Audit log events and metadata
The Sigma Audit Log is a connection that provides metadata related to user-initiated events that occur within your Sigma organization.
This document details audit log event categories, event types, and entry metadata. For more information about audit logging with Sigma, see the following:
- Enable or disable audit logging
- Access and explore audit logs
- Create an audit logs storage integration
- Export audit log data to cloud storage
Audit log events are not intended to be compared with usage data. Audit logs are designed for security, compliance, and governance use cases and provide a detailed, immutable record of who did what and when in your Sigma organization. Usage data contains aggregate data about workbook queries performed in your Sigma organization and is not intended for auditing purposes.
Documentation memo
This document references the audit log with its default column settings and connection configurations. If settings and configurations were customized by an Admin user, column visibility and naming in your audit log may differ.
To confirm column visibility and identify the default columns defined in this document, refer to the Column tab in your audit log. If necessary, you can cross-reference your audit log’s custom “friendly names” with cloud data warehouse (CDW) or database management system (DBMS) column IDs provided in the event metadata tables throughout this document.
Event categories
The audit log records user events in the following categories:
| Category ↑ | Description |
|---|---|
| ACCESS_SIGMA | User access and configurations in the Admin > Authentication page |
| ACCOUNT_TYPES | Admin interactions with account type configurations and member assignments |
| AI_CONVERSATIONS | User interactions with Sigma Assistant, Sigma agents, and warehouse agents through chat, automated actions, and more. |
| AI_SETTINGS | Admin configuration of AI providers and data sources used by Assistant |
| API_ACTIONS | API calls made on behalf of a user or automation as part of a Call API action in Sigma. Distinct from direct calls to Sigma's public API. |
| AUDIT_LOGS | Audit log enablement and audit log storage integration management |
| CONNECTIONS | Admin interactions with the CDW or DBMS connection configurations |
| EXPORTS | User interactions with on-demand export functionality |
| INPUT_TABLES | User interactions with input tables |
| MATERIALIZATION | User interactions with materializations |
| MCP | Agent interactions with configured MCP connectors, and management of MCP connectors |
| OBJECT_INTERACTIONS | User interactions with workbooks, data models, datasets, and workspaces |
| PERMISSIONS | User interactions with permissions grants on folders and documents |
| PUBLIC_API | User interactions with Sigma's API endpoints |
| QUERY_EXECUTIONS | User interactions that trigger queries to the CDW |
| SCHEDULES | User interactions with scheduled export functionality |
| STORED_PROCEDURES | Stored procedure executions |
| TEAMS | Admin interactions with team settings and member assignments |
| TENANTS | Admin interactions with deployment settings for tenant organizations. |
| USER_ACCOUNTS | Admin interactions with member accounts and user invitations |
Event types and metadata
Base entry metadata (all entries)
All audit entries—regardless of event category or type—include the following base metadata:
| Column name (default "friendly name") ↑ | Column ID (CDW/DBMS column ID) | Description |
|---|---|---|
| Cloud Provider | CLOUD_PROVIDER | Cloud service provider for your Sigma instance |
| Event Category | EVENT_CATEGORY | Event request category (primary event classification) |
| Event Status | EVENT_STATUS | Event response status |
| Event Status Reason Code | EVENT_STATUS_REASON_CODE | Reason code for the event response. Provided for select events when Event Status = SUCCESS, and provided for all events when Event Status = FAILURE. |
| Event Type | EVENT_TYPE | Event request type (secondary event classification) |
| Impersonating User Organization Id | IMPERSONATING_USER_ORGANIZATION_ID | Organization ID of the actor when using impersonation |
| Impersonation User Email | IMPERSONATION_USER_EMAIL | Email assigned to the impersonated user account |
| Impersonation User Id | IMPERSONATION_USER_ID | System-generated ID associated with the impersonated user account |
| Organization Id | ORGANIZATION_ID | UUID associated with your Sigma instance |
| Request Id | REQUEST_ID | UUID associated with the event request |
| Request time | REQUEST_TIME | Date and time of the event request in UTC |
| Schema Version | SCHEMA_VERSION | Database schema model version |
| Sigma Url | SIGMA_URL | URL of the application page where the event request occurred |
| User Agent | USER_AGENT | Software and browser details associated with the event request |
| User Email | USER_EMAIL | Email assigned to the user account responsible for the event request |
| User Id | USER_ID | System-generated ID associated with the user account responsible for the event request |
| User Ip | USER_IP | IP address associated with the device on which the event request occurred |
Audit events reference
Select an event category to browse the available audit log events in that category, along with the metadata columns available for each.
Audit events
| Event category ↑ | Event type | Event status | Entry trigger | Additional metadata columns | Notes |
|---|---|---|---|---|---|
| ACCESS_SIGMA | LOGIN | SUCCESS | Successful SAML authentication or OAuth authorization → successful login | Auth Type = SamlLogin or OAuthLogin | Applicable when SAML or OAuth is enabled |
| ACCESS_SIGMA | PASSWORD_RESET | FAILURE | Failed password reset request using Forgot Password feature in sign-in page → password reset email failed to send | Auth Type = PasswordResetRequest, Target User Ids = a list of user ids whose password are reset | |
| ACCESS_SIGMA | IMPERSONATE | SUCCESS | Admins impersonate other non-admins by clicking the 'Impersonate' button when viewing their profile → successful impersonate | Auth Type = ImpersonationLogin, Impersonation User ID | |
| ACCESS_SIGMA | PASSWORD_RESET | FAILURE | New password submitted through page linked in password reset email → failed password reset | Auth Type = PasswordReset | |
| ACCESS_SIGMA | NEW_USER_SIGNUP | SUCCESS | New user registration submitted through page linked in user invite email → successful login | Auth Type = PasswordLogin, SamlLogin, OAuthLogin | |
| ACCESS_SIGMA | LOGIN | SUCCESS | Valid email and password entered in sign-in page → successful login | Auth Type = PasswordLogin | Applicable when password authentication is enabled and 2FA is disabled |
| ACCESS_SIGMA | IMPERSONATE | FAILURE | Admins impersonate other non-admins by clicking the 'Impersonate' button when viewing their profile → failed impersonate | Auth Type = ImpersonationLogin, Impersonation User ID | |
| ACCESS_SIGMA | LOGIN | SUCCESS | 2FA code entered and verified → successful login | Auth Type = PasswordLoginMfaVerify | Applicable when password authentication and 2FA are both enabled |
| ACCESS_SIGMA | LOGIN | FAILURE | Invalid email or password entered in sign-in page → failed login | Auth Type = PasswordLogin | Applicable when password authentication is enabled and 2FA is enabled or disabled |
| ACCESS_SIGMA | PASSWORD_UPDATE | FAILURE | New password submitted through Change Password modal in Your Profile > Details page → failed password update | Auth Type = PasswordUpdate | |
| ACCESS_SIGMA | NEW_USER_SIGNUP | FAILURE | New user registration submitted through page linked in user invite email → failed login | Auth Type = PasswordLogin, SamlLogin, OAuthLogin | Failed logins using SAML or OAuth may be logged as the LOGIN event type |
| ACCESS_SIGMA | PASSWORD_RESET | SUCCESS | New password submitted through page linked in password reset email → successful password reset | Auth Type = PasswordReset | |
| ACCESS_SIGMA | LOGIN | SUCCESS | Valid email and password entered in sign-in page → 2FA email successfully sent | Auth Type = PasswordLoginMfaTriggered | Applicable when password authentication and 2FA are both enabled |
| ACCESS_SIGMA | PASSWORD_UPDATE | SUCCESS | New password submitted through Change Password modal in Your Profile > Details page → successful password update | Auth Type = PasswordUpdate | |
| ACCESS_SIGMA | LOGIN | FAILURE | Failed SAML authentication or OAuth authorization → failed login | Auth Type = SamlLogin, OAuthLogin | Applicable when SAML or OAuth is enabled |
| ACCESS_SIGMA | PASSWORD_RESET | SUCCESS | Successful password reset request using Forgot Password feature in sign-in page | Auth Type = PasswordResetRequest, Target User Ids = a list of user ids whose password are reset | |
| ACCESS_SIGMA | LOGIN | FAILURE | 2FA code entered but not verified → failed login | Auth Type = PasswordLoginMfaVerify | Applicable when password authentication and 2FA are both enabled |
| ACCOUNT_TYPES | ACCOUNT_TYPE_UPDATED | FAILURE | Account type permissions edited in Administration > Account Types > {account_name} page → failed account type update | Account Type Id, Features Enabled, Features Disabled | |
| ACCOUNT_TYPES | ACCOUNT_TYPE_DELETED | FAILURE | Delete selected in account type action menu in Administration > Account Types page → failed account type deletion | Account Type Id, Delegate Account Type Id | |
| ACCOUNT_TYPES | ACCOUNT_TYPE_CREATED | FAILURE | New account type configured in Administration > Account Types > New Account Type page → failed account type creation | Features Enabled, Features Disabled |
Event metadata
| Event category ↑ | Column friendly name | Column ID | Description | Notes |
|---|---|---|---|---|
| ACCESS_SIGMA | Auth Type | AUTH_TYPE | Type of authentication or authorization request associated with the event | |
| ACCESS_SIGMA | Target User Ids | TARGET_USER_IDS | System-generated IDs associated with affected user accounts | |
| ACCOUNT_TYPES | Delegate Account Type Id | DELEGATE_ACCOUNT_TYPE_ID | New UUID associated with the account type | |
| ACCOUNT_TYPES | Features Enabled | FEATURES_ENABLED | Permissions included in the account type | |
| ACCOUNT_TYPES | Features Disabled | FEATURES_DISABLED | Permissions excluded from the account type | |
| ACCOUNT_TYPES | Account Type Id | ACCOUNT_TYPE_ID | UUID associated with the account type | |
| AI_CONVERSATIONS | Conversation Id | CONVERSATION_ID | UUID associated with the AI conversation | |
| AI_CONVERSATIONS | Conversation Turn Id | CONVERSATION_TURN_ID | UUID associated with a single turn in the conversation | Uniquely identifies the user message |
| AI_CONVERSATIONS | Conversation Context | CONVERSATION_CONTEXT | Where in the product the conversation happened | |
| AI_CONVERSATIONS | Conversation Agent | CONVERSATION_AGENT | Which agent the conversation was with | |
| AI_CONVERSATIONS | Conversation Owner Id | CONVERSATION_OWNER_ID | System-generated ID associated with the user account that owns the conversation | |
| AI_CONVERSATIONS | Source Conversation Id | SOURCE_CONVERSATION_ID | UUID of the conversation this conversation was forked from | |
| AI_CONVERSATIONS | Fork Turn Id | FORK_TURN_ID | UUID of the turn in the source conversation the fork started from | |
| AI_SETTINGS | AI Restrict to Configured Sources | AI_RESTRICT_TO_CONFIGURED_SOURCES | Whether Sigma Assistant is limited to search only the sources admins selected by default | |
| AI_SETTINGS | AI Source Updates | AI_SOURCE_UPDATES | The sources added, changed, or removed from the specific sources configured for Assistant, each with its inodeID and the change made. | |
| AI_SETTINGS | AI Provider Config Type | AI_PROVIDER_CONFIG_TYPE | Which AI provider was configured: openai, azure_openai, warehouse, external_embeddings, gemini, anthropic, bedrock, or warehouse_embeddings | |
| AI_SETTINGS | AI Provider Connection Id | AI_PROVIDER_CONNECTION_ID | The ID of the warehouse connection used (warehouse-hosted models only) | |
| API_ACTIONS | Host | HOST | Hostname the API action request was sent to | |
| API_ACTIONS | Status Code | STATUS_CODE | HTTP status code returned by the API action call | |
| API_ACTIONS | Auth Inode Id | AUTH_INODE_ID | Inode ID of the stored credential used to authenticate the call |
Sigma Shared metadata reference
Select a table name to view the columns available in the SIGMA_SHARED audit tables.
The DOCUMENT_REFERENCES table is only populated for tenant organizations with audit logging enabled.
| Table name ↑ | Column name | Type | Description |
|---|---|---|---|
| COMMENTS | Conversation Uuid | Text | The UUID of the conversation |
| COMMENTS | Organization Uuid | Text | The UUID of the organization |
| COMMENTS | Inode Uuid | Text | The UUID of the inode |
| COMMENTS | Conversation Type | Text | The type of element the conversation happens on (workbook or element) |
| COMMENTS | Element Id | Text | The ID of the element |
| COMMENTS | Conversation Is Resolved | Logical | Boolean value describing if the conversation has been resolved |
| COMMENTS | Conversation Created at Utc | Date | The timestamp in UTC when the conversation was created |
| COMMENTS | Conversation Updated at Utc | Date | The timestamp in UTC when the conversation was last updated |
| COMMENTS | Conversation Transcript | Text | The transcript of the conversation in the comments section of the workbook |
| COMMENTS | Users Mentioned List | Text | A comma-separated list of users mentioned in a comment |
| COMMENTS | Num Users Mentioned | Number | The number of users mentioned in this conversation |
| COMMENTS | Comment Attachments List | Array | An array of the attachments uploaded in the comments section of the workbook |
| COMMENTS | Num Attachments | Number | The number of attachments in this conversation |
| COMMENTS | Num Comments | Number | The number of comments in this conversation |
| CONNECTIONS | Connection Uuid | Text | Universally unique identifier associated with the connection |
| CONNECTIONS | Connection Type | Text | Warehouse associated with connection |
| CONNECTIONS | Connection Name | Text | The name of the connection |
| CONNECTIONS | Organization Uuid | Text | Universally unique identifier of the organization associated with this connection |
| CONNECTIONS | Connection Created at Utc | Date | The timestamp in UTC when this connection was created |
| CONNECTIONS | Connection Updated at Utc | Date | The timestamp in UTC when this connection was last updated |