Audit log events and metadata

The Sigma Audit Log is a connection that provides metadata related to user-initiated events that occur within your Sigma organization.

This document details audit log event categories, event types, and entry metadata. For more information about audit logging with Sigma, see the following:

Documentation memo

This document references the audit log with its default column settings and connection configurations. If settings and configurations were customized by an Admin user, column visibility and naming in your audit log may differ.

To confirm column visibility and identify the default columns defined in this document, refer to the Column tab in your audit log. If necessary, you can cross-reference your audit log's custom “friendly names” with cloud data warehouse (CDW) or database management system (DBMS) column IDs provided in the event metadata tables throughout this document.

Event categories

The audit log records user events in the following categories:

🚩
The WRITEBACK event category is part of a private beta audit log enhancement that's currently in development. Due to the nature of the audit log schema, additional metadata columns associated with the category are currently displayed in the table for all organizations, regardless of input table usage and private beta participation.

Event types and metadata

Base entry metadata (all entries)

All audit entries—regardless of event category or type—include the following base metadata:

Audit events reference

Select an event category to browse the available audit log events in that category.

Sigma Shared metadata reference

Select a table name to view the columns available in the SIGMA_SHARED audit tables.