CircleCI Audit Logs

CircleCI audit logs provide a detailed record of actions and events within your CircleCI organization. These logs capture information such as user activities, build events, project changes, and security events. They help administrators track user activity, ensure security compliance, and audit changes for troubleshooting and incident investigation.

Ingest Methods

Setup the ingestion of this source using one of the following guides.

If using an AWS S3 bucket use the following SNS topic ARN to send your bucket notifications.

arn:aws:sns:<REGION>:253602268883:runreveal_circleci_audit

Setup

For detailed setup instructions, see the CircleCI documentation to configure audit log streaming to your chosen storage solution.

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.

Table: circleci_audit_logs (53 columns)

Column	Type
`workspaceID`	String
`sourceID`	String
`sourceType`	String
`sourceTTL`	UInt32
`receivedAt`	DateTime
`id`	String
`eventTime`	DateTime
`eventName`	String
`eventID`	String
`srcIP`	String
`srcASCountryCode`	String
`srcASNumber`	UInt32
`srcASOrganization`	String
`srcCity`	String
`srcConnectionType`	String
`srcISP`	String
`srcLatitude`	Float64
`srcLongitude`	Float64
`srcUserType`	String
`dstIP`	String
`dstASCountryCode`	String
`dstASNumber`	UInt32
`dstASOrganization`	String
`dstCity`	String
`dstConnectionType`	String
`dstISP`	String
`dstLatitude`	Float64

Column	Type
`dstLongitude`	Float64
`dstUserType`	String
`actor`	Map(String
`tags`	Map(String
`resources`	Array(String)
`serviceName`	String
`enrichments`	Array(Tuple(data Map(String
`readOnly`	Bool
`rawLog`	String
`auditLogId`	String
`version`	UInt32
`occurredAt`	DateTime
`action`	String
`actorId`	String
`actorType`	String
`actorName`	String
`targetId`	String
`targetType`	String
`targetName`	String
`scopeId`	String
`scopeType`	String
`scopeName`	String
`success`	Bool
`requestId`	String
`payload`	String
`metadata`	Map(String

BOX Cloudentity