Audit log events and metadata
The Sigma Audit Log is a connection that provides metadata related to user-initiated events that occur within your Sigma organization.
This document details audit log event categories, event types, and entry metadata. For more information about audit logging with Sigma, see the following:
- Enable audit logging
- Access and explore audit logs
- Create an audit logs storage integration
- Export audit log data to cloud storage
Documentation memo
This document references the audit log with its default column settings and connection configurations. If settings and configurations were customized by an Admin user, column visibility and naming in your audit log may differ.
To confirm column visibility and identify the default columns defined in this document, refer to the Column tab in your audit log. If necessary, you can cross-reference your audit log's custom “friendly names” with cloud data warehouse (CDW) or database management system (DBMS) column IDs provided in the event metadata tables throughout this document.
Event categories
The audit log records user events in the following categories:
The WRITEBACK event category is part of a private beta audit log enhancement that's currently in development. Due to the nature of the audit log schema, additional metadata columns associated with the category are currently displayed in the table for all organizations, regardless of input table usage and private beta participation.
Event types and metadata
Base entry metadata (all entries)
All audit entries—regardless of event category or type—include the following base metadata:
Audit events reference
Select an event category to browse the available audit log events in that category.
Sigma Shared metadata reference
Select a table name to view the columns available in the SIGMA_SHARED
audit tables.
Updated 8 days ago