Logged operations
We automatically capture an audit log any time a user changes any piece of data in your Tines tenant.
These audit logs are available to tenant admins via our API, and are typically drained to a log analysis or SIEM tool for further investigation.
For every operation available in the user interface and API, our system automatically and consistently captures a log.
| Operation | Description |
|---|---|
| ActionLogsClearance | An Action’s logs were cleared |
| ActionMemoryClearance | An Action’s memory was cleared |
| ActionMetricsChange | An Action’s time-saved/reporting setting was changed |
| ActionSizeChange | An actions size was changed |
| ActionsDisabledChange | Multiple Actions had their ‘disabled’ property changed |
| ActionsEventsDeletion | Multiple Actions’ events were cleared |
| ActionsMonitoringChange | Multiple Actions’ monitoring settings were changed |
| ActionsNameChange | Multiple Actions’ names were changed |
| ActionsOptionsChange | Multiple Actions’ options were changed |
| ActionsScheduleChange | Multiple Actions’ schedules were changed |
| AnalyticsCapture | An analytics event was captured |
| AnnotationContentChange | An annotation was edited |
| AnnotationSizeChange | An annotation was resized |
| ArchivedStoryDeleteAll | A team’s story trash was emptied |
| ArchivedStoryDeletion | An individual story was removed from a team’s story trash |
| AuthenticationTokenCreation | A new API key was created |
| AuthenticationTokenDeletion | An API key was deleted |
| BatchStoryArchive | A set of stories were moved to trash |
| CredentialDestruction | A credential was deleted |
| CredentialMovement | A credential was moved to a new team/folder |
| CredentialOauthTokenRefresh | An OAuth credential’s token was refreshed |
| CredentialReplacement | A credential was replaced on a story |
| CredentialSave | A credential was created or updated |
| CustomCertificateAuthoritySet | A custom certificate authority was set |
| EventDeletion | An event was deleted |
| ExampleStoryImport | A story was imported from the story library |
| FolderCreation | A folder was created |
| FolderDestruction | A folder was destroyed |
| FolderUpdate | A folder was updated |
| FormFieldAddition | A form field was added |
| FormFieldRemoval | A form field was removed |
| FormFieldReorder | A form field’s position was reordered |
| FormFieldUpdate | A form field was updated |
| FormUpdate | A form was updated |
| GroupExtraction | A group was extracted from a set of actions |
| GroupFlatten | A group was flattened to a set of actions |
| JobsQueuedDeletion | Currently enqueued jobs were cleared (for a self-hosted tenant) |
| JobsRetryingDeletion | Currently retrying jobs were cleared (for a self-hosted tenant) |
| LastEventReEmission | The most recent event was re-emitted |
| LinkChange | A link between actions was edited |
| Login | A user logged in |
| GlobalResourceCreation | A global resource was created |
| GlobalResourceDestruction | A global resource was deleted |
| GlobalResourceEdit | A global resource was edited |
| GlobalResourceMovement | A global resource was moved to a new team/folder |
| ResourceReplacement | A global resource was replaced on a story |
| RecordReportCreation | A Record report was created |
| RecordReportDeletion | A Record report was deleted |
| RecordReportElementColumnReorder | A Record report element column was reordered |
| RecordReportElementCreation | A Record report element was created |
| RecordReportElementDestruction | A Record report element was deleted |
| RecordReportElementUpdate | A Record report element was edited |
| RecordReportUpdate | A Record report was edited |
| RecordResultSetUpdate | A Record result set was updated |
| RecordTypeCreation | A Record type was created |
| RecordTypeDestruction | A Record type was deleted |
| RecordTypeUpdate | A Record type was updated |
| RecordWriterCreation | A Record writer was created |
| RecordWriterDestruction | A Record writer was deleted |
| RecordWriterUpdate | A Record writer was edited |
| SCIM/2.0/User/{operation} | A SCIM 2.0 operation (create, replace, update or destroy) on a User |
| SsoConfigurationDefaultSet | The default SSO configuration was set to Tines-powered |
| SsoConfigurationOidcSet | The default SSO configuration was set to OIDC |
| SsoConfigurationSamlSet | The default SSO configuration was set to SAML |
| StoryActionsAutoAlign | A set of actions were auto aligned |
| StoryActionsAutoLayout | A set of actions were auto laid-out |
| StoryActionsPositioning | A set of actions and annotations were repositioned |
| StoryArchive | A story was moved to trash |
| StoryCreation | A story was created |
| StoryDescriptionChange | A story’s description was changed |
| StoryDisabledChange | A story was disabled or enabled |
| StoryEventsDeletion | All of a story’s events were deleted |
| StoryImport | A story was imported |
| StoryItemsCreation | A set of actions/annotations were created |
| StoryItemsDestruction | A set of actions/annotations were destroyed |
| StoryItemsMovement | A set of actions/annotations were moved |
| StoryJobsClearance | A story’s scheduled jobs were cleared |
| StoryKeepEventsForChange | A story’s event retention settings were changed |
| StoryLockedChange | A story was locked or unlocked |
| StoryMovement | A story was moved |
| StoryNameChange | A story’s name was changed |
| StoryPriorityChange | A story’s priority was changed |
| StoryRecipientAddition | A monitoring recipient was added for a story |
| StoryRecipientRemoval | A monitoring recipient was removed for a story |
| StoryRecipientUpdate | A monitoring recipient was changed for a story |
| StoryReportingStatusChange | Reporting was enabled/disabled for a story |
| StoryRestore | A story was restored from the trash |
| StorySendToStoryChange | A story’s send-to-story settings were edited |
| StoryVersionCreate | A story version was created |
| StoryVersionDeletion | A story version was deleted |
| StoryVersionImport | A story version was imported |
| StoryVersionNameChange | A story’s version was renamed |
| TeamCaseAddCommentReaction | A reaction was added to a case comment |
| TeamCaseButtonCreation | An action (button) was added to a case |
| TeamCaseCommentCreation | A comment was added to a case |
| TeamCaseCommentUpdate | A comment was updated on a case |
| TeamCaseCreation | A case was created |
| TeamCaseFileAttach | A file or comment and file was attached to a case |
| TeamCaseRemoveCommentReaction | A reaction was removed from a comment on a case |
| TeamCaseSubscriberCreation | A subscriber was added to a case |
| TeamCaseSubscriberDeletion | A subscriber was removed from a case |
| TeamCaseTagsUpdate | A tag was added to or removed from a case |
| TeamCaseUpdate | A case was assigned, renamed, completed or its description updated |
| TeamCasesSavedViewCreation | A saved view was created for a teams cases |
| TeamCasesSavedViewDestruction | A saved view was deleted from a teams cases |
| TeamCaseWebhookUpdate | A case notification webhook was set or updated for the team |
| TeamCreation | A team was created |
| TeamDestruction | A team was destroyed |
| TeamMemberRemoval | A team member was removed |
| TeamMembersAddition | A team member was added |
| TeamUpdate | A team was updated |
| TemplateCreation | A template was created |
| TemplateDestruction | A template was deleted |
| TemplateUpdate | A template was updated |
| TenantConfigChange | A tenant’s config was changed |
| TenantFeatureFlagToggle | A feature flag was enabled/disabled |
| TenantPlanUpgradeRequest | A plan upgrade was requested |
| TestStoryCreation | Change control was enabled for a story |
| TestStoryDeletion | Change control was disabled for a story |
| UserDeletion | A user was deleted |
| UserEdit | A user was edited |
| UserReinvitation | A user’s invitation was resent |
| UsersInvitation | A user was invited |
Log format
Each log contains enriched user information, as well as metadata related to the operation carried out. Extremely sensitive information, for example credential values, are never included.
{
"created_at": "2022-10-04T19:03:18Z",
"id": 123456,
"inputs": {
"inputs": {
"teamId": 1772
}
},
"request_ip": "11.22.33.44",
"request_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36",
"tenant_id": 9,
"updated_at": "2022-10-04T19:03:18Z",
"user_email": "user@example.com",
"user_id": 9,
"user_name": "Example User",
"operation_name": "StoryCreation"
}