Skip to main content

The audit log for dbt Cloud Enterprise

To review actions performed by people in your organization, dbt provides logs of audited user and system events in real time. The audit log appears as events happen and includes details such as who performed the action, what the action was, and when it was performed. You can use these details to troubleshoot access issues, perform security audits, or analyze specific events.

You must be an Account Admin to access the audit log and this feature is only available on Enterprise plans.

The dbt Cloud audit log stores all the events that occurred in your organization in real-time, including:

  • For events within 90 days, the dbt Cloud audit log has a selectable date range that lists events triggered.
  • For events beyond 90 days, Account Admins can export all events by using Export All.

Accessing the audit log

To access the audit log, click the gear icon in the top right, then click Audit Log.

Audit log menuAudit log menu

Understanding the audit log

On the audit log page, you will see a list of various events and their associated event data. Each of these events show the following information in dbt:

  • Event name: Action that was triggered
  • Agent: User who triggered that action/event
  • Timestamp: Local timestamp of when the event occurred

Event details

Click the event card to see the details about the activity that triggered the event. This view provides important details, including when it happened and what type of event was triggered. For example, if someone changes the settings for a job, you can use the event details to see which job was changed (type of event: v1.events.job_definition.Changed), by whom (person who triggered the event: actor), and when (time it was triggered: created_at_utc). For types of events and their descriptions, see Events in audit log.

The event details provide the key factors of an event:

NameDescription
account_idAccount ID of where the event occurred
actorActor that carried out the event - User or Service
actor_idUnique ID of the actor
actor_ipIP address of the actor
actor_nameIdentifying name of the actor
created_at_utcUTC timestamp on when the event occurred
event_typeUnique key identifying the event
idUnique ID of the event
serviceService that carried out the action
sourceSource of the event - dbt Cloud UI or API
v1.events.event_typeThis key will be different for each event and will match the event_type. This data will include all the details about the object(s) that was changed.

Audit log events

The audit log supports various events for different objects in dbt Cloud. You will find events for authentication, environment, jobs, service tokens, groups, user, project, permissions, license, connection, repository, and credentials.

Authentication

Event NameEvent TypeDescription
Auth Provider Changedv1.events.auth_provider.ChangedAuthentication provider settings changed
Credential Login Failedv1.events.auth.CredentialsLoginFailedUser login via username and password failed
Credential Login Succeededv1.events.auth.CredentialsLoginSucceededUser successfully logged in with username and password
SSO Login Failedv1.events.auth.SsoLoginFailedUser login via SSO failed
SSO Login Succeededv1.events.auth.SsoLoginSucceededUser successfully logged in via SSO

Environment

Event NameEvent TypeDescription
Environment Addedv1.events.environment.AddedNew environment successfully created
Environment Changedv1.events.environment.ChangedEnvironment settings changed
Environment Removedv1.events.environment.RemovedEnvironment successfully removed

Jobs

Event NameEvent TypeDescription
Job Addedv1.events.job_definition.AddedNew Job successfully created
Job Changedv1.events.job_definition.ChangedJob settings changed
Job Removedv1.events.job_definition.RemovedJob definition removed

Service Token

Event NameEvent TypeDescription
Service Token Createdv1.events.service_token.CreatedNew Service Token was successfully created
Service Token Revokedv1.events.service_token.RevokedService Token was revoked

Group

Event NameEvent TypeDescription
Group Addedv1.events.user_group.AddedNew Group successfully created
Group Changedv1.events.user_group.ChangedGroup settings changed
Group Removedv1.events.user_group.ChangedGroup successfully removed

User

Event NameEvent TypeDescription
Invite Addedv1.events.invite.AddedUser invitation added and sent to the user
Invite Redeemedv1.events.invite.RedeemedUser redeemed invitation
User Added to Accountv1.events.account.UserAddedNew user added to the account
User Added to Groupv1.events.user_group_user.AddedAn existing user is added to a group
User Removed from Accountv1.events.account.UserRemovedUser removed from the account
User Removed from Groupv1.events.user_group_user.RemovedAn existing user is removed from a group
Verification Email Confirmedv1.events.user.jit.email.ConfirmedEmail verification confirmed by user
Verification Email Sentv1.events.user.jit.email.SentEmail verification sent to user created via JIT

Project

Event NameEvent TypeDescription
Project Addedv1.events.project.AddedNew project added
Project Changedv1.events.project.ChangedProject settings changed
Project Removedv1.events.project.RemovedProject is removed

Permissions

Event NameEvent TypeDescription
User Permission Addedv1.events.permission.AddedNew user permissions are added
User Permission Removedv1.events.permission.RemovedUser permissions are removed

License

Event NameEvent TypeDescription
License Mapping Addedv1.events.license_map.AddedNew user license mapping is added
License Mapping Changedv1.events.license_map.ChangedUser license mapping settings are changed
License Mapping Removedv1.events.license_map.RemovedUser license mapping is removed

Connection

Event NameEvent TypeDescription
Connection Addedv1.events.connection.AddedNew Data Warehouse connection added
Connection Changedv1.events.connection.ChangedData Warehouse Connection settings changed
Connection Removedv1.events.connection.RemovedData Warehouse connection removed

Repository

Event NameEvent TypeDescription
Repository Addedv1.events.repository.AddedNew repository added
Repository Changedv1.events.repository.ChangedRepository settings changed
Repository Removedv1.events.repository.RemovedRepository removed

Credentials

Event NameEvent TypeDescription
Credentials Added to Projectv1.events.credentials.AddedProject credentials added
Credentials Changed in Projectv1.events.credentials.ChangedCredentials changed in project
Credentials Removed from Projectv1.events.credentials.RemovedCredentials removed from project

Searching the audit log

You can search the audit log to find a specific event or actor, which is limited to the ones listed in Events in audit log. The audit log successfully lists historical events spanning the last 90 days. You can search for an actor or event using the search bar, and then narrow your results using the time window.

Use search bar to find content in the audit logUse search bar to find content in the audit log

Exporting logs

You can use the audit log to export all historical audit results for security, compliance, and analysis purposes:

  • For events within 90 days dbt Cloud will automatically display the 90-day selectable date range. Select Export Selection to download a CSV file of all the events that occurred in your organization within 90 days.

  • For events beyond 90 days Select Export All. The Account Admin will receive an email link to download a CSV file of all the events that occurred in your organization.

View audit log export optionsView audit log export options

Azure Single-tenant

For users deployed in Azure single tenant, while the Export All button isn't available, you can conveniently use specific APIs to access all events:

0