What audit logs capture
Every authenticated API call to CDF produces an audit log entry. The entry answers four questions:
Audit logs capture details from all requests made with valid access tokens.
Sometimes, audit logs contain personally identifiable information (PII), IP addresses, and other sensitive data. Treat audit log contents as confidential and restrict access to people with the appropriate security clearance.
Audit logs (and associated detail) should generally be consumed and analyzed in a separate purpose-built system for security monitoring — a security information and event management (SIEM) solution — owned by the customer.
Delivery and availability
Audit logs are delivered as a Delta Lake table to the cloud storage destination you configure. Under normal operating conditions, log entries are available in your storage within one hour of the corresponding API call being made. In rare, unforeseen circumstances — such as infrastructure disruptions or exceptional system load — delivery may be delayed by up to 12 hours. Such delays are uncommon and do not indicate data loss; entries are durably queued and will be delivered once normal operation resumes. For information on configuring your storage destination and querying delivered logs, see Setting up audit log streaming and Audit log query reference.Audit log schema
Each audit log entry contains the following fields.Headers such as
x-cdp-sdk, x-cdp-app, and x-cdp-clienttag are captured inside requestHeaders only when the calling client sets them. They are absent from the map when not present in the original request.