Integrity and event reference

Understand tamper protection, categories, and common event types.

Audit logs are tamper-evident. Each entry includes a content hash and the previous entry hash.

Any change to history breaks the chain.

What we log

Events are grouped into these categories:

• Authentication: logins, logouts, password changes, 2FA, session actions
• Authorization: access denied attempts
• Data access: recording views, downloads, exports
• Data changes: create, edit, delete recordings, captures, folders, labels
• Admin actions: SSO/SCIM changes, integrations, automation and triage rules
• Security: suspicious activity, rate limiting, invalid tokens

Event reference (examples)

Authentication

• user.login (Low)
• user.login_failed (Medium)
• user.password_changed (Medium)
• user.two_factor_enabled (Medium)
• user.two_factor_disabled (High)
• user.saml_login (Low)
• user.api_token_created (Medium)
• user.api_token_deleted (Medium)
• user.mcp_token_created (Medium)
• user.mcp_token_deleted (Medium)

Data

• recording.created (Low)
• recording.updated (Low)
• recording.deleted (Medium)
• recording.bulk_deleted (High)
• capture.created (Low)
• capture.updated (Low)
• capture.deleted (Medium)
• capture.bulk_deleted (High)
• folder.created (Low)
• folder.updated (Low)
• folder.deleted (Medium)
• label.created (Low)
• label.updated (Low)
• label.deleted (Low)

Authorization

• access.denied (Medium)