Logged Actions

The following tables identify and describe which user actions performed across various Cogynt applications are logged in the Audit Viewer application. Each audit log creates an entry with an Object and Action captured:

• Object: The data item that an action was performed against.
• Action: The action performed upon the object.

User Management

Object	Action	Description
user	user logged in	Logs when a user logs into Cogynt. This may not log if your authentication provider is a customized setup.
user	user logged out	Logs when a user logs out of Cogynt.
user	user account created	Accounts are created through users logging in through the authentication provider.
user	user account updated	Logs changes to a user's first name, last name, role, or group(s).
user	user account deleted	Logs when a user account is deleted.
group	group created	Logs when a group is created.
group	group updated	Logs when a group is updated.
group	group deleted	Logs when a group is deleted.
role	role created	Logs when a role is created.
role	role updated	Logs when a role is updated.
role	role deleted	Logs when a role is deleted.

Authoring

Object	Action	Description
deployment_target	deployment target created	Logs when a deployment target is created.
deployment_target	deployment target edited	Logs when a deployment target is edited.
deployment_target	deployment target deleted	Logs when a deployment target is deleted.
deployment_target	deployment target duplicated	Logs when a deployment target is duplicated.
flink_deployment	flink deployment created	Logs when a flink deployment is created.
flink_deployment	flink deployment deleted	Logs when a flink deployment is deleted.
flink_deployment	flink deployment edited	Logs when a flink deployment is edited.
flink_deployment	flink deployment duplicated	Logs when a flink deployment is duplicated.
flink_deployment	flink deployment started	Logs when a flink deployment is started.
flink_deployment	flink deployment paused	Logs when a flink deployment is paused.
flink_deployment	flink deployment resumed	Logs when a flink deployment is resumed.
flink_deployment	flink deployment cancelled	Logs when a flink deployment is cancelled/stopped.
project	project created	Logs when a project is created.
project	project edited	Logs when a project is edited.
project	project deleted	Logs when a project is deleted.
schema_discovery	schema discovered	Logs when a user runs a Schema Discovery.
user_data_schema	user data schema created	Logs when a user data schema is created.
user_data_schema	user data schema edited	Logs when a user data schema is edited.
user_data_schema	user data schema deleted	Logs when a user data schema is deleted.
user_data_schema	user data schema duplicated	Logs when a user data schema is duplicated.
event_type	event type created	Logs when an event type is created.
event_type	event type edited	Logs when an event type is edited.
event_type	event type deleted	Logs when an event type is deleted.
event_type	event type duplicated	Logs when an event type is duplicated.

Data Management

Object	Action	Description
data_import	attempted to import data	Logs when a user attempts to import data.
data_import	data import failed	Logs when a data import has failed.
data_import	data imported	Logs when a data was successfully imported.
data_import	data import aborted by user	Logs when a data import was aborted.
data_import	data manually entered	Logs when a user manual inputs data.
kafka_connector	connector created	Logs when a connector is created.
kafka_connector	connector edited	Logs when a connector is edited.
kafka_connector	connector deleted	Logs when a connector is deleted.
kafka_connector	connector launched	Logs when a connector is launched.
kafka_connector	connector paused	Logs when a connector is paused.
kafka_connector	connector resumed	Logs when a connector is resumed.
kafka_connector	connector stopped	Logs when a connector is stopped.

Workstation

Object	Action	Description
collection	collection created	Logs when a user creates a collection/case file.
collection	collection updated	Updates to a collection's tags, priority, name, description, assignee, etc. Adding notes or events are logged as separate actions. Attached events are logged as collection_item. Notes are logged as notes. Custom field value changes are logged as custom_field_value.
collection	collection deleted	Logs when a collection is deleted.
collection_item	collection item was added to collection	Collection items are events added to a collection.
collection_item	collection item was deleted from collection	Collection items are events added to a collection.
collection_field_template	created a new custom field template	Logs when a custom field template is created.
collection_field_template	deleted a new custom field template	Logs when a custom field template is deleted.
collection_field_template	updated a new custom field template	Logs when a custom field template is updated.
collection_field_template	updated a new custom field templates options	Logs when options are modified on select and checkbox custom field templates.
related_collection	related collection updated	Logs when a user links a collection as related.
related_collection	related collection updated	Logs when a user unlinks a related collection or clicks "undo" after linking a collection as related.
custom_field_value	updated a custom fields value	Logs when a user updates a custom field value on a collection.
ingestion	event definition was updated	Logs when an event_type's ingestion status is toggled between active, suspended, etc.
export_builder	export builder was created	Logs when an export builder template is created.
export_builder	export builder was updated	Logs when an export builder template is updated.
export_builder	export builder was deleted	Logs when an export builder template is deleted.
note	note was created	Logs when users creates comments on a collection.
note	note was updated	Logs when users update comments on a collection.
note	note was deleted	Logs when users delete comments on a collection.
notification	notification was dismissed	Logs when a user dismisses an event notification.
notification	notification was updated	Logs when a user updates an event notification. Updates include changing priority, tags, and assignee.
notification_setting	notification setting was created	Logs when a notification setting is created.
notification_setting	notification setting was updated	Logs when a notification setting is updated.
notification_setting	notification setting was deleted	Logs when a notification setting is deleted.
system_tag	system tag was created	Logs when a system tag is created.
system_tag	system tag was updated	Logs when a system tag is updated.
system_tag	system tag was deleted	Logs when a system tag is deleted.
manual_action	manual action was created/published	Logs when a user performs a manual action on an event.
text_search	text search was initiated	Logs when a user performs a "text" string search in the Events Explorer widget of Workstation.
search_facet	search facet filter modified	Logs when a user applies filters in Search Facets.
workstation_data	delete all data	Logs when a user performs the "Delete All Data" action in the Admin screen of Workstation. This deletes the majority of data from Workstation. Collections, notes on a collection, and any attachment tags do not get deleted.
workstation_data	reset drilldown data	Logs when a user clicks the Reset Drilldown Data button in the Admin screen of Workstation.
workstation_data	delete event definition data	Logs when a user deletes one or multiple selected event_types in the "Event Mode" deletion in the Admin screen of Workstation.
attachment	download attachment	Logs when a user downloads an attachment from a note on a collection.
attachment	attachment was created	Logs when a user uploads an attachment to a note.
attachment	attachment was deleted	Logs when a user deletes an attachment from a note.
report_builder	report builder was created	Logs when a report builder template is created.
report_builder	report builder was updated	Logs when a report builder template is updated.
report_builder	report builder was deleted	Logs when a report builder template is deleted.
event_detail_template	event_detail_template created	Logs when an event_detail_template is created.
event_detail_template	event_detail_template updated	Logs when an event_detail_template is updated.
event_detail_template	event_detail_template deleted	Logs when an event_detail_template is deleted.