Serval Audit Logs

Serval tracks the provisioning and deprovisioning of entitlements and resources across your organization. Its audit log records all access-related actions — access requests, entitlement grants, deprovisionings, policy and role changes, and API key activity. These logs help security and compliance teams maintain audit trails, monitor privileged access, and build detections on identity and entitlement changes.

Setup

Serval supports API polling to collect audit log events from your organization via the audit log endpoint (GET /v2/audit-logs).

1. Go to Sources in RunReveal
2. Click the Serval source tile
3. Give it a name
4. Select your Region (US or EU)
5. Fill in your Client ID and Client Secret
6. Click Connect Source

Authentication

Serval bearer tokens expire after 24 hours, so RunReveal authenticates with your API credentials and mints a short-lived access token on your behalf. You provide a Client ID and Client Secret, and RunReveal exchanges them for a token via Serval's OAuth2 client-credentials flow (POST /v2/auth/token), refreshing automatically as tokens expire.

1. Sign in to the Serval platform
2. Create an API credential with access to the audit log API
3. Copy the Client ID and Client Secret into RunReveal
4. Choose the region that matches your Serval tenant:
   • US — https://public.api.serval.com
   • EU — https://public.eu1.serval.com

Collected Events

Serval events carry a nested eventType object whose key identifies the action. RunReveal stores that key in the eventName field. Event types include:

• Access lifecycle — access requests, provisioning, and deprovisioning (e.g. accessProvisioned, accessDeprovisioned)
• Policy and role — access policy and custom role creation, updates, and deletion (e.g. accessPolicyCreated, customRoleGrantsSet)
• Entitlements and entities — entitlement and entity lifecycle changes (e.g. entitlementCreated, entityDeleted)
• API keys — API key creation and revocation (e.g. apiKeyCreated, apiKeyRevoked)
• Identity — user creation, invitation, deactivation, login, and impersonation (e.g. userLogin, impersonationSessionStarted)
• Configuration — org settings, SSO, and team changes (e.g. orgSettingsChanged, ssoConfigChanged)

Event Data Structure

Each audit event includes:

• Event ID and Type — Unique identifier (id) and the nested eventType key
• Timestamp — When the action occurred (timestamp, RFC 3339)
• Actor Information — Actor ID plus the actor variant (user, API key, system, worker, or impersonated user) and its display details
• Network Context — Source IP address and user agent
• Outcome — Result of the attempted action (status, reasonCode) and the actor's justification when supplied

Data Collection

• Collection Method: API polling every 5 minutes
• Backfill: On first connection RunReveal ingests the last 24 hours of audit history
• Event Format: JSON with normalized fields for consistent querying

Verify It's Working

Once added the source logs should begin flowing within a minute.

You can validate we are receiving your logs by running the following SQL query.

SELECT * FROM runreveal.logs WHERE sourceType = 'serval' LIMIT 1

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.

Helpful Links

• Serval Audit Log API - Reference for the audit log endpoint
• Serval API Reference - Public API overview