pool has been copied.

DATA_MODEL_PERMISSION_TABLE_APPLIED

A data model permission table has been applied.

DATA_MODEL_PERMISSION_TABLE_DELETED

A data model permission table has been deleted.

DATA_MODEL_PERMISSION_ASSIGNMENT_CREATED

A manual data permission assignment rule has been created.

DATA_MODEL_PERMISSION_ASSIGNMENT_DELETED

A manual data permission assignment rule has been deleted.

DATA_MODEL_PERMISSION_ASSIGNMENT_UPDATED

A manual data permission assignment rule has been changed.

DATA_MODEL_TABLES_CREATED

Table(s) have been added to the data model.

DATA_MODEL_TABLE_DELETED

A data model table has been deleted.

DATA_MODEL_FOREIGN_KEY_UPDATED

A foreign key in the data model has been changed.

DATA_MODEL_FOREIGN_KEY_DELETED

A foreign key in the data model has been deleted.

DATA_MODEL_FOREIGN_KEY_CREATED

A foreign key in the data model has been created.

DATA_MODEL_ACTIVITY_OR_CASE_TABLE_CHANGED

The data model activity table or case table configuration changed.

DATA_MODEL_MANUAL_LOAD_STARTED

A manual data model load has been triggered.

DATA_MODEL_LOAD_MANUALLY_CANCELED

A data model load has been canceled manually.

DATA_MODEL_CUSTOM_CALENDAR_SAVED

A custom calendar has been saved for a data model.

DATA_MODEL_CUSTOM_CALENDAR_ENABLED

A custom calendar has been enabled for a data model.

DATA_MODEL_FACTORY_CALENDAR_SAVED

A factory calendar has been saved for a data model.

DATA_MODEL_FACTORY_CALENDAR_ENABLED

A factory calendar has been enabled for a data model.

DATA_MODEL_CALENDAR_DISABLED

The calendar option for a data model got enabled.

DATA_MODEL_SIGNAL_LINK_CREATED

A signal link has been created.

DATA_MODEL_NAME_MAPPINGS_LOADED

A name mapping has been loaded.

DATA_MODEL_NAME_MAPPINGS_DELETED

A name mapping has been deleted.

DATA_MODEL_DUPLICATED

A data model has been duplicated.

DATA_MODEL_PERMISSION_ENABLED

The data permissions have been enabled for one data model.

DATA_MODEL_PERMISSION_DISABLED

The data permissions have been disabled for one data model.

DATA_JOB_DUPLICATED

A data job has been duplicated.

DATA_JOB_COPIED

A data job has been copied

DATA_JOB_UPDATED

A data job got updated, e.g. renamed.

DATA_JOB_MANUALLY_CANCELED

A data job execution has been canceled manually.

DATA_JOB_MANUALLY_EXECUTED

A data job execution has been triggered manually.

DATA_JOB_ALERT_UPDATED

A data job alert was updated

DATA_JOB_ALERT_ENABLED

A data job alert was enabled to trigger on events such as failures, successes, skips and execution time.

DATA_JOB_ALERT_DISABLED

A data job alert was deleted

DATA_SOURCE_UPDATED

A data connection got updated, e.g. renamed.

DATA_SOURCE_DUPLICATED

A data connection has been duplicated.

FILE_UPLOAD_CREATED

A file upload took place.

FILE_UPLOAD_HISTORY_ENTRY_DELETED

A history entry for a former file upload got deleted.

TASK_CREATED

A task, i.e., transformation or extraction, has been created.

TASK_DELETED

A task, i.e., transformation or extraction, has been deleted.

TASK_DISABLED

A task, i.e., transformation or extraction, has been disabled.

TASK_ENABLED

A task, i.e., transformation or extraction, has been enabled.

TASK_ORDER_CHANGED

The task order, i.e., the order of transformations and extractions, has been changed.

TASK_NAME_OR_DESCRIPTION_UPDATED

A task's name or description has been changed, i.e., transformation or extraction.

EXTRACTION_CONFIGURATIONS_UPDATED

An extraction configuration has been changed.

TRANSFORMATION_CODE_CHANGED

A transformation statement (SQL code) has been changed.

PARAMETER_CREATED

A parameter has been created.

PARAMETER_DELETED

A parameter has been deleted.

PARAMETER_UPDATED

A parameter got updated.

SCHEDULING_CREATED

A schedule has been created.

SCHEDULING_RENAMED

A schedule has been renamed.

SCHEDULING_DELETED

A schedule has been deleted.

SCHEDULING_ENABLED

A schedule has been enabled.

SCHEDULING_DISABLED

A schedule has been disabled.

SCHEDULING_MODE_CHANGED

A schedule' mode (Full vs Delta) has been changed.

SCHEDULING_CANCELLED

A schedule has been canceled manually.

SCHEDULING_FREQUENCY_CHANGED

A schedule's frequency has been changed.

SCHEDULING_MANUALLY_EXECUTED

A schedule has been executed manually.

SCHEDULING_MONITORING_DISABLED

Monitoring has been disabled on a data job.

SCHEDULING_MONITORING_ENABLED

Monitoring has been enabled on a data job.

JOB_SCHEDULING_CREATED

A data job has been assigned to a schedule.

JOB_SCHEDULING_EXECUTION_ORDER_CHANGED

The data job execution order within a schedule has been changed.

JOB_SCHEDULING_DELETED

A data job has been removed from a schedule.

DATA_POOL_VERSION_CREATED

A version was created for a data pool.

DATA_POOL_VERSION_DELETED

A version was deleted for a data pool.

DATA_POOL_VERSION_COPIED

A version was copied.