Audit Logging for Resource Tags

All operations on resource tags such as creating, renaming, changing a color or description, merging, and deleting, write entries to the audit log under the resourcetag category. Each entry records the action type, the user who performed it (email and user ID), a timestamp, and the state of the affected tag. The sections below describe what each operation logs and provide example AQL queries for retrieving entries from the audit log.

Tag Creation

Log Details

When a tag is created, the action is logged as an entry in the audit logs and includes:

  • action: updated with the created status

  • user details: email and user ID

  • timestamp

  • other details including name, color, description, initial sharing type, and permission level

Response Digest Updates

The tag_action field in the response_digest of the audit log is set to tag.created.

Accessing the Audit Log

You can access the resource tag audit log entries by launching an AQL Search:

Copy 
audit | where category='resourcetag'

Renaming and Merging Tags

Log Details

All rename and merge operations write entries to the audit log. Each logged entry includes:

  • action field: updated with the updated status for both renaming and merge actions

  • user details: email and user ID

  • timestamp

  • the previous and current state of the tag

Response Digest Updates

The audit record is written against the newly merged tag.

Additionally, the tag_action field in the response_digest of the audit log is updated with one of the following values:

Action Response Digest Update

Rename

Logged as tag.renamed.
Color change

Logged as tag.color_changed.
Description change Logged as tag.description_changed.
Merge Logged as tag.merged. Includes the source tag name, target tag name, and the number of resources re-tagged.
Permissions change Logged as tag.permissions_changed when the sharing type or permission level of a tag is updated.

Accessing the Audit Log

You can access the resource tag audit log entries by launching AQL Search queries:

Example 1: Check audit logs for a rename operation

Copy 
audit | where category='resourcetag' and action = "updated"

Example 2: Check audit logs for a merge operation

Copy 
audit | where category='resourcetag' and action='updated' and response_digest contains '"tag_action": "tag.merged"'

Example 3: Check actions taken by a specific user

Copy 
audit | where category='resourcetag' and user='john.doe@acme.com'

Example 4: Renaming of a specific tag

Copy 
audit | where category='resourcetag' and action='updated' and response_digest contains '"tag_action": "tag.updated"' and response_digest contains '"name"'

Example 5: Merge where a specific tag was the source

Copy 
audit | where category='resourcetag' and response_digest contains '"tag_action": "tag.merged"' and response_digest contains '"source_tag": "OldTagName"'

Example 6: Merge where a specific tag was the target

Copy 
audit | where category='resourcetag' and response_digest contains '"tag_action": "tag.merged"' and response_digest contains '"target_tag": "SurvivingTagName"'

Tag Deletion

Log Details

When a tag is deleted, the action is logged as an entry in the audit logs and includes:

  • action field: updated with the deleted status

  • user details: email and user ID

  • timestamp

  • information about the deleted tag: including its name, color, and description.

Response Digest Updates

For bulk deletes, a separate audit log entry is written for each deleted tag. Additionally, a tag.deleted entry is written to the tag_action field in the response_digest of the audit log.

Accessing the Audit Log

You can access the audit log entries for both single and bulk tag deletion by launching the following AQL query:

Copy 
audit | where category='resourcetag' and action = "deleted"