Audit Lookup Table (ThreatStream)

ThreatStream user activity logs can be retrieved from the audit system lookup table, which captures events from both ThreatStream and Security Analytics. The table includes logs generated through the user interface as well as API interactions. For details on API and Security Analytics logs, see Audit Logging (Limited Availability) .

Note: Alternatively, ThreatStream user audit logs can be viewed on the Audit page in ThreatStream Settings. For details, refer toUser Activity Audit. Note that ThreatStream MCP user activity is not recorded on the Audit page.

To access ThreatStream user activity logs:

  1. Navigate to Search > Manage > Lookup Tables.

  2. Locate the audit system lookup table using the Search field.

  3. Click the audit link to view the table details on the Result tab.

  4. Use the following AQL expression to narrow down your results to ThreatStream user actions.

    audit | where app = "ts_user_action"

For more information on how to filter AQL search results, refer to Anomali Search.

Audit Logs for ThreatStream

User Actions in ThreatStream Description
accepted-chat-eula User accepted the Chat End of User License Agreement.
added-description User added or modified the Summary text on the user's Profile page.

added-permission

User granted a user permission on the ThreatStream Settings > User Admin page.
advanced-search User initiated advanced-search.
asset-issue-status-change User assigned a status to the asset issue.
commented User added a comment to the object specified in the category field.

created

User created the object specified in the category field.
deleted User deleted the object specified in the category field.
downvoted User disliked the intelligence.
exported User exported the object specified in the category field.

logout

User logged out by clicking the Logout link.
marked-complete User marked an intelligence initiative specified in the category field as complete.
mcp-auth User successfully authenticated and connected to an MCP client.
mcp-scope-violation User used an MCP tool without the required scopes. This event records the attempted tool execution, the scopes required to run it, the scopes currently granted to the user's token, and any missing scopes.
mitre_score The user updated the MITRE ATT&CK Security Control Framework for your organization.
mitre_version The user updated the MITRE ATT&CK version.

removed-permission

The user removed a user permission on the ThreatStream Settings > User Admin page.
search The user initiated basic search.

signed-in

The user signed in by specifying their user name and password.
signed-in-sso The user logged in using SSO.
starred The user bookmarked the intelligence.

updated

The user updated the object specified in the category field.
uploaded-avatar The user uploaded an avatar to the user's own Profile page.
upvoted The user liked the intelligence.
viewed The user viewed the intelligence.
watched The user requested to receive notifications when the intelligence is updated.