1. Audit Logging Events

Audit Logging Events

Workspaces

airlock_accepted
event_payload Mandatory Format Notes/Instructions
request_id Y integer
user_name Y string
reason Y string
destination Y string
target_workspace_id N integer
target_workspace_name N string
primary_session_id N string
application_time_stamp Y date and time
workspace_id Y integer
workspace_name Y string
organisation_id Y integer
organisation_name Y string
role Y string
resource Y string
airlock_downloaded
event_payload Mandatory Format Notes/Instructions
request_id Y integer
user_name Y string
reason Y string
destination Y string
primary_session_id N string
application_time_stamp Y date and time
workspace_id Y integer
workspace_name Y string
organisation_id Y integer
organisation_name Y string
role Y string
airlock_exported_to
event_payload Mandatory Format Notes/Instructions
request_id Y integer
user_name Y string
reason Y string
destination Y string
target_workspace_id N integer
target_workspace_name N string
primary_session_id N string
application_time_stamp Y date and time
workspace_id Y integer
workspace_name Y string
organisation_id Y integer
organisation_name Y string
role Y string
resource Y string
airlock_imported_from
event_payload Mandatory Format Notes/Instructions
request_id Y integer
user_name Y string
reason Y string
destination Y string
source_workspace_id N integer
source_workspace_name N string
primary_session_id N string
application_time_stamp Y date and time
workspace_id Y integer
workspace_name Y string
organisation_id Y integer
organisation_name Y string
role Y string
resource Y string
airlock_requested
event_payload Mandatory Format Notes/Instructions
request_id Y integer
user_name Y string
reason Y string
destination Y string
target_workspace_id N integer
target_workspace_name N string
primary_session_id N string
application_time_stamp Y date and time
workspace_id Y integer
workspace_name Y string
organisation_id Y integer
organisation_name Y string
role Y string
resource N string The resource should be present if the destination is workspace
application_startup
event_payload Mandatory Format Notes/Instructions
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
system_username Y string The name of the OS user running the AAP application
error_description N String The description of the error
error_details N String The context of the error
detail N String For audit reporting: The description of the error
authentication
event_payload Mandatory Format Notes/Instructions
secondary_session_id N string The session id passed from the provisioning application.
resource Y string The username attempting to authenticate with the AAP application
error_description N String The description of the error
error_details N String The context of the error
detail N String For audit reporting: The description of the error
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
primary_session_id N string The session ID that was generated when the authentication was successful.
originating_ip Y ip address ip address
user_creation
event_payload Mandatory Format Notes/Instructions
target_user_id Y integer The id of the newly added user
target_username Y integer The username of the newly added user
resource Y integer The username of the newly added user
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
primary_session_id N string The session ID that was generated when the authentication was successful.
originating_ip Y ip address ip address
user_deletion
event_payload Mandatory Format Notes/Instructions
target_user_id Y integer The id of the deleted user
target_username Y integer The username of the deleted user
resource Y integer The username of the deleted user
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
primary_session_id N string The session ID that was generated when the authentication was successful.
originating_ip Y ip address ip address
invited_user_to_workspace
event_payload Mandatory Format Notes/Instructions
target_user_id Y integer The id of the invited user
target_user_name Y string The username of the invited user
resource Y string The username of the invited user
workspace_id Y integer The id of the workspace the user was invited to
workspace_name Y String The name of the workspace the user was invited to
is_archived N Boolean Indicates if the workspace has been archived (T) or unarchived (F)
owner_id N integer The id of the workspace owner
owner N String The username of the workspace owner
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string Username of the user inviting the member
primary_session_id N string The session ID that was generated when the authentication was successful.
originating_ip Y ip address ip address
workspace_invite_accepted
event_payload Mandatory Format Notes/Instructions
target_user_id Y integer The id of the accepted invited user
target_user_name Y string The username of the accepted invited user
resource Y string The name of the workspace the user accepted the invite to
workspace_id Y integer The id of the workspace the user was invited to
workspace_name Y String The name of the workspace the user was invited to
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
primary_session_id N string The session ID that was generated when the authentication was successful.
originating_ip Y ip address ip address
workspace_invite_declined
event_payload Mandatory Format Notes/Instructions
target_user_id Y integer The id of the accepted invited user
target_user_name Y string The username of the accepted invited user
resource Y string The name of the workspace the user accepted the invite to
workspace_id Y integer The id of the workspace the user was invited to
workspace_name Y String The name of the workspace the user was invited to
is_archived N Boolean Indicates if the workspace has been archived (T) or unarchived (F)
owner_id N integer The id of the workspace owner
owner N String The username of the workspace owner
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
primary_session_id N string The session ID that was generated when the authentication was successful.
originating_ip Y ip address ip address
removing_user_from_workspace
event_payload Mandatory Format Notes/Instructions
target_user_id Y integer The id of the removed user
target_username Y integer The username of the removed user
resource Y integer The username of the removed user
workspace_id Y integer The id of the workspace the user was removed from
workspace_name Y String The name of the workspace the user was removed from
is_archived N Boolean Indicates if the workspace has been archived (T) or unarchived (F)
owner_id N integer The id of the workspace owner
owner N String The username of the workspace owner
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
primary_session_id N string The session ID that was generated when the authentication was successful.
originating_ip Y ip address ip address
password_change
event_payload Mandatory Format Notes/Instructions
target_user_id Y integer The id of the user who's password is changed
target_username Y string The username of the user who's password is changed
resource Y string The username of the user who's password is changed
detail Y string Password Change
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
primary_session_id N string The session ID that was generated when the authentication was successful.
originating_ip Y ip address ip address
role_change
event_payload Mandatory Format Notes/Instructions
source_role Y string The previous role of the user
target_role Y string The new role
target_user_id Y integer The id of the user who's role is changed
target_username Y string The username of the user who's role is changed
resource Y string The username of the user who's role is changed
detail Y string Changing to admin/user
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
primary_session_id N string The session ID that was generated when the authentication was successful.
originating_ip Y ip address ip address
workfile_copying
event_payload Mandatory Format Notes/Instructions
workfile_id Y integer The id of the original workfile
file_name Y String The name of the workfile
file_ext Y String The name of the workfile extension
new_workfile_id Y integer The id of the new workfile
new_workfile_name Y integer The file_name the new workfile
detail Y integer To new_workfile_name
workspace_id Y integer The id of the workspace
workspace_name Y String The name of the workspace
is_archived N Boolean Indicates if the workspace has been archived (T) or unarchived (F)
owner_id N integer The id of the workspace owner
owner N String The username of the workspace owner
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
primary_session_id N string The session ID that was generated when the authentication was successful.
originating_ip Y ip address ip address
workfile_rename
event_payload Mandatory Format Notes/Instructions
workfile_id Y integer The id of the original workfile
file_name Y String The old name of the workfile
new_workfile_name Y integer The new file_name of the workfile
resource Y String The old name of the workfile
detail Y String To new_workfile_name or error
error_description N String The description of the error
error_details N String The context of the error
workspace_id Y integer The id of the workspace
workspace_name Y String The name of the workspace
is_archived N Boolean Indicates if the workspace has been archived (T) or unarchived (F)
owner_id N integer The id of the workspace owner
owner N String The username of the workspace owner
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
primary_session_id N string The session ID that was generated when the authentication was successful.
originating_ip Y ip address ip address
workfile_creation
event_payload Mandatory Format Notes/Instructions
workfile_id Y integer The id of the workfile
file_name Y String The name of the workfile
file_ext Y String The name of the workfile extension
workspace_id Y integer The id of the workspace
workspace_name Y String The name of the workspace
is_archived N Boolean Indicates if the workspace has been archived (T) or unarchived (F)
owner_id N integer The id of the workspace owner
owner N String The username of the workspace owner
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
primary_session_id N string The session ID that was generated when the authentication was successful.
originating_ip Y ip address ip address
workfile_upload
event_payload Mandatory Format Notes/Instructions
workfile_id Y integer The id of the workfile
file_name Y String The name of the workfile
file_ext Y String The name of the workfile extension
workspace_id Y integer The id of the workspace
workspace_name Y String The name of the workspace
is_archived N Boolean Indicates if the workspace has been archived (T) or unarchived (F)
owner_id N integer The id of the workspace owner
owner N String The username of the workspace owner
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
primary_session_id N string The session ID that was generated when the authentication was successful.
originating_ip Y ip address ip address
workfile_deletion
event_payload Mandatory Format Notes/Instructions
workfile_id Y integer The id of the workfile
file_name Y String The name of the workfile
file_ext Y String The name of the workfile extension
workspace_id Y integer The id of the workspace
workspace_name Y String The name of the workspace
is_archived N Boolean Indicates if the workspace has been archived (T) or unarchived (F)
owner_id N integer The id of the workspace owner
owner N String The username of the workspace owner
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
primary_session_id N string The session ID that was generated when the authentication was successful.
originating_ip Y ip address ip address
workfile_access
event_payload Mandatory Format Notes/Instructions
workfile_id Y integer The id of the workfile
file_name Y String The name of the workfile
file_ext Y String The name of the workfile extension
draft_id N integer The id of this draft of the workfile
version_number N String The current version number of the workfile
version_filename N String The current version filename of the workfile
workspace_id Y integer The id of the workspace
workspace_name Y String The name of the workspace
is_archived N Boolean Indicates if the workspace has been archived (T) or unarchived (F)
owner_id N integer The id of the workspace owner
owner N String The username of the workspace owner
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
primary_session_id N string The session ID that was generated when the authentication was successful.
originating_ip Y ip address ip address
workfile_download
event_payload Mandatory Format Notes/Instructions
workfile_id Y integer The id of the workfile
file_name Y String The name of the workfile
file_ext Y String The name of the workfile extension
draft_id N integer The id of this draft of the workfile
version_number N String The current version number of the workfile
version_filename N String The current version filename of the workfile
workspace_id Y integer The id of the workspace
workspace_name Y String The name of the workspace
is_archived N Boolean Indicates if the workspace has been archived (T) or unarchived (F)
owner_id N integer The id of the workspace owner
owner N String The username of the workspace owner
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
primary_session_id N string The session ID that was generated when the authentication was successful.
originating_ip Y ip address ip address
data_import
event_payload Mandatory Format Notes/Instructions
dataset_id Y integer The id of the dataset (database_table) the data was imported to
dataset_name Y String The name of the dataset (database_table) the data was imported to
workspace_id Y integer The id of the workspace
workspace_name Y String The name of the workspace
is_archived N Boolean Indicates if the workspace has been archived (T) or unarchived (F)
owner_id N integer The id of the workspace owner
owner N String The username of the workspace owner
error_description Y String The description of the error
error_details Y String The context of the error
detail Y String For audit reporting: The description of the error
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
primary_session_id N string The session ID that was generated when the authentication was successful.
originating_ip Y ip address ip address
workspace_creation

N.B. Legacy event – workspace_creation audit events now logged by XAP Management API

workspace_id Y integer The id of the workspace
workspace_name Y String The name of the workspace
is_archived N Boolean Indicates if the workspace has been archived (T) or unarchived (F)
owner_id N integer The id of the workspace owner
owner N String The username of the workspace owner
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
primary_session_id N string The session ID that was generated when the authentication was successful.
originating_ip Y ip address ip address
workspace_deletion

N.B. Legacy event – workspace_creation audit events now logged by XAP Management API

workspace_id Y integer The id of the workspace
workspace_name Y String The name of the workspace
is_archived N Boolean Indicates if the workspace has been archived (T) or unarchived (F)
owner_id N integer The id of the workspace owner
owner N String The username of the workspace owner
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
primary_session_id N string The session ID that was generated when the authentication was successful.
originating_ip Y ip address ip address
workspace_archiving
event_payload Mandatory Format Notes/Instructions
workspace_id Y integer The id of the workspace
workspace_name Y String The name of the workspace
is_archived N Boolean Indicates if the workspace has been archived (T) or unarchived (F)
owner_id N integer The id of the workspace owner
owner N String The username of the workspace owner
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
primary_session_id N string The session ID that was generated when the authentication was successful.
originating_ip Y ip address ip address
workspace_access
event_payload Mandatory Format Notes/Instructions
workspace_id Y integer The id of the workspace the user has accessed
workspace_name Y String The name of the workspace the user has accessed
is_archived N Boolean Indicates if the workspace has been archived (T) or unarchived (F)
owner_id N integer The id of the workspace owner
owner N String The username of the workspace owner
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
primary_session_id N string The session ID that was generated when the authentication was successful.
originating_ip Y ip address ip address
data_source_creation
event_payload Mandatory Format Notes/Instructions
data_source_id Y integer The id of the data_source
data_source_name Y String The name of the data_source
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
primary_session_id N string The session ID that was generated when the authentication was successful.
originating_ip Y ip address ip address
data_source_deletion
event_payload Mandatory Format Notes/Instructions
data_source_id Y integer The id of the data_source
data_source_name Y String The name of the data_source
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
primary_session_id N string The session ID that was generated when the authentication was successful.
originating_ip Y ip address ip address
unauthorised_operation
event_payload Mandatory Format Notes/Instructions
operation Y integer The name of the attempted operation
object_type Y String The type of object (e.g. workspace, user etc) that the operation was attempted against
object_id Y integer The id of the object that the operation was attempted against
object_name N String The name of the object that the operation was attempted against
error_description Y String The description of the error
error_details Y String The context of the error
detail Y String For audit reporting: The description of the error
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
primary_session_id N string The session ID that was generated when the authentication was successful.
originating_ip Y ip address ip address
unauthorised_access_attempt
event_payload Mandatory Format Notes/Instructions
logged_in Y boolean If this is false, the user was attempting to access an admin-only area of the system
url Y string The url that was the target of the unauthorised access attempt
error_description Y String The description of the error
error_details Y String The context of the error
detail Y String For audit reporting: The description of the error
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
primary_session_id N string The session ID that was generated when the authentication was successful.
originating_ip Y ip address ip address
app_publish
event_payload Mandatory Format Notes/Instructions
app_id Y integer The id of the mini-app
app_name Y String The name of the mini-app
app_type Y String RShiny
location N String Where the app is being published to/unpublished from
workspace_id Y integer The id of the workspace
workspace_name Y String The name of the workspace
is_archived N Boolean Indicates if the workspace has been archived (T) or unarchived (F)
owner_id N integer The id of the workspace owner
owner N String The username of the workspace owner
resource Y String The name of the mini-app
error_description N String The description of the error
error_details N String The context of the error
detail Y String Publish or error description
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
primary_session_id N string The session ID that was generated when the authentication was successful.
originating_ip Y ip address ip address
app_unpublish
event_payload Mandatory Format Notes/Instructions
app_id Y integer The id of the mini-app
app_name Y String The name of the mini-app
app_type Y String RShiny
location N String Where the app is being published to/unpublished from
workspace_id Y integer The id of the workspace
workspace_name Y String The name of the workspace
is_archived N Boolean Indicates if the workspace has been archived (T) or unarchived (F)
owner_id N integer The id of the workspace owner
owner N String The username of the workspace owner
resource Y String The name of the mini-app
error_description N String The description of the error
error_details N String The context of the error
detail Y String Unpublish or error description
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
primary_session_id N string The session ID that was generated when the authentication was successful.
originating_ip Y ip address ip address
app_preview
event_payload Mandatory Format Notes/Instructions
app_id Y integer The id of the mini-app
app_name Y String The name of the mini-app
app_type Y String RShiny
location N String Where the app is being published to/unpublished from
workspace_id Y integer The id of the workspace
workspace_name Y String The name of the workspace
is_archived N Boolean Indicates if the workspace has been archived (T) or unarchived (F)
owner_id N integer The id of the workspace owner
owner N String The username of the workspace owner
resource Y String The name of the mini-app
error_description N String The description of the error
error_details N String The context of the error
detail Y String Preview or error description
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
primary_session_id N string The session ID that was generated when the authentication was successful.
originating_ip Y ip address ip address
app_run
event_payload Mandatory Format Notes/Instructions
app_id Y integer The id of the mini-app
app_name Y String The name of the mini-app
app_type Y String RShiny
location N String Where the app is being run from
workspace_id Y integer The id of the workspace
workspace_name Y String The name of the workspace
is_archived N Boolean Indicates if the workspace has been archived (T) or unarchived (F)
owner_id N integer The id of the workspace owner
owner N String The username of the workspace owner
resource Y String The name of the mini-app
detail Y String Run description
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
primary_session_id N string The session ID that was generated when the authentication was successful.
originating_ip Y ip address ip address
app_deleted
event_payload Mandatory Format Notes/Instructions
app_id Y integer The id of the mini-app
app_name Y String The name of the mini-app
app_type Y String RShiny
location N String Where the app is being deleted from
workspace_id Y integer The id of the workspace
workspace_name Y String The name of the workspace
is_archived N Boolean Indicates if the workspace has been archived (T) or unarchived (F)
owner_id N integer The id of the workspace owner
owner N String The username of the workspace owner
resource Y String The name of the mini-app
error_description N String The description of the error
error_details N String The context of the error
detail Y String Delete or error description
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
primary_session_id N string The session ID that was generated when the authentication was successful.
originating_ip Y ip address ip address
app_creation
event_payload Mandatory Format Notes/Instructions
app_id Y integer The id of the mini-app
app_name Y String The name of the mini-app
app_type Y String RShiny
workspace_id Y integer The id of the workspace
workspace_name Y String The name of the workspace
is_archived N Boolean Indicates if the workspace has been archived (T) or unarchived (F)
owner_id N integer The id of the workspace owner
originating_ip Y ip address ip address
owner N String The username of the workspace owner
resource Y String The name of the mini-app
detail Y String Create
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
primary_session_id N string The session ID that was generated when the authentication was successful.
originating_ip Y ip address ip address
app_rename
event_payload Mandatory Format Notes/Instructions
app_id Y integer The id of the mini-app
app_name Y String The old name of the mini-app
new_app_name Y String The new name of the mini-app
app_type Y String RShiny
workspace_id Y integer The id of the workspace
workspace_name Y String The name of the workspace
is_archived N Boolean Indicates if the workspace has been archived (T) or unarchived (F)
owner_id N integer The id of the workspace owner
owner N String The username of the workspace owner
originating_ip Y ip address ip address
resource Y String The old name of the mini-app
detail Y String New App Name or error
error_description N String The description of the error
error_details N String The context of the error
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
primary_session_id N string The session ID that was generated when the authentication was successful.
originating_ip Y ip address ip address
note_creation
event_payload Mandatory Format Notes/Instructions
note_id Y integer The id of the note
workspace_id Y integer The id of the workspace
workspace_name Y String The name of the workspace
is_archived N Boolean Indicates if the workspace has been archived (T) or unarchived (F)
owner_id N integer The id of the workspace owner
owner N String The username of the workspace owner
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
resource Y String The name of the workspace, workfile or dataset
detail Y String Added note to workspace, workfile or dataset
dataset_id N Integer The id of the dataset
dataset_name N String The name of the dataset
workfile_id N integer The id of the workfile
file_name N String The name of the workfile
file_ext N String The name of the workfile extension
note_deletion
event_payload Mandatory Format Notes/Instructions
note_id Y integer The id of the note
workspace_id Y integer The id of the workspace
workspace_name Y String The name of the workspace
is_archived N Boolean Indicates if the workspace has been archived (T) or unarchived (F)
owner_id N integer The id of the workspace owner
owner N String The username of the workspace owner
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
resource Y String The name of the workspace, workfile or dataset
detail Y String Removed note from workspace, workfile or dataset
dataset_id N Integer The id of the dataset
dataset_name N String The name of the dataset
workfile_id N integer The id of the workfile
file_name N String The name of the workfile
file_ext N String The name of the workfile extension
insight_creation
event_payload Mandatory Format Notes/Instructions
note_id Y integer The id of the note
workspace_id Y integer The id of the workspace
workspace_name Y String The name of the workspace
is_archived N Boolean Indicates if the workspace has been archived (T) or unarchived (F)
owner_id N integer The id of the workspace owner
owner N String The username of the workspace owner
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
resource Y String The name of the workspace, workfile or dataset
detail Y String Added insight to workspace, workfile or dataset
dataset_id N Integer The id of the dataset
dataset_name N String The name of the dataset
workfile_id N integer The id of the workfile
file_name N String The name of the workfile
file_ext N String The name of the workfile extension
insight_deletion
event_payload Mandatory Format Notes/Instructions
note_id Y integer The id of the note
workspace_id Y integer The id of the workspace
workspace_name Y String The name of the workspace
is_archived N Boolean Indicates if the workspace has been archived (T) or unarchived (F)
owner_id N integer The id of the workspace owner
owner N String The username of the workspace owner
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string The username attempting to authenticate with the AAP application
resource Y String The name of the workspace, workfile or dataset
detail Y String Removed insight from workspace, workfile or dataset
dataset_id N Integer The id of the dataset
dataset_name N String The name of the dataset
workfile_id N integer The id of the workfile
file_name N String The name of the workfile
file_ext N String The name of the workfile extension

ETL

etl_file_upload
event_payload Mandatory Format Notes/Instructions
upload_start N ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss When the user started the file upload to the SFTP server
upload_end N ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss When the file upload to the SFTP server completed
upload_duration N String human readable duration for the difference between the start and end of the upload e.g. 1h 30m 10s
upload_in_seconds N Integer the difference between the start and end of the upload in seconds for comparison purposes
session_id Y Integer The numbered session under which the file was uploaded to the SFTP folder
detail Y String Fixed string for audit reporting: user uploaded a file
batch_id Y Integer random number linking all events through etl for a file
feed_id Y String The name of the feed: rsh, cris etc
originating_ip Y ip address ip address
workspace_name Y String The name of the workspace (and therein user) that the data is being sent to in AAP
user_name Y String The name of the workspace as same as user
full_path Y String The name of the file that was uploaded to the SFTP folder
file_name Y String The name of the file that was uploaded to the SFTP folder
file_ext Y String The name of the file extension that was uploaded to the SFTP folder
resource Y String The name of the file that was uploaded to the SFTP folder, for audit reporting view
etl_file_transfer_start
event_payload Mandatory Format Notes/Instructions
session_id Y Integer The numbered session under which the file was uploaded to the SFTP folder
detail Y String Fixed string for audit reporting: file detected and transfer begins
batch_id Y Integer random number linking all events through etl for a file
feed_id Y String The name of the feed: rsh, cris etc
originating_ip Y ip address ip address
workspace_name Y String The name of the workspace (and therein user) that the data is being sent to in AAP
user_name Y String The name of the workspace as same as user
full_path Y String The name of the file that was uploaded to the SFTP folder
file_name Y String The name of the file that was uploaded to the SFTP folder
file_ext Y String The name of the file extension that was uploaded to the SFTP folder
resource Y String The name of the file that was uploaded to the SFTP folder, for audit reporting view
etl_file_transfer_fail
event_payload Mandatory Format Notes/Instructions
error_description Y String The description of the error
error_details N String The context of the error
etl_file_path Y String The full path of the file that was transferred to the ETL server
session_id Y Integer The numbered session under which the file was uploaded to the SFTP folder
detail Y String For audit reporting: The description of the error
batch_id Y Integer random number linking all events through etl for a file
feed_id Y String The name of the feed: rsh, cris etc
originating_ip Y ip address ip address
workspace_name Y String The name of the workspace (and therein user) that the data is being sent to in AAP
user_name Y String The name of the workspace as same as user
full_path Y String The name of the file that was uploaded to the SFTP folder
file_name Y String The name of the file that was uploaded to the SFTP folder
file_ext Y String The name of the file extension that was uploaded to the SFTP folder
resource Y String The name of the file that was uploaded to the SFTP folder, for audit reporting view
etl_file_transfer_end
event_payload Mandatory Format Notes/Instructions
etl_file_path Y String The full path of the file that was transferred to the ETL server
session_id Y Integer The numbered session under which the file was uploaded to the SFTP folder
detail Y String Fixed String for audit reporting: File arrived and loading begins
batch_id Y Integer random number linking all events through etl for a file
feed_id Y String The name of the feed: rsh, cris etc
originating_ip Y ip address ip address
workspace_name Y String The name of the workspace (and therein user) that the data is being sent to in AAP
user_name Y String The name of the workspace as same as user
full_path Y String The name of the file that was uploaded to the SFTP folder
file_name Y String The name of the file that was uploaded to the SFTP folder
file_ext Y String The name of the file extension that was uploaded to the SFTP folder
resource Y String The name of the file that was uploaded to the SFTP folder, for audit reporting view
etl_start
event_payload Mandatory Format Notes/Instructions
database Y String The name of the workspace (and therein user) that the data is being sent to in AAP
database_schema N String The name of the database schema that the data will reside
database_table Y String The name of the database table that the data will reside
detail Y String Destination table and action – create or append
batch_id Y Integer random number linking all events through etl for a file
feed_id Y String The name of the feed: rsh, cris etc
originating_ip Y ip address ip address
workspace_name Y String The name of the workspace (and therein user) that the data is being sent to in AAP
user_name Y String The name of the workspace as same as user
full_path Y String The name of the file that was uploaded to the SFTP folder
file_name Y String The name of the file that was uploaded to the SFTP folder
file_ext Y String The name of the file extension that was uploaded to the SFTP folder
resource Y String The name of the file that was uploaded to the SFTP folder, for audit reporting view
etl_validation_fail
event_payload Mandatory Format Notes/Instructions
error_description Y String The description of the error
error_details Y String The context of the error
database Y String The name of the workspace (and therein user) that the data is being sent to in AAP
database_schema N String The name of the database schema that the data will reside
database_table Y String The name of the database table that the data will reside
detail Y String For audit reporting: The description of the error
batch_id Y Integer random number linking all events through etl for a file
feed_id Y String The name of the feed: rsh, cris etc
originating_ip Y ip address ip address
workspace_name Y String The name of the workspace (and therein user) that the data is being sent to in AAP
user_name Y String The name of the workspace as same as user
full_path Y String The name of the file that was uploaded to the SFTP folder
file_name Y String The name of the file that was uploaded to the SFTP folder
file_ext Y String The name of the file extension that was uploaded to the SFTP folder
resource Y String The name of the file that was uploaded to the SFTP folder, for audit reporting view
etl_load
event_payload Mandatory Format Notes/Instructions
database Y String The name of the workspace (and therein user) that the data is being sent to in AAP
database_schema N String The name of the database schema that the data will reside
database_table Y String The name of the database table that the data will reside
detail Y String Destination table and action – create or append
batch_id Y Integer random number linking all events through etl for a file
feed_id Y String The name of the feed: rsh, cris etc
originating_ip Y ip address ip address
workspace_name Y String The name of the workspace (and therein user) that the data is being sent to in AAP
user_name Y String The name of the workspace as same as user
full_path Y String The name of the file that was uploaded to the SFTP folder
file_name Y String The name of the file that was uploaded to the SFTP folder
file_ext Y String The name of the file extension that was uploaded to the SFTP folder
resource Y String The name of the file that was uploaded to the SFTP folder, for audit reporting view
etl_load_fail
event_payload Mandatory Format Notes/Instructions
error_description Y String The description of the error
error_details Y String The context of the error
database Y String The name of the workspace (and therein user) that the data is being sent to in AAP
database_schema N String The name of the database schema that the data will reside
database_table Y String The name of the database table that the data will reside
detail Y String For audit reporting: The description of the error
batch_id Y Integer random number linking all events through etl for a file
feed_id Y String The name of the feed: rsh, cris etc
originating_ip Y ip address ip address
workspace_name Y String The name of the workspace (and therein user) that the data is being sent to in AAP
user_name Y String The name of the workspace as same as user
full_path Y String The name of the file that was uploaded to the SFTP folder
file_name Y String The name of the file that was uploaded to the SFTP folder
file_ext Y String The name of the file extension that was uploaded to the SFTP folder
resource Y String The name of the file that was uploaded to the SFTP folder, for audit reporting view
etl_end
event_payload Mandatory Format Notes/Instructions
database Y String The name of the workspace (and therein user) that the data is being sent to in AAP
database_schema N String The name of the database schema that the data will reside
database_table Y String The name of the database table that the data will reside
detail Y String Destination table and action – create or append
batch_id Y Integer random number linking all events through etl for a file
feed_id Y String The name of the feed: rsh, cris etc
originating_ip Y ip address ip address
workspace_name Y String The name of the workspace (and therein user) that the data is being sent to in AAP
user_name Y String The name of the workspace as same as user
full_path Y String The name of the file that was uploaded to the SFTP folder
file_name Y String The name of the file that was uploaded to the SFTP folder
file_ext Y String The name of the file extension that was uploaded to the SFTP folder
resource Y String The name of the file that was uploaded to the SFTP folder, for audit reporting view
etl_file_fail
event_payload Mandatory Format Notes/Instructions
error_description Y String The description of the error
error_details Y String The context of the error
database N String The name of the workspace (and therein user) that the data is being sent to in AAP
database_schema N String The name of the database schema that the data will reside
database_table N String The name of the database table that the data will reside
detail Y String For audit reporting: The description of the error
batch_id Y Integer random number linking all events through etl for a file
feed_id Y String The name of the feed: rsh, cris etc
originating_ip Y ip address ip address
workspace_name Y String The name of the workspace (and therein user) that the data is being sent to in AAP
user_name Y String The name of the workspace as same as user
full_path Y String The name of the file that was uploaded to the SFTP folder
file_name Y String The name of the file that was uploaded to the SFTP folder
file_ext Y String The name of the file extension that was uploaded to the SFTP folder
resource Y String The name of the file that was uploaded to the SFTP folder, for audit reporting view
file_quarantined
event_payload Mandatory Format Notes/Instructions
error_description Y String The description of the error
error_details Y String The context of the error
database N String The name of the workspace (and therein user) that the data is being sent to in AAP
database_schema N String The name of the database schema that the data will reside
database_table N String The name of the database table that the data will reside
detail Y String For audit reporting: The description of the error
batch_id Y Integer random number linking all events through etl for a file
feed_id Y String The name of the feed: rsh, cris etc
originating_ip Y ip address ip address
workspace_name Y String The name of the workspace (and therein user) that the data is being sent to in AAP
user_name Y String The name of the workspace as same as user
full_path Y String The name of the file that was uploaded to the SFTP folder
file_name Y String The name of the file that was uploaded to the SFTP folder
file_ext Y String The name of the file extension that was uploaded to the SFTP folder
resource Y String The name of the file that was uploaded to the SFTP folder, for audit reporting view

Audit Reporting

audit_start_fail
event_payload Mandatory Format Notes/Instructions
error_description Y String The description of the error
error_details Y String The context of the error
detail Y String For audit reporting: The description of the error
audit_start
event_payload Mandatory Format Notes/Instructions
last_poll_id Y Integer Events above this id will be transferred to the workspace
workspace_name Y String The name of the workspace (and therein user) that the data is being sent to in AAP
next_poll_id Y Integer Events above this id will be transferred to the workspace next time
count Y Integer Number of records copied to the workspace
resource N String This will be blank
detail N String This will be blank
audit_load_fail
event_payload Mandatory Format Notes/Instructions
error_description Y String The description of the error
error_details Y String The context of the error
detail Y String For audit reporting: The description of the error
workspace_name Y String The name of the workspace (and therein user) that the data is being sent to in AAP
audit_end
event_payload Mandatory Format Notes/Instructions
last_poll_id Y Integer Events above this id have been transferred to the workspace
next_poll_id Y Integer Events above this id will be transferred to the workspace next time
count Y Integer Number of records copied to the workspace
workspace_name Y String The name of the workspace (and therein user) that the data is being sent to in AAP
resource N String This will be blank
detail N String This will be blank

Workspaces R-Server

session_state
event_payload Mandatory Format Notes/Instructions
status Y string State of session Starting/Started/Failed to start/Closing/Closed/Closing due to error/Failed to close
error_description N String The description of the error
error_details N String The context of the error
detail N String For audit reporting: The description of the error
originating_ip Y ip address ip address
workspace_id Y Integer The id of the workspace that the r session is being run against
workspace_name Y String The name of the workspace that the r session is being run against
user_name Y String The user running the r session
terminal Y String The type of terminal being used
primary_session_id Y String The session id of the XAP yser
secondary_session_id Y String The R Session Id
resource Y String The type of terminal being used
viewing_file
event_payload Mandatory Format Notes/Instructions
file Y string State of session Starting/Started/Failed
originating_ip Y ip address ip address
workspace_id Y Integer The id of the workspace that the r session is being run against
workspace_name Y String The name of the workspace that the r session is being run against
user_name Y String The user running the r session
terminal Y String The type of terminal being used
primary_session_id Y String The session id of the XAP yser
secondary_session_id Y String The R Session Id
resource Y String The type of terminal being used
console_error
event_payload Mandatory Format Notes/Instructions
error_description Y String The description of the error
error_details Y String The context of the error
detail Y String For audit reporting: The description of the error
originating_ip Y ip address ip address
workspace_id Y Integer The id of the workspace that the r session is being run against
workspace_name Y String The name of the workspace that the r session is being run against
user_name Y String The user running the r session
terminal Y String The type of terminal being used
primary_session_id Y String The session id of the XAP yser
secondary_session_id Y String The R Session Id
resource Y String The type of terminal being used
command_run
event_payload Mandatory Format Notes/Instructions
command Y string SThe command being executed
originating_ip Y ip address ip address
workspace_id Y Integer The id of the workspace that the r session is being run against
workspace_name Y String The name of the workspace that the r session is being run against
user_name Y String The user running the r session
terminal Y String The type of terminal being used
primary_session_id Y String The session id of the XAP yser
secondary_session_id Y String The R Session Id
resource Y String The type of terminal being used

De-identification

deidentify_start
event_payload Mandatory Format Notes/Instructions
batch_id Y Integer -1 if an error occured
project_id Y String The identifier of the project that the event was performed against
request_host Y String Host (and port) address
actioner_user_name Y String Username of the user performing the operation
error_code N String Application error code
error N String Error message
deidentify_end
event_payload Mandatory Format Notes/Instructions
batch_id Y Integer -1 if an error occured
processed_rows Y Integer The number of rows processed during de-identification
project_id Y String The identifier of the project that the event was performed against
request_host Y String Host (and port) address
actioner_user_name Y String Username of the user performing the operation
error_code N String Application error code
error N String Error message
reidentify
event_payload Mandatory Format Notes/Instructions
deidentifier Y String The deidentifier to be re-identified
project_id Y String The identifier of the project that the event was performed against
request_host Y String Host (and port) address
actioner_user_name Y String Username of the user performing the operation
error_code N String Application error code
error N String Error message
create_project
event_payload Mandatory Format Notes/Instructions
project_name Y String The name of the new project
project_id Y String The id of the new project
request_host Y String Host (and port) address
actioner_user_name Y String Username of the user performing the operation
error_code N String Application error code
error N String Error message
assign_user_to_project
event_payload Mandatory Format Notes/Instructions
added_user Y String The username of the user assigned to the project
project_id Y String The project identifier for the project the specified user was assigned to
request_host Y String Host (and port) address
actioner_user_name Y String Username of the user performing the operation
error_code N String Application error code
error N String Error message
remove_user_from_project
event_payload Mandatory Format Notes/Instructions
removed_user Y String The username of the user unassigned from a project
project_id Y String The project identifier for the project the specified user was unassigned from
request_host Y String Host (and port) address
actioner_user_name Y String Username of the user performing the operation
error_code N String Application error code
error N String Error message

XAP Provisioning

[ht_accordion sections="x

copied_data_table
event_payload Mandatory Format Notes/Instructions
database_table Y string The name of a table that was copied during the copied during a populate operation
error_description N String The description of the error
error_details N String The context of the error
detail N String For audit reporting: The description of the error
user_name Y string The currently logged in username
primary_session_id Y string The current provisioning session id
secondary_session_id N string The current XAP session id
completed_team_provisioning
event_payload Mandatory Format Notes/Instructions
error_description N String The description of the error
error_details N String The context of the error
detail N String For audit reporting: The description of the error
user_name Y string The currently logged in username
primary_session_id Y string The current provisioning session id
secondary_session_id N string The current XAP session id
workspace_name Y String The name of the workspace
completed_update_provisioning
event_payload Mandatory Format Notes/Instructions
error_description N String The description of the error
error_details N String The context of the error
detail N String For audit reporting: The description of the error
user_name Y string The currently logged in username
primary_session_id Y string The current provisioning session id
secondary_session_id N string The current XAP session id
workspace_name Y String The name of the workspace
completed_request_provisioning
event_payload Mandatory Format Notes/Instructions
request_workspace N String The name of the request workspace
error_description N String The description of the error
error_details N String The context of the error
detail N String For audit reporting: The description of the error
provider_workspace Y String The source workspace
requester_workspace Y String The workspace being requested
user_name Y string The currently logged in username
primary_session_id Y string The current provisioning session id
secondary_session_id N string The current XAP session id
workspace_name Y String The name of the workspace
request_provisioning
event_payload Mandatory Format Notes/Instructions
request_workspace N String The name of the request workspace
error_description N String The description of the error
error_details N String The context of the error
detail Y String For audit reporting: The description of the error or started
operation Y String Fixed String: started
provider_workspace Y String The source workspace
requester_workspace Y String The workspace being requested
user_name Y string The currently logged in username
primary_session_id Y string The current provisioning session id
secondary_session_id N string The current XAP session id
workspace_name Y String The name of the workspace
completed_populate_provisioning
event_payload Mandatory Format Notes/Instructions
error_description N String The description of the error
error_details N String The context of the error
detail N String For audit reporting: The description of the error
source_workspace Y String The source workspace
destination_workspace Y String The destination workspace
user_name Y string The currently logged in username
primary_session_id Y string The current provisioning session id
secondary_session_id N string The current XAP session id
workspace_name Y String The name of the workspace
populate_provisioning
event_payload Mandatory Format Notes/Instructions
error_description N String The description of the error
error_details N String The context of the error
detail Y String For audit reporting: The description of the error or started
operation N String started
source_workspace Y String The source workspace
destination_workspace Y String The destination workspace
user_name Y string The currently logged in username
primary_session_id Y string The current provisioning session id
secondary_session_id N string The current XAP session id
workspace_name Y String The name of the workspace
rollback_provisioning
event_payload Mandatory Format Notes/Instructions
error_description N String The description of the error
error_details N String The context of the error
detail Y String For audit reporting: The description of the error or status (started or completed)
status N String started or completed
workspace_id Y integer The id of the workspace being rolled back
database_name Y string The name of a database that was created during provisioning
etl_folder N string The name of the etl folder associated with the workspace
ftp_user N string The name of a ftp user associated with the workspace
user_name Y string The currently logged in username
primary_session_id Y string The current provisioning session id
secondary_session_id N string The current XAP session id
workspace_name Y String The name of the workspace
delete_provisioning
event_payload Mandatory Format Notes/Instructions
error_description N String The description of the error
error_details N String The context of the error
detail Y String For audit reporting: The description of the error or status (started or completed)
status N String started or completed
workspace_id Y integer The id of the workspace being deleted
database_name Y string The name of a database that was created during provisioning
etl_folder N string The name of the etl folder associated with the workspace
ftp_user N string The name of a ftp user associated with the workspace
user_name Y string The currently logged in username
primary_session_id Y string The current provisioning session id
secondary_session_id N string The current XAP session id
workspace_name Y String The name of the workspace
database_table_deleted
event_payload Mandatory Format Notes/Instructions
resource Y String The database table being deleted
workspace_id Y integer The id of the associated workspace
database_name Y string The name of a database that was created during provisioning
database_table Y String The database table being deleted
etl_folder N string The name of the etl folder associated with the workspace
ftp_user N string The name of a ftp user associated with the workspace
user_name Y string The currently logged in username
primary_session_id Y string The current provisioning session id
secondary_session_id N string The current XAP session id
workspace_name Y String The name of the workspace
database_deleted
event_payload Mandatory Format Notes/Instructions
resource Y String The name of the database being deleted
workspace_id N integer The id of the workspace being deleted
database_name Y string The name of the database being deleted
etl_folder N string The name of the etl folder associated with the workspace
ftp_user N string The name of a ftp user associated with the workspace
user_name Y string The currently logged in username
primary_session_id N string The current provisioning session id
secondary_session_id N string The current XAP session id
workspace_name Y String The name of the workspace
database_login_role_deleted
event_payload Mandatory Format Notes/Instructions
resource Y String The name of the role being deleted
workspace_id N integer The id of the associated workspace
database_name Y string The name of the associated database
etl_folder N string The name of the etl folder associated with the workspace
ftp_user N string The name of a ftp user associated with the workspace
user_name Y string The currently logged in username
primary_session_id N string The current provisioning session id
secondary_session_id N string The current XAP session id
workspace_name Y String The name of the workspace
etl_directory_created
event_payload Mandatory Format Notes/Instructions
resource Y String upload
workspace_id N integer The id of the workspace being deleted
database_name N string The name of the associated workspace
etl_folder N string The name of the etl folder associated with the workspace
ftp_user N string The name of a ftp user associated with the workspace
user_name Y string The currently logged in username
primary_session_id N string The current provisioning session id
secondary_session_id N string The current XAP session id
workspace_name Y String The name of the workspace
etl_directory_deleted
event_payload Mandatory Format Notes/Instructions
resource Y String upload
full_path Y String The path to the etl folder associated with the workspace
workspace_id N integer The id of the associated workspace
database_name N string The name of the database being deleted
etl_folder N string The name of the etl folder associated with the workspace
ftp_user N string The name of a ftp user associated with the workspace
user_name Y string The currently logged in username
primary_session_id N string The current provisioning session id
secondary_session_id N string The current XAP session id
workspace_name Y String The name of the workspace
team_provisioning_started
event_payload Mandatory Format Notes/Instructions
workspace_id Y integer The id of the workspace being deleted
database_name Y string The name of the database being deleted
etl_folder N string The name of the etl folder associated with the workspace
ftp_user N string The name of a ftp user associated with the workspace
user_name Y string The currently logged in username
primary_session_id Y string The current provisioning session id
secondary_session_id N string The current XAP session id
workspace_name Y String The name of the workspace
update_provisioning_started
event_payload Mandatory Format Notes/Instructions
user_name Y string The currently logged in username
primary_session_id Y string The current provisioning session id
secondary_session_id N string The current XAP session id
workspace_name Y String The name of the workspace
create_database_login_role
event_payload Mandatory Format Notes/Instructions
workspace_id N integer The id of the associated workspace
database_name Y string The name of the associated database
etl_folder N string The name of the etl folder associated with the workspace
ftp_user N string The name of a ftp user associated with the workspace
user_name Y string The currently logged in username
primary_session_id N string The current provisioning session id
secondary_session_id N string The current XAP session id
workspace_name Y String The name of the workspace
create_database
event_payload Mandatory Format Notes/Instructions
workspace_id N integer The id of the associated workspace
database_name Y string The name of the associated database
etl_folder N string The name of the etl folder associated with the workspace
ftp_user N string The name of a ftp user associated with the workspace
user_name Y string The currently logged in username
primary_session_id N string The current provisioning session id
secondary_session_id N string The current XAP session id
workspace_name Y String The name of the workspace

Hadoop Processing Engine

CREATE_PROJECT
event_payload Mandatory Format Notes/Instructions
status Y String Operation status
project_name Y String The name of the project to be created
ADD_JOB
event_payload Mandatory Format Notes/Instructions
job_name Y String The name of the job to be added
status Y String Operation status
project_name Y String The name of the project which the job will be added to
RUN_JOB
event_payload Mandatory Format Notes/Instructions
job_name Y String The name of the job to be added
input_files Y String Comma delimited list of files to be processed
hadoop_command Y String The full hadoop command to be executed
status Y String Operation status, either STARTED, COMPLETE or FAILED
project_name Y String The name of the project that the job belongs to

gd_collect

configuring
event_payload Mandatory Format Notes/Instructions
operation_details Y String Message naming file that the configuration was read from
username Y String Name of the user running the program.
parse meta-data
event_payload Mandatory Format Notes/Instructions
operation_status Y String Success status of operation: ok/warn/fail
operation_details Y String Name of Meta-data file
error_details N String For events with operation_status=fail, this gives more details on the nature of the error.
username Y String Name of the user running the program.
mkdir
event_payload Mandatory Format Notes/Instructions
operation_status Y String Success status of operation: ok/warn/fail
operation_details Y String Name of directory
duration_millis Y Integer Number of milliseconds the mkdir operation took
error_details N String For events with operation_status=fail, this gives more details on the nature of the error.
username Y String Name of the user running the program.
operation_size N String Size of the file being moved
queuing
event_payload Mandatory Format Notes/Instructions
operation_status Y String Success status of operation: ok/warn/fail
operation_details Y String Name of queue directory
error_details N String For events with operation_status=fail, this gives more details on the nature of the error.
username Y String Name of the user running the program.
operation_size N String Size of the file being moved
move_file
event_payload Mandatory Format Notes/Instructions
operation_status Y String Success status of operation: ok/warn/fail
operation_details N String Details about what file is being moved where
duration_millis N Integer Number of milliseconds the move operation took
error_details N String For events with operation_status=fail, this gives more details on the nature of the error.
username Y String Name of the user running the program.
establishing lock
event_payload Mandatory Format Notes/Instructions
error_details N String More details on the nature of the error.
username Y String Name of the user running the program.
scan staging directory
event_payload Mandatory Format Notes/Instructions
operation_status Y String Success status of operation: ok/warn/fail
error_details N String More details on the nature of the error.
username Y String Name of the user running the program.

gd_provision

make_directory
event_payload Mandatory Format Notes/Instructions
operation_status Y String Success status of operation: ok/warn/fail
operation_details N String Name of directory being created
duration_millis N Integer Number of milliseconds the mkdir operation took
error_details N String For events with operation_status=fail, this gives more details on the nature of the error.
username Y String Name of the user running the program.

Sandbox VM

sandbox_logon
event_payload Mandatory Format Notes/Instructions
workspace_name Y String The name of the workspace the user was invited to
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string Name of the user logging on
host_name Y string Name of the Sandbox VM
os Y string O/S running on VM eg. 'Windows'
logon_id Y string Windows Logon session identifier for correlating Logon with Logoff events – unique between reboots
originating_ip Y ip address ip address of client connected to Sandbox VM
detail Y String event summary
sandbox_logoff
event_payload Mandatory Format Notes/Instructions
workspace_name Y String The name of the workspace the user was invited to
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string Name of the user logging off
host_name Y string Name of the Sandbox VM
os Y string O/S running on VM eg. 'Windows'
logon_id Y string Windows Logon session identifier for correlating Logon with Logoff events – unique between reboots
detail Y String event summary

event-filter

sandbox_summary
event_payload Mandatory Format Notes/Instructions
workspace_name Y String The name of the workspace the user uses
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string Name of the user logging on
host_name Y string Name of the Sandbox VM
os Y string O/S running on VM eg. 'Windows'
originating_ip N ip address ip address of client connected to Sandbox VM
detail Y String event summary

Workspace Database

database_connection
event_payload Mandatory Format Notes/Instructions
workspace_name N String The name of the workspace the user logged into. (Only supplied for connection and disconnection events
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string Name of the user account that generated the event
database_name Y string Name of the Database where the event was generated
resource Y string Name of the Database where the event was generated
connecting_ip N ip address ip address of client connected to Greenplum Database
transaction_id N String Serial number of the transaction context
debug Y String Details of the qurey that was executed
detail Y String event summary
error_description N String The description of the error
error_details N String Context of the error
database_disconnection
event_payload Mandatory Format Notes/Instructions
workspace_name N String The name of the workspace the user logged into. (Only supplied for connection and disconnection events
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string Name of the user account that generated the event
database_name Y string Name of the Database where the event was generated
resource Y string Name of the Database where the event was generated
connecting_ip N ip address ip address of client connected to Greenplum Database
transaction_id N String Serial number of the transaction context
debug Y String Details of the qurey that was executed
detail Y String event summary
error_description N String The description of the error
error_details N String Context of the error
database_query
event_payload Mandatory Format Notes/Instructions
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string Name of the user account that generated the event
database_name Y string Name of the Database where the event was generated
resource Y string Name of the Database where the event was generated
connecting_ip N ip address ip address of client connected to Greenplum Database
transaction_id N String Serial number of the transaction context
debug Y String Details of the qurey that was executed
detail Y String event summary
error_description N String The description of the error
error_details N String Context of the error

Workspace Files

file_access
event_payload Mandatory Format Notes/Instructions
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string Name of the user account that generated the event or '(unknown)' if the SID from the Isilon cannot be resolved
sid N string Windows Security ID associated with the user that generated the event on the Isilon
workspace_name N string Name of the Workspace where the event was generated
resource Y string Path (relative to mount point of share) to the File System object that was the subject of the event
originating_ip Y ip address ip address of the host where the event happened
sharename N String Name of the Samba share that generated the event
cmd Y String File system operation generating the event – eg. open, rmdir, unlink
status Y String Indication of whether the operation succeeded – 'ok' or 'failed + reason'
file_name N String Path (relative to mount point of share) to the File System object that was the subject of the event
detail N String Readable description of the event
error_description N String The description of the error
error_details N String Context of the error
file_creation
event_payload Mandatory Format Notes/Instructions
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string Name of the user account that generated the event or '(unknown)' if the SID from the Isilon cannot be resolved
sid N string Windows Security ID associated with the user that generated the event on the Isilon
workspace_name N string Name of the Workspace where the event was generated
resource Y string Path (relative to mount point of share) to the File System object that was the subject of the event
originating_ip Y ip address ip address of the host where the event happened
sharename N String Name of the Samba share that generated the event
cmd Y String File system operation generating the event – eg. open, rmdir, unlink
status Y String Indication of whether the operation succeeded – 'ok' or 'failed + reason'
file_name N String Path (relative to mount point of share) to the File System object that was the subject of the event
detail N String Readable description of the event
error_description N String The description of the error
error_details N String Context of the error
file_deletion
event_payload Mandatory Format Notes/Instructions
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string Name of the user account that generated the event or '(unknown)' if the SID from the Isilon cannot be resolved
sid N string Windows Security ID associated with the user that generated the event on the Isilon
workspace_name N string Name of the Workspace where the event was generated
resource Y string Path (relative to mount point of share) to the File System object that was the subject of the event
originating_ip Y ip address ip address of the host where the event happened
sharename N String Name of the Samba share that generated the event
cmd Y String File system operation generating the event – eg. open, rmdir, unlink
status Y String Indication of whether the operation succeeded – 'ok' or 'failed + reason'
file_name N String Path (relative to mount point of share) to the File System object that was the subject of the event
detail N String Readable description of the event
error_description N String The description of the error
error_details N String Context of the error
file_rename
event_payload Mandatory Format Notes/Instructions
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string Name of the user account that generated the event or '(unknown)' if the SID from the Isilon cannot be resolved
sid N string Windows Security ID associated with the user that generated the event on the Isilon
workspace_name N string Name of the Workspace where the event was generated
resource Y string Path (relative to mount point of share) to the File System object that was the subject of the event
originating_ip Y ip address ip address of the host where the event happened
sharename N String Name of the Samba share that generated the event
cmd Y String File system operation generating the event – eg. open, rmdir, unlink
status Y String Indication of whether the operation succeeded – 'ok' or 'failed + reason'
file_name N String Path (relative to mount point of share) to the File System object that was the subject of the event
new_file_name N String Secondary subject of the event – eg. the destination of rename, the name of the link for link
detail N String Readable description of the event
error_description N String The description of the error
error_details N String Context of the error
datafile_access
event_payload Mandatory Format Notes/Instructions
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string Name of the user account that generated the event or '(unknown)' if the SID from the Isilon cannot be resolved
sid N string Windows Security ID associated with the user that generated the event on the Isilon
workspace_name N string Name of the Workspace where the event was generated
resource Y string Path (relative to mount point of share) to the File System object that was the subject of the event
originating_ip Y ip address ip address of the host where the event happened
sharename N String Name of the Samba share that generated the event
cmd Y String File system operation generating the event – eg. open, rmdir, unlink
status Y String Indication of whether the operation succeeded – 'ok' or 'failed + reason'
file_name N String Path (relative to mount point of share) to the File System object that was the subject of the event
detail N String Readable description of the event
error_description N String The description of the error
error_details N String Context of the error
datafile_creation
event_payload Mandatory Format Notes/Instructions
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string Name of the user account that generated the event or '(unknown)' if the SID from the Isilon cannot be resolved
sid N string Windows Security ID associated with the user that generated the event on the Isilon
workspace_name N string Name of the Workspace where the event was generated
resource Y string Path (relative to mount point of share) to the File System object that was the subject of the event
originating_ip Y ip address ip address of the host where the event happened
sharename N String Name of the Samba share that generated the event
cmd Y String File system operation generating the event – eg. open, rmdir, unlink
status Y String Indication of whether the operation succeeded – 'ok' or 'failed + reason'
file_name N String Path (relative to mount point of share) to the File System object that was the subject of the event
detail N String Readable description of the event
error_description N String The description of the error
error_details N String Context of the error
datafile_deletion
event_payload Mandatory Format Notes/Instructions
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string Name of the user account that generated the event or '(unknown)' if the SID from the Isilon cannot be resolved
sid N string Windows Security ID associated with the user that generated the event on the Isilon
workspace_name N string Name of the Workspace where the event was generated
resource Y string Path (relative to mount point of share) to the File System object that was the subject of the event
originating_ip Y ip address ip address of the host where the event happened
sharename N String Name of the Samba share that generated the event
cmd Y String File system operation generating the event – eg. open, rmdir, unlink
status Y String Indication of whether the operation succeeded – 'ok' or 'failed + reason'
file_name N String Path (relative to mount point of share) to the File System object that was the subject of the event
detail N String Readable description of the event
error_description N String The description of the error
error_details N String Context of the error
datafile_rename
event_payload Mandatory Format Notes/Instructions
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string Name of the user account that generated the event or '(unknown)' if the SID from the Isilon cannot be resolved
sid N string Windows Security ID associated with the user that generated the event on the Isilon
workspace_name N string Name of the Workspace where the event was generated
resource Y string Path (relative to mount point of share) to the File System object that was the subject of the event
originating_ip Y ip address ip address of the host where the event happened
sharename N String Name of the Samba share that generated the event
cmd Y String File system operation generating the event – eg. open, rmdir, unlink
status Y String Indication of whether the operation succeeded – 'ok' or 'failed + reason'
file_name N String Path (relative to mount point of share) to the File System object that was the subject of the event
new_file_name N String Secondary subject of the event – eg. the destination of rename, the name of the link for link
detail N String Readable description of the event
error_description N String The description of the error
error_details N String Context of the error
workfile_access
event_payload Mandatory Format Notes/Instructions
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string Name of the user account that generated the event or '(unknown)' if the SID from the Isilon cannot be resolved
sid N string Windows Security ID associated with the user that generated the event on the Isilon
workspace_name N string Name of the Workspace where the event was generated
resource Y string Path (relative to mount point of share) to the File System object that was the subject of the event
originating_ip Y ip address ip address of the host where the event happened
sharename N String Name of the Samba share that generated the event
cmd Y String File system operation generating the event – eg. open, rmdir, unlink
status Y String Indication of whether the operation succeeded – 'ok' or 'failed + reason'
file_name N String Path (relative to mount point of share) to the File System object that was the subject of the event
detail N String Readable description of the event
error_description N String The description of the error
error_details N String Context of the error
workfile_creation
event_payload Mandatory Format Notes/Instructions
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string Name of the user account that generated the event or '(unknown)' if the SID from the Isilon cannot be resolved
sid N string Windows Security ID associated with the user that generated the event on the Isilon
workspace_name N string Name of the Workspace where the event was generated
resource Y string Path (relative to mount point of share) to the File System object that was the subject of the event
originating_ip Y ip address ip address of the host where the event happened
sharename N String Name of the Samba share that generated the event
cmd Y String File system operation generating the event – eg. open, rmdir, unlink
status Y String Indication of whether the operation succeeded – 'ok' or 'failed + reason'
file_name N String Path (relative to mount point of share) to the File System object that was the subject of the event
detail N String Readable description of the event
error_description N String The description of the error
error_details N String Context of the error
workfile_deletion
event_payload Mandatory Format Notes/Instructions
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string Name of the user account that generated the event or '(unknown)' if the SID from the Isilon cannot be resolved
sid N string Windows Security ID associated with the user that generated the event on the Isilon
workspace_name N string Name of the Workspace where the event was generated
resource Y string Path (relative to mount point of share) to the File System object that was the subject of the event
originating_ip Y ip address ip address of the host where the event happened
sharename N String Name of the Samba share that generated the event
cmd Y String File system operation generating the event – eg. open, rmdir, unlink
status Y String Indication of whether the operation succeeded – 'ok' or 'failed + reason'
file_name N String Path (relative to mount point of share) to the File System object that was the subject of the event
detail N String Readable description of the event
error_description N String The description of the error
error_details N String Context of the error
workfile_rename
event_payload Mandatory Format Notes/Instructions
application_time_stamp Y ISO8601 Combined date and time format i.e. YYYY-MM-DD hh:mm:ss
user_name Y string Name of the user account that generated the event or '(unknown)' if the SID from the Isilon cannot be resolved
sid N string Windows Security ID associated with the user that generated the event on the Isilon
workspace_name N string Name of the Workspace where the event was generated
resource Y string Path (relative to mount point of share) to the File System object that was the subject of the event
originating_ip Y ip address ip address of the host where the event happened
sharename N String Name of the Samba share that generated the event
cmd Y String File system operation generating the event – eg. open, rmdir, unlink
status Y String Indication of whether the operation succeeded – 'ok' or 'failed + reason'
file_name N String Path (relative to mount point of share) to the File System object that was the subject of the event
new_file_name N String Secondary subject of the event – eg. the destination of rename, the name of the link for link
detail N String Readable description of the event
error_description N String The description of the error
error_details N String Context of the error

XAP Management API

workspace_creation
event_payload Mandatory Format Notes/Instructions
workspace_name Y String
user_name Y String Email address for the owner of the workspace
organisation Y String
workspace_deletion
event_payload Mandatory Format Notes/Instructions
workspace_name Y String
user_name Y String Email address for the owner of the workspace
organisation Y String
data_staging_area_added
event_payload Mandatory Format Notes/Instructions
workspace_name Y String
user_name Y String Email address for the owner of the workspace
organisation Y String
data_staging_area_deleted
event_payload Mandatory Format Notes/Instructions
workspace_name Y String
user_name Y String Email address for the owner of the workspace
organisation Y String
safe_added
event_payload Mandatory Format Notes/Instructions
workspace_name Y String
user_name Y String Email address for the owner of the workspace
organisation Y String
detail Y String Details the new SAFE level
safe_changed
event_payload Mandatory Format Notes/Instructions
workspace_name Y String
user_name Y String Email address for the owner of the workspace
organisation Y String
detail Y String Details the new SAFE level
safe_deleted
event_payload Mandatory Format Notes/Instructions
workspace_name Y String
user_name Y String Email address for the owner of the workspace
organisation Y String
detail Y String Details the new SAFE level (always 0 for delete)
virtual_desktop_added
event_payload Mandatory Format Notes/Instructions
workspace_name Y String
resource_name Y String User provided name for the VM
user_name Y String Email address for the owner of the workspace
organisation Y String
detail Y String Details the VM configuration in the format _HOSTNAME_, _TEMPLATE_, _CAPACITY
virtual_desktop_changed
event_payload Mandatory Format Notes/Instructions
workspace_name Y String
resource_name Y String User provided name for the VM
user_name Y String Email address for the owner of the workspace
organisation Y String
detail Y String Details the new capacity of the VM
virtual_desktop_deleted
event_payload Mandatory Format Notes/Instructions
workspace_name Y String
resource_name Y String User provided name for the VM
user_name Y String Email address for the owner of the workspace
organisation Y String
detail Y String Details the VM configuration in the format _HOSTNAME_, _TEMPLATE_, _CAPACITY
sandbox_duo
event_payload Mandatory Format Notes/Instructions
workspace_name Y String
resource_name Y String User provided name for the VM
user_name Y String Email address for the owner of the workspace
detail Y String Details the Duo authentication results