Skip to content

Starburst Query Audit Logs

Public preview

This feature is currently in public preview and available to all accounts.

Starburst query audit logs is a feature that audits queries that users run natively in Starburst and presents them in a universal format as Immuta audit logs. Users can view audit records for queries made in Starburst against Immuta data sources on the audit page. Immuta audits the activity of Immuta users on Immuta data sources.


Best practices: Store audit logs

By default Starburst (Trino) audit logs expire after 90 days. Export the universal audit model (UAM) logs to S3, and store audit logs outside of Immuta in order to retain the audit logs long-term.

Audit schema

Each audit message from the Immuta platform will be a one-line JSON object containing the properties listed below.

Property Description Example
action The action associated with the audit log. QUERY
actor.type The Immuta user type of the actor who made the query. USER_ACTOR The Immuta user ID of the actor who made the query. The Immuta name of the user who made the query. Taylor
actor.identityProvider The IAM the user is registered in. bim is the built-in Immuta IAM. bim
actor.profileId The profile ID of the user who made the query. 10
actionStatus Indicates whether or not the user was granted access to the data. Possible values are UNAUTHORIZED, FAILURE, or SUCCESS. Unauthorized access is not audited for Starburst (Trino), so this value will always be SUCCESS. SUCCESS
eventTimestamp The time the query occurred. 2023-06-27T11:03:59.000Z
id The unique Immuta ID of the audit record. This will match the Trino query ID. 20240221_200952_00200_qhadw
tenantId The Immuta SaaS tenant ID.
targetType The type of targets affected by the query; this value will always be DATASOURCE. DATASOURCE
targets A list of the targets affected by the query. See the example below
auditPayload.type The type of audit record; this value will always be: QueryAuditPayload. QueryAuditPayload
auditPayload.queryId The unique Trino ID of the query. 20240221_200952_00200_qhadw
auditPayload.query The command text of the query that was run in the integration. Immuta truncates the query text to the first 2048 characters. select * from lineitem l join orders o on l.orderkey = o.orderkey limit 10
auditPayload.technologyContext.type The technology the query was made in. TrinoContext
auditPayload.technologyContext.trinoUsername The Starburst user ID for the user who made the query.
auditPayload.technologyContext.immutaPluginVersion The version of the Immuta plugin in Starburst. 437-SNAPSHOT
auditPayload.version The version of the audit event schema. 1
receivedTimestamp The timestamp of when the audit event was received and stored by Immuta. 2023-06-27T15:18:22.314Z

Example audit record

  "id": "20240221_200952_00200_qhadw",
  "action": "QUERY",
  "actionStatus": "SUCCESS",
  "actor": {
    "name": "Taylor",
    "id": "",
    "identityProvider": "bim",
    "profileId": "13",
    "type": "USER_ACTOR"
  "tenantId": "",
  "targetType": "DATASOURCE",
  "targets": [
      "type": "DATASOURCE",
      "id": "35",
      "name": "Tiny Lineitem",
      "technology": "STARBURST_TRINO"
      "type": "DATASOURCE",
      "id": "33",
      "name": "Tiny Orders",
      "technology": "STARBURST_TRINO"
  "relatedResources": [],
  "auditPayload": {
    "type": "QueryAuditPayload",
    "version": 1,
    "queryId": "20240221_200952_00200_qhadw",
    "query": "select * from lineitem l join orders o on l.orderkey = o.orderkey limit 10",
    "startTime": "2024-02-21T20:09:52.000Z",
    "endTime": null,
    "duration": null,
    "technologyContext": {
      "trinoUsername": "",
      "immutaPluginVersion": "437-SNAPSHOT",
      "type": "TrinoContext"
    "objectsAccessed": [],
    "securityProfile": {
      "sensitivity": {
        "score": "INDETERMINATE"
  "eventTimestamp": "2024-02-21T20:09:52.000Z",
  "receivedTimestamp": "2024-02-21T20:09:53.599Z"