Enterprise Audit Logs Expanded: 65+ New Event Types for Comprehensive Compliance and Security Coverage

A Major Expansion for Audit Logs

Enterprise platform audit capabilities have been upgraded again. The latest update adds coverage for more than 65 new event types to Audit Logs. For enterprise administrators relying on the platform for large-scale deployments, this means that a significantly broader range of critical operations within the system can now be fully recorded and traced.

This expansion isn't limited to a single module — it spans multiple core domains, including Projects, Workspaces, Deployments, Account Security, SSO and SCIM, Connectors, Secrets, and Agent activity. This breadth of coverage gives enterprises a unified view of nearly all critical operations occurring across their organization.

A Closer Look at Coverage

The newly added event categories signal a systematic strengthening of enterprise security governance. Breaking them down reveals that each category addresses a high-risk area in enterprise IT governance.

Identity and Access Management

The inclusion of SSO (Single Sign-On) and SCIM (System for Cross-domain Identity Management) events is particularly significant. These two technologies form the backbone of enterprise identity governance — any configuration change, user sync, or permission adjustment can impact access control across the entire organization. Bringing them into the audit scope means that identity-layer operations are now traceable and auditable.

SSO allows users to access multiple systems with a single set of credentials, typically implemented through identity providers like Okta, Azure AD, or Google Workspace. SCIM is a standardized protocol for automatically syncing user accounts, roles, and permissions between identity providers and applications, eliminating the lag and errors of manual management. Together, they form the core of "zero-touch" user lifecycle management: automatically provisioning access when employees join and immediately revoking it when they leave. Because of their broad reach, any unauthorized change to SSO configurations or SCIM sync rules could result in widespread permission exposure or access disruption — making their inclusion in audit logs one of the highest-priority improvements in identity security governance.

Secrets and Connectors

Operations involving Secrets and Connectors typically touch external system integrations and sensitive credential management. With these events now logged, administrators can clearly see who accessed or modified sensitive configurations and when — which is critical for mitigating insider threats and vulnerabilities in third-party integrations.

Agent Activity Tracking

Notably, Agent activity has been designated as a standalone audit category. As AI Agents take on an increasing number of automated tasks in enterprise workflows, recording and reviewing their behavior is becoming a new imperative for AI Governance. This change reflects the platform's growing emphasis on Agent observability.

AI Governance refers to the systematic monitoring, review, and accountability mechanisms applied to the behavior, decisions, and operations of AI systems. Unlike traditional software, AI Agents can autonomously call APIs, modify data, and trigger workflows — their action chains often span multiple systems and can be difficult to predict. When Agents operate with elevated privileges in production environments, the absence of complete operational records makes root cause analysis nearly impossible when data anomalies or security incidents occur. Designating Agent activity as a distinct audit category essentially extends the mature accountability logic from human operations to automated actors — recording what an Agent did, on whose behalf, and at what time. This is a foundational requirement for building trustworthy AI systems and an increasingly central concern in regulatory AI compliance frameworks.

Practical Value for Enterprise Administrators

According to official documentation, enterprise account administrators can apply this expanded event history to three core scenarios: Compliance, Security Investigations, and Operational Troubleshooting.

From a compliance standpoint, a complete operational history forms the foundational evidence chain for meeting audit requirements under frameworks such as SOC 2 and ISO 27001. For security investigations, rich log data helps security teams quickly pinpoint the source of anomalies and reconstruct attack paths. On the operational side, activity history helps teams understand the context behind changes in system state.

Flexible Log Access Options

This update also emphasizes log accessibility. Administrators can either view event history directly through the built-in Audit Log Portal or export logs to a configured SIEM (Security Information and Event Management) destination.

SIEM integration is especially valuable for large enterprises, as it allows security teams to incorporate platform logs into a unified security monitoring framework — enabling cross-source analysis and centralized threat detection and response. This dual-channel design accommodates both lightweight viewing and deep integration needs.

SIEM (Security Information and Event Management) systems are the core hub of enterprise Security Operations Centers (SOC), with representative products including Splunk, Microsoft Sentinel, and IBM QRadar. Their core capability lies in aggregating logs from disparate systems and using correlation rules and behavioral analysis to identify cross-system anomaly patterns. For example, if a user shows an unusual login in SSO logs while simultaneously showing high-frequency access in secrets audit logs, a SIEM can correlate these two independent events into a single high-confidence alert. Connecting platform audit logs to a SIEM essentially brings the AI platform's operational behavior into the enterprise's broader security visibility — rather than viewing it in isolation — which is decisive for large organizations that require unified compliance reporting or real-time threat response.

Summary

Expanding audit log coverage from a limited set of core events to 65+ new event types represents a substantive advancement in enterprise platform security and compliance capabilities. For organizations scaling their AI adoption — especially those introducing Agent-based automation — mature observability infrastructure like this is a prerequisite for moving from experimentation to production. Administrators should take time to familiarize themselves with the newly added event types and evaluate how to integrate them into their existing security monitoring workflows.