Zendesk

The Zendesk Source works by polling your event/alert logs every 60 seconds using the API token authentication method.

To connect your source, generate an API Token from your Zendesk settings tab. Make sure Token Access is enabled and create a new token.

Provide the token, as well as the email address of your Zendesk Support administrator to RunReveal while creating the source.

Click verify source prior to connecting your source in RunReveal, which may take a moment, but if successful will ensure that the source is correctly configured.

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.

Table: zendesk_logs (45 columns)

ColumnType
workspaceIDString
sourceIDString
sourceTypeLowCardinality(String)
sourceTTLUInt32
receivedAtDateTime
idString
eventTimeDateTime
eventNameString
eventIDString
srcIPString
srcASCountryCodeString
srcASNumberUInt32
srcASOrganizationString
srcCityString
srcConnectionTypeString
srcISPString
srcLatitudeFloat64
srcLongitudeFloat64
srcUserTypeString
dstIPString
dstASCountryCodeString
dstASNumberUInt32
dstASOrganizationString
ColumnType
dstCityString
dstConnectionTypeString
dstISPString
dstLatitudeFloat64
dstLongitudeFloat64
dstUserTypeString
actorMap(String, String)
tagsMap(String, String)
resourcesArray(String)
serviceNameString
readOnlyBool
rawLogString
urlString
actionLabelString
actorIDString
zendeskSourceTypeString
zendeskSourceIDString
zendeskSourceLabelString
actionString
changeDescriptionString
ipAddressString
actorNameString