Integrity and event reference

Understand tamper protection, categories, and common event types.

Audit logs are tamper-evident. Each entry includes a content hash and the previous entry hash.

Any change to history breaks the chain.

What we log

Events are grouped into these categories:

• Authentication: logins, logouts, password changes, 2FA, session actions

• Authorization: access denied attempts

• Data access: recording views, downloads, exports

• Data changes: create, edit, delete recordings, captures, folders, labels

• Admin actions: SSO/SCIM changes, integrations, automation and triage rules

• Security: suspicious activity, rate limiting, invalid tokens

Event reference (examples)

Authentication

• user.login (Low)

• user.login_failed (Medium)

• user.password_changed (Medium)

• user.two_factor_enabled (Medium)

• user.two_factor_disabled (High)

• user.saml_login (Low)

• user.api_token_created (Medium)

• user.api_token_deleted (Medium)

• user.mcp_token_created (Medium)

• user.mcp_token_deleted (Medium)

Data

• recording.created (Low)

• recording.updated (Low)

• recording.deleted (Medium)

• recording.bulk_deleted (High)

• capture.created (Low)

• capture.updated (Low)

• capture.deleted (Medium)

• capture.bulk_deleted (High)

• folder.created (Low)

• folder.updated (Low)

• folder.deleted (Medium)

• label.created (Low)

• label.updated (Low)

• label.deleted (Low)

Authorization

• access.denied (Medium)