Notion
Notion is a productivity and collaboration tool for managing documents, projects, and databases. Notion logs capture user activity such as page views, edits, comments, sharing actions, and permission changes. These logs help administrators monitor collaboration, track changes to content, and ensure proper access controls are maintained, providing insights into how teams use and interact with Notion workspaces.
Setup
This source uses am HTTP webhook to ingest events. Create the source in RunReveal and a new webhook URL will be generated. Use this URL when setting up your source.

Login to your Notion account and navigate to Settings -> Connections -> Workspace. From this screen you can click see all to view the RunReveal Integration.

Select the RunReveal tile and paste the webhook URL that was generated when you added your source. Click the connect button to start sending Notion logs to RunReveal.
Verifying the subscription
After you click connect, Notion sends a one-time verification request to your webhook URL and will not start delivering real events until you confirm it. Notion does not show you this token directly -- go back to your source's overview page in RunReveal, where it appears as Verification Token once received (this can take a few seconds; use the Check button if it doesn't show up right away). Copy it and paste it into Notion's verification dialog to complete the subscription.
Verify It's Working
Once added the source logs should begin flowing within a minute.
You can validate we are receiving your logs by running the following SQL query.
Schema
The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.
Table: notion_logs (40 columns)
notion_logs (40 columns)| Column | Type |
|---|---|
workspaceID | String |
sourceID | String |
sourceType | LowCardinality(String) |
sourceTTL | UInt32 |
receivedAt | DateTime |
id | String |
eventTime | DateTime |
eventName | String |
eventID | String |
srcIP | String |
srcASCountryCode | String |
srcASNumber | UInt32 |
srcASOrganization | String |
srcCity | String |
srcConnectionType | String |
srcISP | String |
srcLatitude | Float64 |
srcLongitude | Float64 |
srcUserType | String |
dstIP | String |
| Column | Type |
|---|---|
dstASCountryCode | String |
dstASNumber | UInt32 |
dstASOrganization | String |
dstCity | String |
dstConnectionType | String |
dstISP | String |
dstLatitude | Float64 |
dstLongitude | Float64 |
dstUserType | String |
actor | Map(String, String) |
tags | Map(String, String) |
resources | Array(String) |
serviceName | String |
readOnly | Bool |
rawLog | String |
notion_workspace_id | String |
notion_workspace_name | String |
object | String |
notion_type | String |
detail | String |