Notion

Notion is a productivity and collaboration tool for managing documents, projects, and databases. Notion logs capture user activity such as page views, edits, comments, sharing actions, and permission changes. These logs help administrators monitor collaboration, track changes to content, and ensure proper access controls are maintained, providing insights into how teams use and interact with Notion workspaces.

Ingest Method

This source uses am HTTP webhook to ingest events. Create the source in RunReveal and a new webhook URL will be generated. Use this URL when setting up your source.

webhook-setup

Setup

Login to your Notion account and navigate to Settings -> Connections -> Workspace. From this screen you can click see all to view the RunReveal Integration.

notion setup

Select the RunReveal tile and paste the webhook URL that was generated when you added your source. Click the connect button to start sending Notion logs to RunReveal.

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.

Table: notion_logs (40 columns)

ColumnType
workspaceIDString
sourceIDString
sourceTypeLowCardinality(String)
sourceTTLUInt32
receivedAtDateTime
idString
eventTimeDateTime
eventNameString
eventIDString
srcIPString
srcASCountryCodeString
srcASNumberUInt32
srcASOrganizationString
srcCityString
srcConnectionTypeString
srcISPString
srcLatitudeFloat64
srcLongitudeFloat64
srcUserTypeString
dstIPString
ColumnType
dstASCountryCodeString
dstASNumberUInt32
dstASOrganizationString
dstCityString
dstConnectionTypeString
dstISPString
dstLatitudeFloat64
dstLongitudeFloat64
dstUserTypeString
actorMap(String, String)
tagsMap(String, String)
resourcesArray(String)
serviceNameString
readOnlyBool
rawLogString
notion_workspace_idString
notion_workspace_nameString
objectString
notion_typeString
detailString