Legacy to UAM Migration

Universal audit model (UAM) is Immuta's consistent structure for all Immuta system and user query audit logs. This reference guide maps the legacy audit events to the new UAM events and provides example schemas of all the UAM events available in Immuta.

To learn more about Immuta's audit, see the UAM reference page.

Events and descriptions

Legacy eventUAM eventDescription

accessGroup

An audit event for managing a group.

accessUser

An audit event for managing a user.

acknowledgePurposes

An audit event for acknowledging a purpose for a project in Immuta.

addToProject

An audit event for adding a data source to an Immuta project.

apiKey

An audit event for when an API key is created or deleted on the Immuta app settings page or from an Immuta user's profile page.

authenticate

An audit event for a user authenticating in Immuta.

-

An audit event for a user logging out of Immuta.

catalogUpdate

An audit event for syncing an external catalog to tag Immuta data sources.

configurationUpdate

An audit event for updates to the configuration on the Immuta app settings page.

collectionCreated

An audit event for creating a domain.

collectionDataSourceAdded

An audit event for updating a domain's data sources.

collectionDataSourceRemoved

An audit event for updating a domain's data sources.

collectionDataSourceUpdated

An audit event for updating a domain's data sources.

collectionDeleted

An audit event for deleting a domain.

collectionPermissionGranted

An audit event for granting or revoking a user's domain-related permissions.

collectionPermissionRevoked

An audit event for granting or revoking a user's domain-related permissions.

collectionUpdated

An audit event for updating an Immuta domain.

dataSourceCreate

An audit event for registering a table as an Immuta data source.

dataSourceDelete

An audit event for deleting a data source in Immuta.

-

An audit event for disabling a data source in Immuta.

dataSourceSave

An audit event for updating a data source with the new data source details.

dataSourceSubscription

The events for data source and project subscriptions.

dataSourceUpdate

An audit event for updating a data source with the new data source details.

externalUserIdChanged

An audit event for updating user details in Immuta.

globalPolicyApplied

An audit event for applying a global policy to a data source.

globalPolicyApprovalRescinded

An audit event for a global policy approval rescinded in the approve to promote workflow.

globalPolicyApproved

An audit event for a global policy approved in the approve to promote workflow.

globalPolicyCertify

An audit event for a global policy being certified by a data owner for their data source.

-

An audit event for a global policy being decertified on a data source.

globalPolicyChangeRequested

An audit event for requested edits on a global policy in the approve to promote workflow.

globalPolicyConflictResolved

An audit event for a global policy conflict being resolved on a data source.

globalPolicyCreate

An audit event for creating a global policy.

globalPolicyDelete

An audit event for deleting a global policy.

globalPolicyDisabled

An audit event for a data owner disabling a global policy from their data source.

globalPolicyPromoted

An audit event for when a global policy is fully approved and promoted to production in the approve to promote workflow.

globalPolicyRemoved

An audit event for a data owner removing a global policy from their data source.

globalPolicyReviewRequested

An audit event for when a global policy is ready and requests a review in the approve to promote workflow.

globalPolicyUpdate

An audit event for updating a global policy with the new global policy details.

licenseCreate

An audit event for creating an Immuta license.

licenseDelete

An audit event for deleting an Immuta license.

nativeQuery

  • SnowflakeQuery

  • DatabricksQuery

An audit event for a user's query in Snowflake or Databricks Unity Catalog. See the Snowflake UAM page or the Databricks Unity Catalog UAM page for additional details about the audit event schema.

policyAdjustmentCreate

An audit event for creating a policy adjustment in an Immuta project.

policyAdjustmentDelete

An audit event for deleting a policy adjustment in an Immuta project.

policyCertificationExpired

An audit event for a global policy certification expiring on a data source.

policyHandlerCreate

An audit event for creating a local policy for an Immuta data source.

policyHandlerUpdate

An audit event for updating a local policy on an Immuta data source.

prestoQuery

TrinoQuery

An audit event for a user's query in Starburst (Trino). See the Starburst (Trino) UAM page for additional details about the audit event schema.

projectCreate

An audit event for creating a project in Immuta.

projectDelete

An audit event for deleting a project in Immuta.

-

An audit event for disabling a project in Immuta.

projectPurposeApprove

An audit event for approving a purpose for a project in Immuta.

projectPurposeDeny

An audit event for denying a purpose for a project in Immuta.

projectSubscription

The events for data source and project subscriptions.

projectUpdate

An audit event for updating a project in Immuta.

purposeDelete

An audit event for deleting a purpose in Immuta.

purposeUpdate

An audit event for updating a purpose in Immuta.

purposeCreate

An audit event for creating a purpose in Immuta.

removeFromProject

An audit event for removing a data source from a project.

sddClassifierCreated

An audit event for creating a sensitive data discovery (SDD) column name regex, regex, or dictionary pattern.

sddClassifierDeleted

An audit event for deleting a sensitive data discovery (SDD) pattern.

sddClassifierUpdated

An audit event for updating a sensitive data discovery (SDD) column name regex, regex, or dictionary pattern.

sddDatasourceTagUpdate

An audit event for the results from a sensitive data discovery (SDD) run that updates the tags on Immuta data sources.

sddTemplateApplied

An audit event for applying an identification framework to data sources.

sddTemplateCreated

An audit event for creating an identification framework.

sddTemplateDeleted

An audit event for deleting an identification framework.

sddTemplateUpdated

An audit event for updating an identification framework.

spark

DatabricksQuery

An audit event for a user's query in Databricks. See the Databricks Spark UAM page for additional details about the audit event schema.

tagAdded

An audit event for applying a tag to an object in Immuta.

tagCreated

An audit event for creating a tag in Immuta.

tagDeleted

An audit event for deleting a tag in Immuta.

tagRemoved

An audit event for removing a tag from an object in Immuta.

tagUpdated

An audit event for updating a tag in Immuta.

webhookCreate

An audit event for creating an Immuta webhook.

webhookDelete

An audit event for deleting an Immuta webhook.

ApiKeyCreated event

  • Event: ApiKeyCreated

  • Legacy event: apiKey

  • Description: An audit event for when an API key is created on the Immuta app settings page or from an Immuta user's profile page.

{
    "relatedResources": [],
    "auditPayload": {
        "type": "ApiKeyCreatedAuditPayload",
        "apiKeyId": "1112158",
        "name": "T1",
        "version": 1
    },
    "action": "CREATE",
    "tenantId": "your-immuta-tenant.com",
    "actionStatus": "SUCCESS",
    "eventTimestamp": "2024-01-25T18:04:58.368Z",
    "actor": {
        "id": "taylor@immuta.com",
        "identityProvider": "bim",
        "profileId": "1",
        "type": "USER_ACTOR",
        "name": "Taylor Smith"
    },
    "targetType": "APIKEY",
    "id": "d9dc3cee-98d0-47d6-ba81-e0b38f9f4014",
    "receivedTimestamp": "2024-01-25T18:04:58.505Z",
    "actorIp": "xxx.xx.xx.xx",
    "targets": [],
    "requestId": "60c68659-ac83-5299-bf3e-14856178a0de",
    "sessionId": "9c553d7ace0aa3ee735fd3c14f737bc6"
}

ApiKeyDeleted event

  • Event: ApiKeyDeleted

  • Legacy event: apiKey

  • Description: An audit event for when an API key is deleted on the Immuta app settings page or from an Immuta user's profile page.

{
    "id": "fe47ddd1-fd22-4dcf-9648-83950a10ef34",
    "targetType": "APIKEY",
    "receivedTimestamp": "2024-01-25T18:08:28.891Z",
    "actor": {
        "type": "USER_ACTOR",
        "identityProvider": "bim",
        "id": "taylor@immuta.com",
        "profileId": "1",
        "name": "Taylor Smith"
    },
    "requestId": "220c7faa-7f56-5d8c-aa31-8ac2212b7707",
    "sessionId": "9c553d7ace0aa3ee735fd3c14f737bc6",
    "targets": [],
    "actorIp": "xxx.xx.xx.xx",
    "relatedResources": [],
    "auditPayload": {
        "type": "ApiKeyDeletedAuditPayload",
        "apiKeyId": "1112158",
        "version": 1
    },
    "eventTimestamp": "2024-01-25T18:08:21.319Z",
    "action": "DELETE",
    "actionStatus": "SUCCESS",
    "tenantId": "your-immuta-tenant.com"
}

AttributeApplied event

  • Event: AttributeApplied

  • Legacy events: accessUser and accessGroup

  • Description: An audit event for an attribute applied to a group or user.

  • Additional parameter details: targetType will specify whether the attribute was added to a USER or GROUP.

{
    "actorIp": "xxx.xx.xx.xx",
    "targets": [
        {
            "name": "Deepu Murty",
            "id": "deepu@immuta.com",
            "identityProvider": "bim",
            "profileId": "20",
            "type": "USER"
        }
    ],
    "requestId": "e45652cd-4d00-5def-8e8c-aca696822fc2",
    "sessionId": "cdbffff8804103418350947c6586712c",
    "actor": {
        "type": "USER_ACTOR",
        "profileId": "1",
        "id": "taylor@immuta.com",
        "identityProvider": "bim",
        "name": "Taylor Smith"
    },
    "id": "63f111a7-0835-4696-8fdb-188130c44fac",
    "targetType": "USER",
    "receivedTimestamp": "2023-09-13T14:36:02.926Z",
    "action": "ATTRIBUTE_APPLY",
    "tenantId": "your-immuta-tenant.com",
    "actionStatus": "SUCCESS",
    "eventTimestamp": "2023-09-13T14:36:02.688Z",
    "relatedResources": [
        {
            "values": ["Product"],
            "name": "Department",
            "id": "department",
            "type": "ATTRIBUTE"
        }
    ],
    "auditPayload": {
        "entityType": "USER",
        "type": "AttributeAppliedAuditPayload",
        "version": 1,
        "attributes": [
            {
                "values": ["Product"],
                "attribute": "Department"
            }
        ],
        "entityIdProvider": "bim",
        "entityId": "deepu@immuta.com"
    }
}

AttributeRemoved event

  • Event: AttributeRemoved

  • Legacy events: accessUser and accessGroup

  • Description: An audit event for an attribute removed from a group or user.

  • Additional parameter details: targetType will specify whether the attribute was removed from a USER or GROUP.

{
    "relatedResources": [
        {
            "values": ["UNCLASSIFIED"],
            "name": "classification",
            "id": "classification",
            "type": "ATTRIBUTE"
        }
    ],
    "auditPayload": {
        "type": "AttributeRemovedAuditPayload",
        "entityType": "USER",
        "version": 1,
        "attributes": [
            {
                "values": ["UNCLASSIFIED"],
                "attribute": "classification"
            }
        ],
        "entityIdProvider": "bim",
        "entityId": "deepu@immuta.com"
    },
    "action": "ATTRIBUTE_REMOVE",
    "actionStatus": "SUCCESS",
    "tenantId": "your-immuta-tenant.com",
    "eventTimestamp": "2024-02-20T19:46:50.259Z",
    "actor": {
        "profileId": "1",
        "id": "taylor@immuta.com",
        "identityProvider": "bim",
        "type": "USER_ACTOR",
        "name": "Taylor Smith"
    },
    "id": "0fd77c61-f08a-488c-9d10-c356ffea0d11",
    "targetType": "USER",
    "receivedTimestamp": "2024-02-20T19:46:50.426Z",
    "targets": [
        {
            "name": "Deepu Murty",
            "type": "USER",
            "id": "deepu@immuta.com",
            "identityProvider": "bim",
            "profileId": "20"
        }
    ],
    "actorIp": "xxx.xx.xx.xx",
    "requestId": "146ec771-ec2e-5f40-8551-1dbc38e64078",
    "sessionId": "893db38b8f1977fda75f60d168c4e74e"
}

ConfigurationUpdated event

  • Event: ConfigurationUpdated

  • Legacy event: configurationUpdate

  • Description: An audit event for updates to the configuration on the Immuta app settings page.

{
    "eventTimestamp": "2023-12-04T18:38:25.801Z",
    "tenantId": "your-immuta-tenant.com",
    "actionStatus": "SUCCESS",
    "action": "CONFIGURATION_UPDATED",
    "auditPayload": {
        "version": 1,
        "type": "ConfigurationUpdatedAuditPayload",
        "changeSet": {
            "plugins": {
                "policy": {
                    "approveToPromote": {
                        "requiredApprovalCount": [
                            {
                                "newValue": 1,
                                "oldValue": 2
                            }
                        ]
                    }
                }
            }
        },
        "configurationId": "20"
    },
    "relatedResources": [],
    "sessionId": "aed83ab8b46affcb1169532dada92b72",
    "requestId": "c80f510f-3f55-5450-8dea-d5e243708686",
    "targets": [
        {
            "name": "20",
            "type": "CONFIGURATION",
            "id": "20"
        }
    ],
    "actorIp": "xxx.xx.xx.xx",
    "receivedTimestamp": "2023-12-04T18:38:26.039Z",
    "id": "3989e233-c791-43e9-813f-7738f4c8e26b",
    "targetType": "CONFIGURATION",
    "actor": {
        "identityProvider": "bim",
        "id": "taylor@immuta.com",
        "profileId": "1",
        "type": "USER_ACTOR",
        "name": "Taylor Smith"
    }
}

DatasourceAppliedToProject event

  • Event: DatasourceAppliedToProject

  • Legacy event: addToProject

  • Description: An audit event for adding a data source to an Immuta project.

{
    "auditPayload": {
        "type": "DatasourceAppliedToProjectAuditPayload",
        "errors": [],
        "projectId": "2",
        "version": 1,
        "datasources": [
            {
                "id": "2",
                "name": "Public Case"
            }
        ]
    },
    "sessionId": "6b928653b1411078647a2764a72beca6",
    "targets": [
        {
            "projectKey": "HumanResources",
            "id": "2",
            "type": "PROJECT",
            "name": "Human Resources"
        }
    ],
    "action": "DATASOURCE_APPLY",
    "id": "8106b44f-cf56-4ca2-a111-641d0e80e6ff",
    "targetType": "PROJECT",
    "actionStatus": "SUCCESS",
    "relatedResources": [
        {
            "id": "2",
            "technology": "SNOWFLAKE",
            "type": "DATASOURCE",
            "name": "Public Case"
        }
    ],
    "actor": {
        "id": "taylor@immuta.com",
        "profileId": "1",
        "name": "Taylor Smith",
        "identityProvider": "bim",
        "type": "USER_ACTOR"
    },
    "eventTimestamp": "2023-10-13T14:08:20.427Z",
    "actorIp": "xxx.xx.xx.xx",
    "requestId": "8823f3f0-4e46-590c-bbb2-209cce750ff9",
    "tenantId": "your-immuta-tenant.com",
    "receivedTimestamp": "2023-10-13T14:08:20.660Z"
}

DatasourceCatalogSynced event

  • Event: DatasourceCatalogSynced

  • Legacy event: catalogUpdate

  • Description: An audit event for syncing an external catalog to tag Immuta data sources.

{
    "tenantId": "your-immuta-tenant.com",
    "action": "CATALOG_SYNC",
    "actor": {
        "type": "USER_ACTOR",
        "identityProvider": "bim",
        "name": "Taylor Smith",
        "profileId": "1",
        "id": "taylor@immuta.com"
    },
    "targetType": "DATASOURCE",
    "actionStatus": "SUCCESS",
    "eventTimestamp": "2023-04-14T16:48:21.159Z",
    "id": "159d4299-fca5-47cb-aa6b-81d93bafa526",
    "targets": [
        {
            "id": "9",
            "name": "Public case",
            "technology": "SNOWFLAKE",
            "type": "DATASOURCE"
        }
    ],
    "relatedResources": [],
    "receivedTimestamp": "2023-04-14T16:48:21.209Z",
    "auditPayload": {
        "datasourceId": "9",
        "changes": {
            "before": {
                "catalogId": null,
                "documentation": null,
                "dictionary": [
                    {
                        "tags": [],
                        "columnName": "country"
                    },
                    {
                        "columnName": "date",
                        "tags": []
                    },
                    {
                        "tags": [],
                        "columnName": "fastest_qualifying"
                    },
                    {
                        "columnName": "location",
                        "tags": []
                    },
                    {
                        "columnName": "round",
                        "tags": []
                    },
                    {
                        "columnName": "winning_aircraft",
                        "tags": []
                    },
                    {
                        "tags": [],
                        "columnName": "winning_pilot"
                    }
                ],
                "tableTags": null,
                "description": null
            },
            "after": {
                "description": "",
                "tableTags": null,
                "dictionary": [
                    {
                        "columnName": "country",
                        "description": "",
                        "tags": []
                    },
                    {
                        "tags": [],
                        "description": "",
                        "columnName": "date"
                    },
                    {
                        "tags": [],
                        "columnName": "fastest_qualifying",
                        "description": ""
                    },
                    {
                        "tags": [],
                        "columnName": "location",
                        "description": ""
                    },
                    {
                        "columnName": "round",
                        "description": "",
                        "tags": []
                    },
                    {
                        "tags": [],
                        "description": "",
                        "columnName": "winning_aircraft"
                    },
                    {
                        "columnName": "winning_pilot",
                        "description": "",
                        "tags": []
                    }
                ],
                "catalogId": "immuta-product_engineering"
            }
        },
        "type": "DatasourceCatalogSyncedAuditPayload"
    }
}

DatasourceCreated event

  • Event: DatasourceCreated

  • Legacy event: dataSourceCreate

  • Description: An audit event for registering a table as an Immuta data source.

{
"id": "dc0b7313-ecc9-42f1-ba33-df0a1a753c08",
"action": "CREATE",
"actionStatus": "SUCCESS",
"actor": {
    "name": "Taylor Smith",
    "id": "taylor@immuta.com",
    "identityProvider": "bim",
    "profileId": "1",
    "type": "USER_ACTOR"
},
"tenantId": "your-immuta-tenant.com",
"targetType": "DATASOURCE",
"targets": [
    {
        "type": "DATASOURCE",
        "id": "102",
        "name": "Pgboss Job",
        "technology": "POSTGRESQL"
    }
],
"relatedResources": [
    {
        "type": "CONNECTION",
        "id": "4",
        "name": "data-source-connection-name",
        "connectionKey": "data-source-connection-key"
    }
],
"auditPayload": {
    "type": "DatasourceCreatedAuditPayload",
    "version": 1,
    "description": null,
    "documentation": null,
    "expiration": null,
    "columnDetectionEnabled": true,
    "disabled": false,
    "technology": "POSTGRESQL",
    "connectionId": "4",
    "table": "job",
    "schema": "pgboss",
    "sensitiveDataDiscoveryEnabled": true
},
"eventTimestamp": "2024-02-22T13:59:04.681Z",
"receivedTimestamp": "2024-02-22T13:59:04.715Z"
}

DatasourceDeleted event

  • Event: DatasourceDeleted

  • Legacy event: dataSourceDelete

  • Description: An audit event for deleting a data source in Immuta.

{
"id": "1403b675-70f6-4833-ab4c-a7486c63f494",
"action": "DELETE",
"actionStatus": "SUCCESS",
"actor": {
    "name": "Taylor Smith",
    "id": "taylor@immuta.com",
    "identityProvider": "bim",
    "profileId": "1",
    "type": "USER_ACTOR"
},
"tenantId": "your-immuta-tenant.com",
"targetType": "DATASOURCE",
"targets": [
    {
        "type": "DATASOURCE",
        "id": "93",
        "name": "Audit",
        "technology": "POSTGRESQL"
    }
],
"relatedResources": [],
"auditPayload": {
    "type": "DatasourceDeletedAuditPayload",
    "version": 1,
    "datasourceId": "93",
    "name": "Audit",
    "technology": "POSTGRESQL"
},
"eventTimestamp": "2024-02-22T14:20:42.379Z",
"receivedTimestamp": "2024-02-22T14:20:42.392Z"
}

DatasourceDisabled event

  • Event: DatasourceDisabled

  • Legacy event: None

  • Description: An audit event for disabling a data source in Immuta.

{
    "id": "a09b9bc3-3775-4496-87ec-b808cf649794",
    "sessionId": "0fcaaf9c074330b4b875746c2e52739c",
    "requestId": "153fe145-32a0-5c33-930d-c571c1d7748d",
    "action":