Announcing RUNWAY: The conference for teams securing what's nextRegister Now
RunReveal
SourcesSource Types

Notion

Notion is a productivity and collaboration tool for managing documents, projects, and databases. Notion logs capture user activity such as page views, edits, comments, sharing actions, and permission changes. These logs help administrators monitor collaboration, track changes to content, and ensure proper access controls are maintained, providing insights into how teams use and interact with Notion workspaces.

Setup

This source uses am HTTP webhook to ingest events. Create the source in RunReveal and a new webhook URL will be generated. Use this URL when setting up your source.

webhook-setup

Login to your Notion account and navigate to Settings -> Connections -> Workspace. From this screen you can click see all to view the RunReveal Integration.

notion setup

Select the RunReveal tile and paste the webhook URL that was generated when you added your source. Click the connect button to start sending Notion logs to RunReveal.

Verify It's Working

Once added the source logs should begin flowing within a minute.

You can validate we are receiving your logs by running the following SQL query.

SELECT * FROM runreveal.logs WHERE sourceType = 'notion' LIMIT 1

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.

Table: notion_logs (40 columns)

ColumnType
workspaceIDString
sourceIDString
sourceTypeLowCardinality(String)
sourceTTLUInt32
receivedAtDateTime
idString
eventTimeDateTime
eventNameString
eventIDString
srcIPString
srcASCountryCodeString
srcASNumberUInt32
srcASOrganizationString
srcCityString
srcConnectionTypeString
srcISPString
srcLatitudeFloat64
srcLongitudeFloat64
srcUserTypeString
dstIPString
ColumnType
dstASCountryCodeString
dstASNumberUInt32
dstASOrganizationString
dstCityString
dstConnectionTypeString
dstISPString
dstLatitudeFloat64
dstLongitudeFloat64
dstUserTypeString
actorMap(String, String)
tagsMap(String, String)
resourcesArray(String)
serviceNameString
readOnlyBool
rawLogString
notion_workspace_idString
notion_workspace_nameString
objectString
notion_typeString
detailString

On this page