Overview

Audit logs provide a comprehensive record of user and system events within a workspace. Use them to monitor workspace activity, investigate incidents, and export data to your SIEM, storage bucket, or downstream workflows.

Log entries are scoped to the workspace where the API key was created. The API key must be created by a user with the Owner role. Torq recommends using a service API key.

Access audit logs using Torq steps or the API.

Events that generate log entries

Log entries are created for events that create or modify data (create, update, and delete actions) across all main resources. Read actions do not generate log entries.

Log entries are typically available immediately after the event occurs. In some cases, delivery can take up to 5 minutes.

When a List audit logs request is sent, the response contains entries for the workspace on which the API key was created.

Users

User invited
User accepted invitation
User role updated
User deleted
User logged in
User logged out
User switched accounts

Groups

Group created
Group updated
Group deleted
Group members added
Group members removed

Workflows

Workflow created
Workflow deleted
Workflow updated
Workflow published
Workflow unpublished
Workflow edited
Workflow reverted
Workflow enabled
Workflow disabled
Workflow imported

Workflow tags are available in the tags array under extra_data for every log entry created for a workflow-related action. Export the log data to filter, aggregate, and use it for automation according to the tags. If the workflow has no tags, the tags array is omitted from the log entry.

Interact

Interaction Submitted

Workspace variables

Workspace variable created
Workspace variable updated
Workspace variable deleted

Workflow notifications

Email address added
Email address removed
Webhook added
Webhook removed
Webhook authentication headers added
Webhook authentication headers removed
Webhook authentication headers updated

API keys

API key enabled
API key deleted

Secrets

Secret created
Secret deleted
Secret updated

Integrations

Integration created
Integration deleted
Integration updated

Custom steps

Custom step created
Custom step deleted

Step Runners

Runner created
Runner deleted

IdP connections

IdP connection created
IdP connection updated
IdP connection enabled
IdP connection disabled

IdP claims mappings

IdP claims mapping created
IdP claims mapping updated
IdP claims mapping deleted

Cases

Case Created
Case Updated
Case Deleted
Observable Created
Observable Updated
Observable Associated with Case
Observable Dissociated from Case
Attachment Added to Case
Attachment Removed from Case
Workspace Configuration Updated
Cases Linked
Link Between Cases Updated
Cases Unlinked
Case Context Updated
Note Created
Note Updated
Note Removed
SLA timer updated
Case Restriction Collaborators Updated
Attachment Downloaded

Actionplans

Actionplan Created
Actionplan Deleted
Actionplan Updated

Dashboards

Dashboard Created
Dashboard Settings Updated
Dashboard Layout Updated
Dashboard Deleted
Dashboard Data Exported
Widget Data Exported
Dashboard Access Updated

Socrates Tools

Agentic tool created
Agentic tool updated
Agentic tool deleted
Agentic tool enabled
Agentic tool disabled

SSO

User login failed

Security settings

Security Settings Updated

Sample log entry

{
   "account_id": "1d8*****-****-4f2a-****-*****fe50a57",
   "account_name": "mrsactor",
   "action": "Workflow updated",
   "actor_name": "Mrs. Actor ",
   "actor_type": "web_app",
   "email": "mrs.actor@torqy.io",
   "extra_data": {
     "revision_id": "f31bb***-f5**-48**-a1**-749cca80f2**",
     "tags": [
       "tag1",
       "tag2",
       "tag3"
     ]
   },
   "id": "8aa*****-****-40a8-b1b1-40811*******",
   "ip": "77.***.***.237",
   "resource_id": "a0f5b***-****-****-****-***7d91d38**",
   "resource_name": "Audit log (step)",
   "timestamp": "2022-05-15T08:51:11.900970Z",
   "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko)    \t\t Chrome/101.0.****.5* Safari/537.36"
}

How to use

Collect audit logs

The Gather Torq audit logs template creates a nested workflow that collects audit or activity logs and returns them to a parent workflow as a JSON array.

Import the template: Open the Gather Torq audit logs template and import it to your workspace.
Customize: Adjust the template parameters to match your requirements.
Invoke from a parent workflow: Call the nested workflow from a parent workflow. It returns a JSON array of log entries from the specified timeframe.

Search audit logs

The Search in Torq Audit Logs template creates an interactive workflow to search audit events by action, email, source, and other fields.

Import the template: Open the Search in Torq Audit Logs template and import it to your workspace.
Run: Execute the workflow and provide the search parameters when prompted.

Audit Logs: Streamline Auditing with Torq