Legacy to UAM Migration

Universal audit model (UAM) is Immuta's consistent structure for all Immuta system and user query audit logs. This reference guide maps the legacy audit events to the new UAM events and provides example schemas of all the UAM events available in Immuta.

To learn more about Immuta's audit, see the UAM reference page.

Events and descriptions

Legacy event	UAM event	Description
accessGroup	AttributeApplied AttributeRemoved GroupMemberRemoved GroupMemberAdded GroupCreated GroupDeleted GroupUpdated	An audit event for managing a group.
accessUser	AttributeApplied AttributeRemoved UserCreated UserDeleted UserCloned UserPasswordUpdated UserOneTimeTokenCreated PermissionRemoved PermissionApplied	An audit event for managing a user.
acknowledgePurposes	ProjectPurposesAcknowledged	An audit event for acknowledging a purpose for a project in Immuta.
addToProject	DatasourceAppliedToProject	An audit event for adding a data source to an Immuta project.
apiKey	ApiKeyCreated ApiKeyDeleted	An audit event for when an API key is created or deleted on the Immuta app settings page or from an Immuta user's profile page.
authenticate	UserAuthenticated	An audit event for a user authenticating in Immuta.
-	UserLogout	An audit event for a user logging out of Immuta.
catalogUpdate	DatasourceCatalogSynced	An audit event for syncing an external catalog to tag Immuta data sources.
configurationUpdate	ConfigurationUpdated	An audit event for updates to the configuration on the Immuta app settings page.
collectionCreated	DomainCreated	An audit event for creating a domain.
collectionDataSourceAdded	DomainDataSourcesUpdated	An audit event for updating a domain's data sources.
collectionDataSourceRemoved	DomainDataSourcesUpdated	An audit event for updating a domain's data sources.
collectionDataSourceUpdated	DomainDataSourcesUpdated	An audit event for updating a domain's data sources.
collectionDeleted	DomainDeleted	An audit event for deleting a domain.
collectionPermissionGranted	DomainPermissionsUpdated	An audit event for granting or revoking a user's domain-related permissions.
collectionPermissionRevoked	DomainPermissionsUpdated	An audit event for granting or revoking a user's domain-related permissions.
collectionUpdated	DomainUpdated	An audit event for updating an Immuta domain.
dataSourceCreate	DatasourceCreated	An audit event for registering a table as an Immuta data source.
dataSourceDelete	DatasourceDeleted	An audit event for deleting a data source in Immuta.
-	DatasourceDisabledAuditEvent	An audit event for disabling a data source in Immuta.
dataSourceSave	DatasourceUpdated	An audit event for updating a data source with the new data source details.
dataSourceSubscription	SubscriptionCreated SubscriptionUpdated SubscriptionDeleted SubscriptionRequestApproved SubscriptionRequestDenied SubscriptionRequested	The events for data source and project subscriptions.
dataSourceUpdate	DatasourceUpdated	An audit event for updating a data source with the new data source details.
externalUserIdChanged	UserUpdated	An audit event for updating user details in Immuta.
globalPolicyApplied	DatasourceGlobalPolicyApplied	An audit event for applying a global policy to a data source.
globalPolicyApprovalRescinded	GlobalPolicyApprovalRescinded	An audit event for a global policy approval rescinded in the approve to promote workflow.
globalPolicyApproved	GlobalPolicyApproved	An audit event for a global policy approved in the approve to promote workflow.
globalPolicyCertify	DatasourcePolicyCertified	An audit event for a global policy being certified by a data owner for their data source.
-	DatasourcePolicyDecertified	An audit event for a global policy being decertified on a data source.
globalPolicyChangeRequested	GlobalPolicyChangeRequested	An audit event for requested edits on a global policy in the approve to promote workflow.
globalPolicyConflictResolved	DatasourceGlobalPolicyConflictResolved	An audit event for a global policy conflict being resolved on a data source.
globalPolicyCreate	GlobalPolicyCreated	An audit event for creating a global policy.
globalPolicyDelete	GlobalPolicyDeleted	An audit event for deleting a global policy.
globalPolicyDisabled	DatasourceGlobalPolicyDisabled	An audit event for a data owner disabling a global policy from their data source.
globalPolicyPromoted	GlobalPolicyPromoted	An audit event for when a global policy is fully approved and promoted to production in the approve to promote workflow.
globalPolicyRemoved	DatasourceGlobalPolicyRemoved	An audit event for a data owner removing a global policy from their data source.
globalPolicyReviewRequested	GlobalPolicyReviewRequested	An audit event for when a global policy is ready and requests a review in the approve to promote workflow.
globalPolicyUpdate	GlobalPolicyUpdated	An audit event for updating a global policy with the new global policy details.
licenseCreate	LicenseCreated	An audit event for creating an Immuta license.
licenseDelete	LicenseDeleted	An audit event for deleting an Immuta license.
nativeQuery	SnowflakeQuery DatabricksQuery	An audit event for a user's query in Snowflake or Databricks Unity Catalog. See the Snowflake UAM page or the Databricks Unity Catalog UAM page for additional details about the audit event schema.
policyAdjustmentCreate	PolicyAdjustmentCreated	An audit event for creating a policy adjustment in an Immuta project.
policyAdjustmentDelete	PolicyAdjustmentDeleted	An audit event for deleting a policy adjustment in an Immuta project.
policyCertificationExpired	DatasourcePolicyCertificationExpired	An audit event for a global policy certification expiring on a data source.
policyHandlerCreate	LocalPolicyCreated	An audit event for creating a local policy for an Immuta data source.
policyHandlerUpdate	LocalPolicyUpdated	An audit event for updating a local policy on an Immuta data source.
prestoQuery	TrinoQuery	An audit event for a user's query in Starburst (Trino). See the Starburst (Trino) UAM page for additional details about the audit event schema.
projectCreate	ProjectCreated	An audit event for creating a project in Immuta.
projectDelete	ProjectDeleted	An audit event for deleting a project in Immuta.
-	ProjectDisabled	An audit event for disabling a project in Immuta.
projectPurposeApprove	ProjectPurposeApproved	An audit event for approving a purpose for a project in Immuta.
projectPurposeDeny	ProjectPurposeDenied	An audit event for denying a purpose for a project in Immuta.
projectSubscription	SubscriptionCreated SubscriptionUpdated SubscriptionDeleted SubscriptionRequestApproved SubscriptionRequestDenied SubscriptionRequested	The events for data source and project subscriptions.
projectUpdate	ProjectUpdated	An audit event for updating a project in Immuta.
purposeDelete	PurposeDeleted	An audit event for deleting a purpose in Immuta.
purposeUpdate	PurposeUpdated	An audit event for updating a purpose in Immuta.
purposeCreate	PurposeUpserted	An audit event for creating a purpose in Immuta.
removeFromProject	DatasourceRemovedFromProject	An audit event for removing a data source from a project.
sddClassifierCreated	SDDClassifierCreated	An audit event for creating a sensitive data discovery (SDD) column name regex, regex, or dictionary pattern.
sddClassifierDeleted	SDDClassifierDeleted	An audit event for deleting a sensitive data discovery (SDD) pattern.
sddClassifierUpdated	SDDClassifierUpdated	An audit event for updating a sensitive data discovery (SDD) column name regex, regex, or dictionary pattern.
sddDatasourceTagUpdate	SDDDatasourceTagUpdated	An audit event for the results from a sensitive data discovery (SDD) run that updates the tags on Immuta data sources.
sddTemplateApplied	SDDTemplateApplied	An audit event for applying an identification framework to data sources.
sddTemplateCreated	SDDTemplateCreated SDDTemplateCloned	An audit event for creating an identification framework.
sddTemplateDeleted	SDDTemplateDeleted	An audit event for deleting an identification framework.
sddTemplateUpdated	SDDTemplateUpdated	An audit event for updating an identification framework.
spark	DatabricksQuery	An audit event for a user's query in Databricks. See the Databricks Spark UAM page for additional details about the audit event schema.
tagAdded	TagApplied	An audit event for applying a tag to an object in Immuta.
tagCreated	TagCreated	An audit event for creating a tag in Immuta.
tagDeleted	TagDeleted	An audit event for deleting a tag in Immuta.
tagRemoved	TagRemoved	An audit event for removing a tag from an object in Immuta.
tagUpdated	TagUpdated	An audit event for updating a tag in Immuta.
webhookCreate	WebhookCreated	An audit event for creating an Immuta webhook.
webhookDelete	WebhookDeleted	An audit event for deleting an Immuta webhook.

ApiKeyCreated event

• Event: ApiKeyCreated

• Legacy event: apiKey

• Description: An audit event for when an API key is created on the Immuta app settings page or from an Immuta user's profile page.

{
    "relatedResources": [],
    "auditPayload": {
        "type": "ApiKeyCreatedAuditPayload",
        "apiKeyId": "1112158",
        "name": "T1",
        "version": 1
    },
    "action": "CREATE",
    "tenantId": "your-immuta-tenant.com",
    "actionStatus": "SUCCESS",
    "eventTimestamp": "2024-01-25T18:04:58.368Z",
    "actor": {
        "id": "[e-mail]",
        "identityProvider": "bim",
        "profileId": "1",
        "type": "USER_ACTOR",
        "name": "Taylor Smith"
    },
    "targetType": "APIKEY",
    "id": "d9dc3cee-98d0-47d6-ba81-e0b38f9f4014",
    "receivedTimestamp": "2024-01-25T18:04:58.505Z",
    "actorIp": "xxx.xx.xx.xx",
    "targets": [],
    "requestId": "60c68659-ac83-5299-bf3e-14856178a0de",
    "sessionId": "9c553d7ace0aa3ee735fd3c14f737bc6"
}

ApiKeyDeleted event

• Event: ApiKeyDeleted

• Legacy event: apiKey

• Description: An audit event for when an API key is deleted on the Immuta app settings page or from an Immuta user's profile page.

{
    "id": "fe47ddd1-fd22-4dcf-9648-83950a10ef34",
    "targetType": "APIKEY",
    "receivedTimestamp": "2024-01-25T18:08:28.891Z",
    "actor": {
        "type": "USER_ACTOR",
        "identityProvider": "bim",
        "id": "[e-mail]",
        "profileId": "1",
        "name": "Taylor Smith"
    },
    "requestId": "220c7faa-7f56-5d8c-aa31-8ac2212b7707",
    "sessionId": "9c553d7ace0aa3ee735fd3c14f737bc6",
    "targets": [],
    "actorIp": "xxx.xx.xx.xx",
    "relatedResources": [],
    "auditPayload": {
        "type": "ApiKeyDeletedAuditPayload",
        "apiKeyId": "1112158",
        "version": 1
    },
    "eventTimestamp": "2024-01-25T18:08:21.319Z",
    "action": "DELETE",
    "actionStatus": "SUCCESS",
    "tenantId": "your-immuta-tenant.com"
}

AttributeApplied event

• Event: AttributeApplied

• Legacy events: accessUser and accessGroup

• Description: An audit event for an attribute applied to a group or user.

• Additional parameter details: targetType will specify whether the attribute was added to a USER or GROUP.

{
    "actorIp": "xxx.xx.xx.xx",
    "targets": [
        {
            "name": "Deepu Murty",
            "id": "[e-mail]",
            "identityProvider": "bim",
            "profileId": "20",
            "type": "USER"
        }
    ],
    "requestId": "e45652cd-4d00-5def-8e8c-aca696822fc2",
    "sessionId": "cdbffff8804103418350947c6586712c",
    "actor": {
        "type": "USER_ACTOR",
        "profileId": "1",
        "id": "[e-mail]",
        "identityProvider": "bim",
        "name": "Taylor Smith"
    },
    "id": "63f111a7-0835-4696-8fdb-188130c44fac",
    "targetType": "USER",
    "receivedTimestamp": "2023-09-13T14:36:02.926Z",
    "action": "ATTRIBUTE_APPLY",
    "tenantId": "your-immuta-tenant.com",
    "actionStatus": "SUCCESS",
    "eventTimestamp": "2023-09-13T14:36:02.688Z",
    "relatedResources": [
        {
            "values": ["Product"],
            "name": "Department",
            "id": "department",
            "type": "ATTRIBUTE"
        }
    ],
    "auditPayload": {
        "entityType": "USER",
        "type": "AttributeAppliedAuditPayload",
        "version": 1,
        "attributes": [
            {
                "values": ["Product"],
                "attribute": "Department"
            }
        ],
        "entityIdProvider": "bim",
        "entityId": "[e-mail]"
    }
}

AttributeRemoved event

• Event: AttributeRemoved

• Legacy events: accessUser and accessGroup

• Description: An audit event for an attribute removed from a group or user.

• Additional parameter details: targetType will specify whether the attribute was removed from a USER or GROUP.

{
    "relatedResources": [
        {
            "values": ["UNCLASSIFIED"],
            "name": "classification",
            "id": "classification",
            "type": "ATTRIBUTE"
        }
    ],
    "auditPayload": {
        "type": "AttributeRemovedAuditPayload",
        "entityType": "USER",
        "version": 1,
        "attributes": [
            {
                "values": ["UNCLASSIFIED"],
                "attribute": "classification"
            }
        ],
        "entityIdProvider": "bim",
        "entityId": "[e-mail]"
    },
    "action": "ATTRIBUTE_REMOVE",
    "actionStatus": "SUCCESS",
    "tenantId": "your-immuta-tenant.com",
    "eventTimestamp": "2024-02-20T19:46:50.259Z",
    "actor": {
        "profileId": "1",
        "id": "[e-mail]",
        "identityProvider": "bim",
        "type": "USER_ACTOR",
        "name": "Taylor Smith"
    },
    "id": "0fd77c61-f08a-488c-9d10-c356ffea0d11",
    "targetType": "USER",
    "receivedTimestamp": "2024-02-20T19:46:50.426Z",
    "targets": [
        {
            "name": "Deepu Murty",
            "type": "USER",
            "id": "[e-mail]",
            "identityProvider": "bim",
            "profileId": "20"
        }
    ],
    "actorIp": "xxx.xx.xx.xx",
    "requestId": "146ec771-ec2e-5f40-8551-1dbc38e64078",
    "sessionId": "893db38b8f1977fda75f60d168c4e74e"
}

ConfigurationUpdated event

• Event: ConfigurationUpdated

• Legacy event: configurationUpdate

• Description: An audit event for updates to the configuration on the Immuta app settings page.

{
    "eventTimestamp": "2023-12-04T18:38:25.801Z",
    "tenantId": "your-immuta-tenant.com",
    "actionStatus": "SUCCESS",
    "action": "CONFIGURATION_UPDATED",
    "auditPayload": {
        "version": 1,
        "type": "ConfigurationUpdatedAuditPayload",
        "changeSet": {
            "plugins": {
                "policy": {
                    "approveToPromote": {
                        "requiredApprovalCount": [
                            {
                                "newValue": 1,
                                "oldValue": 2
                            }
                        ]
                    }
                }
            }
        },
        "configurationId": "20"
    },
    "relatedResources": [],
    "sessionId": "aed83ab8b46affcb1169532dada92b72",
    "requestId": "c80f510f-3f55-5450-8dea-d5e243708686",
    "targets": [
        {
            "name": "20",
            "type": "CONFIGURATION",
            "id": "20"
        }
    ],
    "actorIp": "xxx.xx.xx.xx",
    "receivedTimestamp": "2023-12-04T18:38:26.039Z",
    "id": "3989e233-c791-43e9-813f-7738f4c8e26b",
    "targetType": "CONFIGURATION",
    "actor": {
        "identityProvider": "bim",
        "id": "[e-mail]",
        "profileId": "1",
        "type": "USER_ACTOR",
        "name": "Taylor Smith"
    }
}

DatasourceAppliedToProject event

• Event: DatasourceAppliedToProject

• Legacy event: addToProject

• Description: An audit event for adding a data source to an Immuta project.

{
    "auditPayload": {
        "type": "DatasourceAppliedToProjectAuditPayload",
        "errors": [],
        "projectId": "2",
        "version": 1,
        "datasources": [
            {
                "id": "2",
                "name": "Public Case"
            }
        ]
    },
    "sessionId": "6b928653b1411078647a2764a72beca6",
    "targets": [
        {
            "projectKey": "HumanResources",
            "id": "2",
            "type": "PROJECT",
            "name": "Human Resources"
        }
    ],
    "action": "DATASOURCE_APPLY",
    "id": "8106b44f-cf56-4ca2-a111-641d0e80e6ff",
    "targetType": "PROJECT",
    "actionStatus": "SUCCESS",
    "relatedResources": [
        {
            "id": "2",
            "technology": "SNOWFLAKE",
            "type": "DATASOURCE",
            "name": "Public Case"
        }
    ],
    "actor": {
        "id": "[e-mail]",
        "profileId": "1",
        "name": "Taylor Smith",
        "identityProvider": "bim",
        "type": "USER_ACTOR"
    },
    "eventTimestamp": "2023-10-13T14:08:20.427Z",
    "actorIp": "xxx.xx.xx.xx",
    "requestId": "8823f3f0-4e46-590c-bbb2-209cce750ff9",
    "tenantId": "your-immuta-tenant.com",
    "receivedTimestamp": "2023-10-13T14:08:20.660Z"
}

DatasourceCatalogSynced event

• Event: DatasourceCatalogSynced

• Legacy event: catalogUpdate

• Description: An audit event for syncing an external catalog to tag Immuta data sources.

{
    "tenantId": "your-immuta-tenant.com",
    "action": "CATALOG_SYNC",
    "actor": {
        "type": "USER_ACTOR",
        "identityProvider": "bim",
        "name": "Taylor Smith",
        "profileId": "1",
        "id": "[e-mail]"
    },
    "targetType": "DATASOURCE",
    "actionStatus": "SUCCESS",
    "eventTimestamp": "2023-04-14T16:48:21.159Z",
    "id": "159d4299-fca5-47cb-aa6b-81d93bafa526",
    "targets": [
        {
            "id": "9",
            "name": "Public case",
            "technology": "SNOWFLAKE",
            "type": "DATASOURCE"
        }
    ],
    "relatedResources": [],
    "receivedTimestamp": "2023-04-14T16:48:21.209Z",
    "auditPayload": {
        "datasourceId": "9",
        "changes": {
            "before": {
                "catalogId": null,
                "documentation": null,
                "dictionary": [
                    {
                        "tags": [],
                        "columnName": "country"
                    },
                    {
                        "columnName": "date",
                        "tags": []
                    },
                    {
                        "tags": [],
                        "columnName": "fastest_qualifying"
                    },
                    {
                        "columnName": "location",
                        "tags": []
                    },
                    {
                        "columnName": "round",
                        "tags": []
                    },
                    {
                        "columnName": "winning_aircraft",
                        "tags": []
                    },
                    {
                        "tags": [],
                        "columnName": "winning_pilot"
                    }
                ],
                "tableTags": null,
                "description": null
            },
            "after": {
                "description": "",
                "tableTags": null,
                "dictionary": [
                    {
                        "columnName": "country",
                        "description": "",
                        "tags": []
                    },
                    {
                        "tags": [],
                        "description": "",
                        "columnName": "date"
                    },
                    {
                        "tags": [],
                        "columnName": "fastest_qualifying",
                        "description": ""
                    },
                    {
                        "tags": [],
                        "columnName": "location",
                        "description": ""
                    },
                    {
                        "columnName": "round",
                        "description": "",
                        "tags": []
                    },
                    {
                        "tags": [],
                        "description": "",
                        "columnName": "winning_aircraft"
                    },
                    {
                        "columnName": "winning_pilot",
                        "description": "",
                        "tags": []
                    }
                ],
                "catalogId": "immuta-product_engineering"
            }
        },
        "type": "DatasourceCatalogSyncedAuditPayload"
    }
}

DatasourceCreated event

• Event: DatasourceCreated

• Legacy event: dataSourceCreate

• Description: An audit event for registering a table as an Immuta data source.

{
"id": "dc0b7313-ecc9-42f1-ba33-df0a1a753c08",
"action": "CREATE",
"actionStatus": "SUCCESS",
"actor": {
    "name": "Taylor Smith",
    "id": "[e-mail]",
    "identityProvider": "bim",
    "profileId": "1",
    "type": "USER_ACTOR"
},
"tenantId": "your-immuta-tenant.com",
"targetType": "DATASOURCE",
"targets": [
    {
        "type": "DATASOURCE",
        "id": "102",
        "name": "Pgboss Job",
        "technology": "POSTGRESQL"
    }
],
"relatedResources": [
    {
        "type": "CONNECTION",
        "id": "4",
        "name": "data-source-connection-name",
        "connectionKey": "data-source-connection-key"
    }
],
"auditPayload": {
    "type": "DatasourceCreatedAuditPayload",
    "version": 1,
    "description": null,
    "documentation": null,
    "expiration": null,
    "columnDetectionEnabled": true,
    "disabled": false,
    "technology": "POSTGRESQL",
    "connectionId": "4",
    "table": "job",
    "schema": "pgboss",
    "sensitiveDataDiscoveryEnabled": true
},
"eventTimestamp": "2024-02-22T13:59:04.681Z",
"receivedTimestamp": "2024-02-22T13:59:04.715Z"
}

DatasourceDeleted event

• Event: DatasourceDeleted

• Legacy event: dataSourceDelete

• Description: An audit event for deleting a data source in Immuta.

{
"id": "1403b675-70f6-4833-ab4c-a7486c63f494",
"action": "DELETE",
"actionStatus": "SUCCESS",
"actor": {
    "name": "Taylor Smith",
    "id": "[e-mail]",
    "identityProvider": "bim",
    "profileId": "1",
    "type": "USER_ACTOR"
},
"tenantId": "your-immuta-tenant.com",
"targetType": "DATASOURCE",
"targets": [
    {
        "type": "DATASOURCE",
        "id": "93",
        "name": "Audit",
        "technology": "POSTGRESQL"
    }
],
"relatedResources": [],
"auditPayload": {
    "type": "DatasourceDeletedAuditPayload",
    "version": 1,
    "datasourceId": "93",
    "name": "Audit",
    "technology": "POSTGRESQL"
},
"eventTimestamp": "2024-02-22T14:20:42.379Z",
"receivedTimestamp": "2024-02-22T14:20:42.392Z"
}

DatasourceDisabled event

• Event: DatasourceDisabled

• Legacy event: None

• Description: An audit event for disabling a data source in Immuta.

{
    "id": "a09b9bc3-3775-4496-87ec-b808cf649794",
    "sessionId": "0fcaaf9c074330b4b875746c2e52739c",
    "requestId": "153fe145-32a0-5c33-930d-c571c1d7748d",
    "action":