Audit log

Request a full, exportable record of every change made in your Oleria workspace, covering user actions, integration changes, remediations, and other key events, for incident investigation and compliance audits. This is a JSON export, not a live screen in the Oleria UI - for an in-app view of submitted remediation and workflow actions, see Action Center.

Request the audit log

Request a copy of your audit log in JSON format by contacting support@oleria.com.

Events

The table below lists every action Oleria records in the audit log. Each row maps a human-readable event description to the action value that appears in the audit log JSON - useful when filtering or parsing an exported log.

Category	Audited event	Action name	Action source
Authentication	User logs into workspace	`LOG_IN`	`AUTHENTICATION`
Authentication	User logs out of workspace	`LOG_OUT`	`AUTHENTICATION`
User Management	Add a new user	`ADD_USER`	`USER_MANAGEMENT`
User Management	Update an existing user	`UPDATE_USER`	`USER_MANAGEMENT`
User Management	Resend an invite to a user	`RESEND_INVITE`	`USER_MANAGEMENT`
User Management	Delete an invite to a user	`DELETE_INVITE`	`USER_MANAGEMENT`
User Management	Delete an existing user	`DELETE_USER`	`USER_MANAGEMENT`
Integration	Add a new integration	`ADD_INTEGRATION`	`INTEGRATION_MANAGEMENT`
Integration	Delete an existing integration	`DELETE_INTEGRATION`	`INTEGRATION_MANAGEMENT`
Export	Export a table as CSV file	`EXPORT_CSV`	`DOWNLOAD_MANAGEMENT`
Ticketing	Add a ticketing system integration	`ADD_TICKETING_SYSTEM`	`TICKETING`
Ticketing	Delete a ticketing system integration	`DELETE_TICKETING_SYSTEM`	`TICKETING`
Remediation	Disable account, Revoke access	`CREATE_WORKFLOW_EXECUTION`	`WORKFLOW_AUTOMATION_FRAMEWORK`
Action Center	Undo action	`REVERT_WORKFLOW_EXECUTION`	`WORKFLOW_AUTOMATION_FRAMEWORK`

This audit log records every disable action under the Remediation category above, whether or not it appears in Action Center - the two track different things: this page logs that a change happened, Action Center tracks the workflow run itself.

Column	Description
Category	The area of the product where the action took place.
Audited event	A plain-language description of what happened.
Action name	The value of the `action` field in the audit log JSON. Use this when filtering exported logs.
Action source	The internal source component that generated the event. Corresponds to the `source` field in the event payload.

Event attributes

Every event in the audit log is a JSON object. The table below defines each field. The action and source fields together identify what happened and where. The actor fields identify who did it. The old and new fields capture what changed - they only appear on update-type events where a record was modified.

Attribute	Type	Description
`action`	string	The action that was performed. For a full list of logged activities, see the events table above.
`actor.id`	string	Unique ID of the user who performed the action.
`actor.email`	string	Email of the user who performed the action.
`message`	string	Describes the event in plain language.
`new`	object	Optional. Key-value pairs showing the value of the record after it was changed. Present on update events only.
`old`	object	Optional. Key-value pairs showing the value of the record before it was changed. Present on update events only.
`source`	string	The resource type or component that generated the event. Corresponds to the Action source column in the events table.
`status`	string	The result of the activity. Possible values: `SUCCESS`, `FAILURE`, `UNKNOWN_STATUS`.
`resourceType`	string	The type of resource affected by the activity.
`target`	string	The specific resource affected by the activity.
`tenant_id`	string	The workspace ID.
`timestamp`	string (date-time)	Date and time the activity occurred (UTC). For example, `2024-01-15T09:32:00Z`.
`eventId`	string	Unique ID (GUID) for the event. Useful for deduplication when processing log exports.

Example event

{
  "eventId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "action": "UPDATE_USER",
  "source": "USER_MANAGEMENT",
  "status": "SUCCESS",
  "timestamp": "2024-01-15T09:32:00Z",
  "actor": {
    "id": "usr_abc123",
    "email": "admin@example.com"
  },
  "target": "usr_xyz789",
  "resourceType": "USER",
  "message": "User role updated",
  "old": { "role": "Analyst" },
  "new": { "role": "Operator" },
  "tenant_id": "tenant_00001"
}

Contact us

For questions, contact us at support@oleria.com.

Getting Started

Posture

Governance

Administration

Support

Request the audit log

Events

Event attributes

Example event

Contact us

​Request the audit log

​Events

​Event attributes

​Example event

​Contact us

Request the audit log

Events

Event attributes

Example event

Contact us