Appearance

Audit Logs ​

Flowstate logs security-relevant events for compliance reporting, incident investigation, and operational visibility. Every authentication attempt, configuration change, API call, and data modification generates a structured audit event that is retained and queryable from the Flowstate UI.

Overview ​

The audit log captures a comprehensive record of activity across your Flowstate tenant. Each event includes the actor who performed the action, the resource that was affected, a timestamp, and contextual details. Events are categorized and assigned a severity level so you can filter, search, and alert on the activity that matters most.

Event Categories ​

Audit events are organized into five categories:

CategoryDescriptionExample Events
authenticationSign-in, sign-out, and session activityLogin success, login failure, magic link sent, SSO redirect, session expiry
auditConfiguration and settings changesAuth provider created, role mapping updated, user role changed, user deactivated
api_activityREST API usage and key lifecycleAPI key created, API key revoked, API request, rate limit exceeded
data_accessReads and writes to workforce planning dataEmployee created, contractor updated, plan published, report exported
infrastructureSystem-level integration eventsSCIM sync completed, SIEM delivery failed, webhook delivery

Severity Levels ​

Each event is assigned a severity level indicating its security significance:

SeverityDescriptionExamples
criticalImmediate attention requiredMultiple failed login attempts, API key compromised
highSignificant security eventAuth provider deleted, admin role granted, rate limit exceeded
mediumNotable activity worth trackingNew API key created, user deactivated, employee deleted
lowRoutine operational eventsSuccessful login, API request, employee updated, data export
infoInformational, low-priority eventsMagic link sent, session refreshed, SCIM sync completed

Event Payload Structure ​

Every audit event follows a consistent JSON structure:

json
{
  "id": "evt_x7k9m2p4q1w3e5r8",
  "timestamp": "2026-03-11T14:32:07.123Z",
  "category": "authentication",
  "type": "login.success",
  "severity": "low",
  "actor": {
    "userId": "clx1a2b3c4d5e6f7g8h9",
    "email": "jane.chen@acme.com",
    "ipAddress": "203.0.113.42",
    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)"
  },
  "resource": {
    "type": "session",
    "id": "ses_r8t3l1m1t9a2b3c4"
  },
  "details": {
    "method": "saml",
    "provider": "Okta SSO",
    "domain": "acme.com"
  },
  "organization": {
    "id": "clx9o8r7g6i5d4",
    "name": "Acme Corp"
  },
  "tenant": "acme"
}

Payload Fields ​

FieldTypeDescription
idstringUnique event identifier
timestampstringISO 8601 timestamp with millisecond precision
categorystringEvent category (see table above)
typestringSpecific event type (e.g., login.success)
severitystringEvent severity level
actor.userIdstringID of the user who triggered the event
actor.emailstringEmail of the actor
actor.ipAddressstringSource IP address
actor.userAgentstringBrowser or client user agent string
resource.typestringType of resource affected
resource.idstringID of the affected resource
detailsobjectEvent-specific metadata
organization.idstringOrganization ID
organization.namestringOrganization display name
tenantstringTenant subdomain

Common Event Types ​

The following table lists the most common event types across all categories:

Authentication Events ​

TypeSeverityDescription
login.successlowUser signed in successfully
login.failuremediumFailed sign-in attempt
login.failure.repeatedcriticalMultiple failed attempts for one account
magic_link.sentinfoMagic link email dispatched
sso.redirectinfoUser redirected to SSO provider
session.expiredinfoUser session expired

Audit Events ​

TypeSeverityDescription
auth_provider.createdhighNew auth provider configured
auth_provider.updatedhighAuth provider settings changed
auth_provider.deletedhighAuth provider removed
role_mapping.updatedhighGroup-to-role mapping changed
user.role_changedhighUser's role was changed
user.deactivatedmediumUser account deactivated

API Activity Events ​

TypeSeverityDescription
api_key.createdmediumNew API key generated
api_key.revokedmediumAPI key revoked
api_key.expiredmediumAPI key reached expiration
api.requestlowAPI endpoint called
api.rate_limitedhighRate limit exceeded

Data Access Events ​

TypeSeverityDescription
employee.createdlowEmployee record created
employee.updatedlowEmployee record modified
employee.deletedmediumEmployee record deleted
contractor.createdlowContractor record created
contractor.updatedlowContractor record modified
contractor.deletedmediumContractor record deleted
team.createdlowTeam created
team.updatedlowTeam structure modified
team.deletedmediumTeam deleted
project.createdlowProject created
project.updatedlowProject modified
project.deletedmediumProject deleted
plan.publishedmediumScenario plan published
report.exportedlowReport or data export generated

Infrastructure Events ​

TypeSeverityDescription
scim.sync_completedinfoSCIM provisioning sync completed
siem.delivery_failedhighFailed to deliver events to SIEM endpoint
webhook.delivery_failedhighFailed to deliver webhook payload

Viewing Audit Logs ​

Navigate to Settings > Security > Audit Logs to view the audit log for your organization.

Filtering ​

Use the filter controls to narrow down the log:

FilterDescription
CategoryFilter by event category (authentication, audit, api_activity, data_access, infrastructure)
SeverityFilter by minimum severity level (critical, high, medium, low, info)
Date RangeRestrict to a specific time window
ActorSearch by user email or user ID

TIP

Start with the critical and high severity filters when investigating a security incident. Expand to medium and low once you have identified the relevant time window and actors.

Event Detail View ​

Click on any event in the log to view its full payload, including the details object with event-specific metadata. This is useful for understanding exactly what changed -- for example, which fields were modified on an employee record or which permission scopes were granted to a new API key.

Retention ​

Audit logs are retained for compliance purposes and are available for the lifetime of your Flowstate tenant. Events cannot be modified or deleted by any user, including tenant administrators.

TIP

For organizations with regulatory requirements (SOC 2, ISO 27001, GDPR), the immutable audit log provides an authoritative record of all security-relevant activity. Export audit data periodically for long-term archival if your compliance framework requires it.

SIEM Integration ​

For real-time streaming of audit events to an external security platform, configure a SIEM integration. SIEM integration delivers the same event payloads described on this page to your Splunk, Microsoft Sentinel, Datadog, or custom HTTPS endpoint as they occur.

This is complementary to the in-app audit log:

CapabilityAudit Logs (In-App)SIEM Integration
Viewing eventsFlowstate UIYour SIEM platform
FilteringCategory, severity, date, actorFull SIEM query language
AlertingNot availableConfigure in your SIEM
CorrelationFlowstate events onlyCorrelate with other systems
RetentionManaged by FlowstateManaged by your SIEM

TIP

Use the in-app audit log for quick investigations and ad-hoc queries. Use SIEM integration for automated alerting, cross-system correlation, and long-term analytics.

Required Permissions ​

ActionPermission
View audit logsAUDIT_VIEW
Configure audit settingsAUDIT_CONFIGURE
Confirm audit findingsAUDIT_CONFIRM
Export audit dataAUDIT_EXPORT

Best Practices ​

  1. Review audit logs regularly -- Schedule periodic reviews of high-severity events, especially login.failure.repeated, auth_provider.*, and user.role_changed events. These may indicate unauthorized access attempts or unintended configuration changes.
  2. Set up SIEM alerts for critical events -- Configure alerts in your SIEM platform for critical-severity events such as repeated login failures, auth provider changes, and API rate limiting. Automated alerts catch incidents faster than manual review.
  3. Investigate anomalies promptly -- If you see unusual patterns (logins from unexpected IP addresses, API keys used outside business hours, bulk data exports), investigate immediately. The audit log provides the actor, timestamp, and resource details you need to assess the situation.
  4. Use audit logs for compliance reporting -- Export audit data on a regular cadence to satisfy compliance requirements. The structured event format integrates well with GRC (governance, risk, and compliance) tools.
  5. Correlate with SIEM data -- If you use SIEM integration, correlate Flowstate audit events with events from other systems (VPN logs, IdP logs, endpoint detection) to build a complete picture of security incidents.
  6. Restrict audit access -- The AUDIT_VIEW and AUDIT_EXPORT permissions should be limited to security, compliance, and IT administration roles. Not every user needs access to the full audit trail.

Flowstate Documentation

Copyright 2024-2026 Flowstate Inc.