Event catalogue

Every log entry carries an event code of the form category.action. The code is stable — you can rely on it in your SIEM filters and in scripts; the description next to it is what a person sees in the interface. The category is the first part of the code; the filter buttons in the section work by it.

Operation is the class of action (create, modify, remove, access, authentication, transfer, execute). Severity is info, notice, warning or critical; on a refusal the event’s severity goes up one step (a refused sign-in is recorded as a warning).

Both success and refusal are recorded for every event — except routine operations marked “refused”: they go into the log only when refused.

Sessions and sign-in

Requesting a sign-in code from Buff Code and waiting for confirmation do not count as events — what is recorded is the person’s decision on the sign-in page. Sign-in codes, tokens and the device key never go into the log. See Sign-in and working context.

Organisation

Members and permissions

Projects

Repositories

Tasks

Review

Ask

Development sessions

The list of your own sessions and viewing your own session are reading your own data and are not recorded. Model calls from Buff Code are spending; they are recorded in the session itself and in billing; calls to the connections’ tools are kept in the connector’s call log. See Audit log and Buff Code.

Research

Credentials

Single sign-on

Plan and models

Rented capacity

Connectors

Knowledge base

What is recorded is the entry name, its scope (for a task entry — “project · task #N”) and type, which fields changed and what the flags were before and after; the entry body does not go into the log — the log is not a text store. Everything the model does with the knowledge base — at any stage of the work and in passes — arrives as pipeline actions (the actor is “system”) with the stage and the task in the details. Viewing the section is not logged, like any reading. See Knowledge base.

Audit log

Pipeline (system)

Platform operator

Notes on individual events

• session.login — the password was accepted and a confirmation code sent; the sign-in itself completes with the session.login_confirm event. A refusal in session.login means a wrong password or login; a refusal in session.login_confirm means a wrong code. Both are recorded in all the organisations the person belongs to: the owner of each sees their member’s sign-in attempts.
• session.org_connect — connecting to the organisation’s space; this is where the address and browser are captured for the later actions in this session. Recorded every time the app is opened.
• session.refresh_denied — session renewal refused: the token was revoked (sign-out, password change) or reused — the latter is worth checking.
• session.register_start / session.register — recorded in the new organisation’s log: it begins with its registration.
• member.owner_set — appointing or removing an owner; a critical event.
• credentials.set / credentials.delete — a repository token saved or deleted; the token value is absent from the log.
• connector.enrol — the agent was paired with a code; the actor is the connector itself (its identifier), the address is where it connected from. connector.revoke is critical.
• connector.event / connector.event_refused — a question, research or task from a comment in a tracker: every request and every refusal to an author who is not on the “Who may ask the bot” list. The tracker, the ticket and who asked (name, login and email, if the tracker shows them) are recorded — without the text of the question. Delivering the same comment again does not produce a second entry.
• auditlog.export — a log export: by whom, in which format, with which filters and how many rows. An attempt to export without the permission is recorded as a refusal.
• pipeline.* — pipeline actions; instead of * — the notification feed event type: task_closed, merge_conflict, review_needed, vm_ready, flow_failed and others. The actor is “system”.
• operator.* — actions of a platform employee on your organisation: operator.billing.balance.topup, operator.billing.balance.adjust, operator.connector.disable, operator.demo.open (the operator opened the demo organisation’s workspace under its owner’s account). The actor is “operator” with their account.