BlueConic Audit Events API

The Audit Event API allows users to connect BlueConic to a SIEM system. We recommend using this API to periodically receive security-related activities based on a rolling window. The API has a 30-day retention period.The API logs the following audit events:| Object | Events ||:---------------------------|:-----------------------------------------------------------------------------------------------|| BlueConic hostname | Create, Update, Delete || BlueConic Support Access | Update (for each change) || Channel | Create, Update, Delete || Clean up rule | Create, Update, Delete || Connection | Create, Update, Delete, Manual run, Scheduled run || Dashboard | Create, Update, Delete || Dialogue | Create, Update, Delete || Domain Group | Create, Update, Delete || Gen AI Setting | Update (for each change) || Group | Read, Update, Delete || Group type | Create, Update, Delete || Ip range | Create, Update, Delete || Language | Create, Update, Delete || Lifecycle | Create, Update, Delete || Merge rule | Create, Update, Delete || Models | Create, Update, Delete || Notebook | Create, Update, Delete, Manual run, Scheduled run, Editor run || OAuth application | Create, Update, Delete || OAuth token | Create, Update, Delete || Objective | Create, Update, Delete || Plugin | Create, Update, Delete || Privacy setting | Update (for each change) || Profile | Read, Update, Delete || Profile property | Create, Update, Delete || Role | Create, Update, Delete || Segment | Create, Update, Delete || Single Sign On Setting | Update (for each change) || Inactvity Setting | Update (for each change) || Supported Legislation Zone | Create, Delete, Update || Timeline Event Rollup | Create, Update, Delete || Timeline Event Type | Create, Update, Delete || Tracker | Create, Update, Delete || User | Login, Login failed, Logout, Create, Update, Delete, Password reset requested, Password change |Only Profile and Group viewed, updated, or deleted by a user from the Profile and Groups tab are logged.The following events are not considered as human actions, and therefore not covered in the PlatformAudit Event API:- Connections that import or export profiles.- Profile and group creation (Profiles can only be created by a visitor or an import connection).**Event data**The following event data is available:| Field | Description | Example values || :--- | :--- |:-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------||date|Datetime in UTC when the event occurred. The date is in the https://www.ietf.org/rfc/rfc3339.txt format.| 2025-04-15T11:24:01.183Z ||username|(BlueConic) Identifier (email address) of the user who did the action.Value is empty for failed login attempts.| test@blueconic.com ||objectType|Object of the action.| BLUECONIC_HOSTNAMEBLUECONIC_SUPPORT_ACCESS_SETTINGCHANNELCLEAN_UP_RULECONNECTIONDASHBOARDDIALOGUEDOMAIN_GROUPGEN_AI_SETTINGGROUPGROUP_TYPEIP_RANGELANGUAGELIFECYCLELISTENERMERGE_RULENOTEBOOKOBJECTIVEPLUGINPRIVACY_SETTINGPROFILEPROFILE_PROPERTYROLESEGMENTSINGLE_SIGN_ON_SETTINGSUPPORTED_LEGISLATION_ZONETRACKERUSER ||objectId|Email address in case of a user. In the case of LOGIN_FAILED and a user tried to login with an invalid format email address, it could be that the user filled the password in the email address field. In that case the objectId is emptyGrouptype_GroupID in case of a group For PRIVACY_SETTING and SINGLE_SIGN_ON_SETTING, the objectId is the name(s) of the changed setting. E.g. Status, Identity_Provider_Issuer_URL_Entity_ID. For BLUECONIC_SUPPORT_ACCESS_SETTING the objectID contains the new settings. `"objects" : [ {"name" : "No Access", "id" : "none" } ]` or `"objects" : [ {"name" : "User name here", "id" : "user1@blueconic.com" },{"name" : "User name 2 here", "id" : "user2@blueconic.com" }], (contains the new list)` or`"objects" : [ {"name" : "All BlueConic support employees", "id" : "all" } ],`UUID or identifier in case of other object types.| 1b1e50a5-c46a-4309-a95c-d4e19985fbbbtest@blueconic.comtest_objectivetest_profile_property ||objectName|Human readable name of the object.For Profiles, the name is determined by the first value that is not empty:fullnameemailBlueConic ID (UUID)For Users, the name is determined by the first value that is not empty:fullnameemailIn the case of LOGIN_FAILED and a user tried to login with an invalid format email address, it could be that the user filled the password in the email address field. In that case, the objectName is empty.For groups, the name is the group id.For PRIVACY_SETTING and SINGLE_SIGN_ON_SETTING, the objectName is the name(s) of the changed setting. E.g. Status, Identity_Provider_Issuer_URL_Entity_ID.For BLUECONIC_SUPPORT_ACCESS_SETTING the objectName contains the new settings.`"objects" : [ {"name" : "No Access", "id" : "none" } ]` or `"objects" : [ {"name" : "User name here", "id" : "user1@blueconic.com" },{"name" : "User name 2 here", "id" : "user2@blueconic.com" }],` (contains the new list) or`"objects" : [ {"name" : "All BlueConic support employees", "id" : "all" } ],`| SFTP connectiontest@blueconic.omKeyword Interest Ranking ||operation| Action performed on the object. | CREATEUPDATEDELETEEDITOR_RUNREADLOGINLOGIN_FAILEDLOGOUTMANUAL_RUNPASSWORD_RESET_REQUESTEDPASSWORD_CHANGESCHEDULED_RUN |ipAddress| The source IP address from which the event was triggered. | 192.168.1.100 ||application| The application that performed the audit event operation. | blueconic |