Audit logs

Logged operations

We automatically capture an audit log any time a user changes any piece of data in your Tines tenant.

These audit logs are available to tenant admins via our API, and are typically drained to a log analysis or SIEM tool for further investigation.

For every operation available in the user interface and API, our system automatically and consistently captures a log.

Operation Description
ActionLogsClearance An Action’s logs were cleared
ActionMemoryClearance An Action’s memory was cleared
ActionMetricsChange An Action’s time-saved/reporting setting was changed
ActionSizeChange An actions size was changed
ActionsDisabledChange Multiple Actions had their ‘disabled’ property changed
ActionsEventsDeletion Multiple Actions’ events were cleared
ActionsMonitoringChange Multiple Actions’ monitoring settings were changed
ActionsNameChange Multiple Actions’ names were changed
ActionsOptionsChange Multiple Actions’ options were changed
ActionsScheduleChange Multiple Actions’ schedules were changed
AnalyticsCapture An analytics event was captured
AnnotationContentChange An annotation was edited
AnnotationSizeChange An annotation was resized
ArchivedStoryDeleteAll A team’s story trash was emptied
ArchivedStoryDeletion An individual story was removed from a team’s story trash
AuthenticationTokenCreation A new API key was created
AuthenticationTokenDeletion An API key was deleted
BatchStoryArchive A set of stories were moved to trash
CredentialDestruction A credential was deleted
CredentialMovement A credential was moved to a new team/folder
CredentialOauthTokenRefresh An OAuth credential’s token was refreshed
CredentialReplacement A credential was replaced on a story
CredentialSave A credential was created or updated
CustomCertificateAuthoritySet A custom certificate authority was set
EventDeletion An event was deleted
ExampleStoryImport A story was imported from the story library
FolderCreation A folder was created
FolderDestruction A folder was destroyed
FolderUpdate A folder was updated
FormFieldAddition A form field was added
FormFieldRemoval A form field was removed
FormFieldReorder A form field’s position was reordered
FormFieldUpdate A form field was updated
FormUpdate A form was updated
GroupExtraction A group was extracted from a set of actions
GroupFlatten A group was flattened to a set of actions
JobsQueuedDeletion Currently enqueued jobs were cleared (for a self-hosted tenant)
JobsRetryingDeletion Currently retrying jobs were cleared (for a self-hosted tenant)
LastEventReEmission The most recent event was re-emitted
LinkChange A link between actions was edited
Login A user logged in
ResourceCreation A global resource was created
ResourceDestruction A global resource was deleted
ResourceEdit A global resource was edited
ResourceMovement A global resource was moved to a new team/folder
ResourceReplacement A global resource was replaced on a story
RecordReportCreation A Record report was created
RecordReportDeletion A Record report was deleted
RecordReportUpdate A Record report was edited
RecordReportElementCreation A Record report element was created
RecordReportElementDestruction A Record report element was deleted
RecordReportElementUpdate A Record report element was edited
RecordWriterCreation A Record writer was created
RecordWriterDestruction A Record writer was deleted
RecordWriterUpdate A Record writer was edited
SCIM/2.0/User/{operation} A SCIM 2.0 operation (create, replace, update or destroy) on a User
SsoConfigurationDefaultSet The default SSO configuration was set to Tines-powered
SsoConfigurationOidcSet The default SSO configuration was set to OIDC
SsoConfigurationSamlSet The default SSO configuration was set to SAML
StoryActionsAutoAlign A set of actions were auto aligned
StoryActionsAutoLayout A set of actions were auto laid-out
StoryActionsPositioning A set of actions and annotations were repositioned
StoryArchive A story was moved to trash
StoryCreation A story was created
StoryDescriptionChange A story’s description was changed
StoryDisabledChange A story was disabled or enabled
StoryEventsDeletion All of a story’s events were deleted
StoryImport A story was imported
StoryItemsCreation A set of actions/annotations were created
StoryItemsDestruction A set of actions/annotations were destroyed
StoryItemsMovement A set of actions/annotations were moved
StoryJobsClearance A story’s scheduled jobs were cleared
StoryKeepEventsForChange A story’s event retention settings were changed
StoryLockedChange A story was locked or unlocked
StoryMovement A story was moved
StoryNameChange A story’s name was changed
StoryPriorityChange A story’s priority was changed
StoryRecipientAddition A monitoring recipient was added for a story
StoryRecipientRemoval A monitoring recipient was removed for a story
StoryRecipientUpdate A monitoring recipient was changed for a story
StoryReportingStatusChange Reporting was enabled/disabled for a story
StoryRestore A story was restored from the trash
StorySendToStoryChange A story’s send-to-story settings were edited
StoryVersionCreate A story version was created
StoryVersionDeletion A story version was deleted
StoryVersionImport A story version was imported
StoryVersionNameChange A story’s version was renamed
TeamCaseCreation A case was created
TeamCaseCommentCreation A comment was added to a case
TeamCaseFileAttach A file or comment and file was attached to a case
TeamCaseTagsUpdate A tag was added to or removed from a case
TeamCaseUpdate A case was assigned, renamed, completed or its description updated
TeamCaseWebhookUpdate A case notification webhook was set or updated for the team
TeamCreation A team was created
TeamDestruction A team was destroyed
TeamMemberRemoval A team member was removed
TeamMembersAddition A team member was added
TeamUpdate A team was updated
TemplateCreation A template was created
TemplateDestruction A template was deleted
TemplateUpdate A template was updated
TenantConfigChange A tenant’s config was changed
TenantFeatureFlagToggle A feature flag was enabled/disabled
TenantPlanUpgradeRequest A plan upgrade was requested
UserDeletion A user was deleted
UserEdit A user was edited
UserReinvitation A user’s invitation was resent
UsersInvitation A user was invited

Log format

Each log contains enriched user information, as well as metadata related to the operation carried out. Extremely sensitive information, for example credential values, are never included.

{
  "created_at": "2022-10-04T19:03:18Z",
  "id": 123456,
  "inputs": {
    "inputs": {
      "teamId": 1772
    }
  },
  "request_ip": "11.22.33.44",
  "request_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36",
  "tenant_id": 9,
  "updated_at": "2022-10-04T19:03:18Z",
  "user_email": "user@example.com",
  "user_id": 9,
  "user_name": "Example User",
  "operation_name": "StoryCreation"
}
Was this helpful?