Announcing RUNWAY: The conference for teams securing what's nextRegister Now
RunReveal
SourcesSource Types

Notion

Notion is a productivity and collaboration tool for managing documents, projects, and databases. Notion logs capture user activity such as page views, edits, comments, sharing actions, and permission changes. These logs help administrators monitor collaboration, track changes to content, and ensure proper access controls are maintained, providing insights into how teams use and interact with Notion workspaces.

Setup

This source uses am HTTP webhook to ingest events. Create the source in RunReveal and a new webhook URL will be generated. Use this URL when setting up your source.

webhook-setup

Login to your Notion account and navigate to Settings -> Connections -> Workspace. From this screen you can click see all to view the RunReveal Integration.

notion setup

Select the RunReveal tile and paste the webhook URL that was generated when you added your source. Click the connect button to start sending Notion logs to RunReveal.

Verifying the subscription

After you click connect, Notion sends a one-time verification request to your webhook URL and will not start delivering real events until you confirm it. Notion does not show you this token directly -- go back to your source's overview page in RunReveal, where it appears as Verification Token once received (this can take a few seconds; use the Check button if it doesn't show up right away). Copy it and paste it into Notion's verification dialog to complete the subscription.

Verify It's Working

Once added the source logs should begin flowing within a minute.

You can validate we are receiving your logs by running the following SQL query.

SELECT * FROM runreveal.logs WHERE sourceType = 'notion' LIMIT 1

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.

Table: notion_logs (40 columns)

ColumnType
workspaceIDString
sourceIDString
sourceTypeLowCardinality(String)
sourceTTLUInt32
receivedAtDateTime
idString
eventTimeDateTime
eventNameString
eventIDString
srcIPString
srcASCountryCodeString
srcASNumberUInt32
srcASOrganizationString
srcCityString
srcConnectionTypeString
srcISPString
srcLatitudeFloat64
srcLongitudeFloat64
srcUserTypeString
dstIPString
ColumnType
dstASCountryCodeString
dstASNumberUInt32
dstASOrganizationString
dstCityString
dstConnectionTypeString
dstISPString
dstLatitudeFloat64
dstLongitudeFloat64
dstUserTypeString
actorMap(String, String)
tagsMap(String, String)
resourcesArray(String)
serviceNameString
readOnlyBool
rawLogString
notion_workspace_idString
notion_workspace_nameString
objectString
notion_typeString
detailString

On this page