Audit logs

Logged operations

We automatically capture an audit log any time a user changes any piece of data in your Tines tenant.

These audit logs are available to tenant admins via our API, and are typically drained to a log analysis or SIEM tool for further investigation.

For every operation available in the user interface and API, our system automatically and consistently captures a log.

Operation Description
ActionLogsClearance An Action’s logs were cleared
ActionMemoryClearance An Action’s memory was cleared
ActionMetricsChange An Action’s time-saved/reporting setting was changed
ActionSizeChange An actions size was changed
ActionsDisabledChange Multiple Actions had their ‘disabled’ property changed
ActionsEventsDeletion Multiple Actions’ events were cleared
ActionsMonitoringChange Multiple Actions’ monitoring settings were changed
ActionsNameChange Multiple Actions’ names were changed
ActionsOptionsChange Multiple Actions’ options were changed
ActionsScheduleChange Multiple Actions’ schedules were changed
AnalyticsCapture An analytics event was captured
AnnotationContentChange An annotation was edited
AnnotationSizeChange An annotation was resized
ArchivedStoryDeleteAll A team’s story trash was emptied
ArchivedStoryDeletion An individual story was removed from a team’s story trash
AuthenticationTokenCreation A new API key was created
AuthenticationTokenDeletion An API key was deleted
BatchStoryArchive A set of stories were moved to trash
CredentialDestruction A credential was deleted
CredentialMovement A credential was moved to a new team/folder
CredentialOauthTokenRefresh An OAuth credential’s token was refreshed
CredentialReplacement A credential was replaced on a story
CredentialSave A credential was created or updated
CustomCertificateAuthoritySet A custom certificate authority was set
EventDeletion An event was deleted
ExampleStoryImport A story was imported from the story library
FolderCreation A folder was created
FolderDestruction A folder was destroyed
FolderUpdate A folder was updated
FormFieldAddition A form field was added
FormFieldRemoval A form field was removed
FormFieldReorder A form field’s position was reordered
FormFieldUpdate A form field was updated
FormUpdate A form was updated
GroupExtraction A group was extracted from a set of actions
GroupFlatten A group was flattened to a set of actions
JobsQueuedDeletion Currently enqueued jobs were cleared (for a self-hosted tenant)
JobsRetryingDeletion Currently retrying jobs were cleared (for a self-hosted tenant)
LastEventReEmission The most recent event was re-emitted
LinkChange A link between actions was edited
Login A user logged in
GlobalResourceCreation A global resource was created
GlobalResourceDestruction A global resource was deleted
GlobalResourceEdit A global resource was edited
GlobalResourceMovement A global resource was moved to a new team/folder
ResourceReplacement A global resource was replaced on a story
RecordReportCreation A Record report was created
RecordReportDeletion A Record report was deleted
RecordReportElementColumnReorder A Record report element column was reordered
RecordReportElementCreation A Record report element was created
RecordReportElementDestruction A Record report element was deleted
RecordReportElementUpdate A Record report element was edited
RecordReportUpdate A Record report was edited
RecordResultSetUpdate A Record result set was updated
RecordTypeCreation A Record type was created
RecordTypeDestruction A Record type was deleted
RecordTypeUpdate A Record type was updated
RecordWriterCreation A Record writer was created
RecordWriterDestruction A Record writer was deleted
RecordWriterUpdate A Record writer was edited
SCIM/2.0/User/{operation} A SCIM 2.0 operation (create, replace, update or destroy) on a User
SsoConfigurationDefaultSet The default SSO configuration was set to Tines-powered
SsoConfigurationOidcSet The default SSO configuration was set to OIDC
SsoConfigurationSamlSet The default SSO configuration was set to SAML
StoryActionsAutoAlign A set of actions were auto aligned
StoryActionsAutoLayout A set of actions were auto laid-out
StoryActionsPositioning A set of actions and annotations were repositioned
StoryArchive A story was moved to trash
StoryCreation A story was created
StoryDescriptionChange A story’s description was changed
StoryDisabledChange A story was disabled or enabled
StoryEventsDeletion All of a story’s events were deleted
StoryImport A story was imported
StoryItemsCreation A set of actions/annotations were created
StoryItemsDestruction A set of actions/annotations were destroyed
StoryItemsMovement A set of actions/annotations were moved
StoryJobsClearance A story’s scheduled jobs were cleared
StoryKeepEventsForChange A story’s event retention settings were changed
StoryLockedChange A story was locked or unlocked
StoryMovement A story was moved
StoryNameChange A story’s name was changed
StoryPriorityChange A story’s priority was changed
StoryRecipientAddition A monitoring recipient was added for a story
StoryRecipientRemoval A monitoring recipient was removed for a story
StoryRecipientUpdate A monitoring recipient was changed for a story
StoryReportingStatusChange Reporting was enabled/disabled for a story
StoryRestore A story was restored from the trash
StorySendToStoryChange A story’s send-to-story settings were edited
StoryVersionCreate A story version was created
StoryVersionDeletion A story version was deleted
StoryVersionImport A story version was imported
StoryVersionNameChange A story’s version was renamed
TeamCaseAddCommentReaction A reaction was added to a case comment
TeamCaseButtonCreation An action (button) was added to a case
TeamCaseCommentCreation A comment was added to a case
TeamCaseCommentUpdate A comment was updated on a case
TeamCaseCreation A case was created
TeamCaseFileAttach A file or comment and file was attached to a case
TeamCaseRemoveCommentReaction A reaction was removed from a comment on a case
TeamCaseSubscriberCreation A subscriber was added to a case
TeamCaseSubscriberDeletion A subscriber was removed from a case
TeamCaseTagsUpdate A tag was added to or removed from a case
TeamCaseUpdate A case was assigned, renamed, completed or its description updated
TeamCasesSavedViewCreation A saved view was created for a teams cases
TeamCasesSavedViewDestruction A saved view was deleted from a teams cases
TeamCaseWebhookUpdate A case notification webhook was set or updated for the team
TeamCreation A team was created
TeamDestruction A team was destroyed
TeamMemberRemoval A team member was removed
TeamMembersAddition A team member was added
TeamUpdate A team was updated
TemplateCreation A template was created
TemplateDestruction A template was deleted
TemplateUpdate A template was updated
TenantConfigChange A tenant’s config was changed
TenantFeatureFlagToggle A feature flag was enabled/disabled
TenantPlanUpgradeRequest A plan upgrade was requested
TestStoryCreation Change control was enabled for a story
TestStoryDeletion Change control was disabled for a story
UserDeletion A user was deleted
UserEdit A user was edited
UserReinvitation A user’s invitation was resent
UsersInvitation A user was invited

Log format

Each log contains enriched user information, as well as metadata related to the operation carried out. Extremely sensitive information, for example credential values, are never included.

{
  "created_at": "2022-10-04T19:03:18Z",
  "id": 123456,
  "inputs": {
    "inputs": {
      "teamId": 1772
    }
  },
  "request_ip": "11.22.33.44",
  "request_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36",
  "tenant_id": 9,
  "updated_at": "2022-10-04T19:03:18Z",
  "user_email": "user@example.com",
  "user_id": 9,
  "user_name": "Example User",
  "operation_name": "StoryCreation"
}
Was this helpful?