Catalogue du journal d'événements

Ensemble des événements d'audit, de workflow et d'intégrité enregistrés par Scrydon.

Scrydon n'accepte que les actions et types de ressources de ce catalogue. Cette page utilise le même registre côté client que les émetteurs et la validation du serveur : une valeur acceptée apparaît donc toujours ici.

Consultez Journalisation d'audit pour la conservation, l'exportation, le transfert SIEM et les champs de chaque événement.

Actions d'audit

Les entrées d'autorisation couvrent chaque combinaison d'action (read, write, delete, execute, admin, retire) et de résultat (GRANTED, DENIED, INDETERMINATE). Une décision produit une seule entrée. Le sujet évalué est conservé dans la preuve bornée, tandis que producer identifie le workload Scrydon authentifié qui l'a soumise.

Action	Clé du registre
`SECRET_CREATE`	`SECRET_CREATE`
`SECRET_UPDATE`	`SECRET_UPDATE`
`SECRET_DELETE`	`SECRET_DELETE`
`SECRET_ACCESS`	`SECRET_ACCESS`
`PROVIDER_CREATE`	`PROVIDER_CREATE`
`PROVIDER_UPDATE`	`PROVIDER_UPDATE`
`PROVIDER_DELETE`	`PROVIDER_DELETE`
`PROVIDER_TEST`	`PROVIDER_TEST`
`RESOURCE_CREATE`	`RESOURCE_CREATE`
`RESOURCE_UPDATE`	`RESOURCE_UPDATE`
`RESOURCE_DELETE`	`RESOURCE_DELETE`
`RESOURCE_ACCESS`	`RESOURCE_ACCESS`
`AUTH_READ_DENIED`	`AUTH_READ_DENIED`
`AUTH_WRITE_DENIED`	`AUTH_WRITE_DENIED`
`AUTH_DELETE_DENIED`	`AUTH_DELETE_DENIED`
`AUTH_EXECUTE_DENIED`	`AUTH_EXECUTE_DENIED`
`AUTH_ADMIN_DENIED`	`AUTH_ADMIN_DENIED`
`AUTH_RETIRE_DENIED`	`AUTH_RETIRE_DENIED`
`AUTH_READ_GRANTED`	`AUTH_READ_GRANTED`
`AUTH_WRITE_GRANTED`	`AUTH_WRITE_GRANTED`
`AUTH_DELETE_GRANTED`	`AUTH_DELETE_GRANTED`
`AUTH_EXECUTE_GRANTED`	`AUTH_EXECUTE_GRANTED`
`AUTH_ADMIN_GRANTED`	`AUTH_ADMIN_GRANTED`
`AUTH_RETIRE_GRANTED`	`AUTH_RETIRE_GRANTED`
`AUTH_READ_INDETERMINATE`	`AUTH_READ_INDETERMINATE`
`AUTH_WRITE_INDETERMINATE`	`AUTH_WRITE_INDETERMINATE`
`AUTH_DELETE_INDETERMINATE`	`AUTH_DELETE_INDETERMINATE`
`AUTH_EXECUTE_INDETERMINATE`	`AUTH_EXECUTE_INDETERMINATE`
`AUTH_ADMIN_INDETERMINATE`	`AUTH_ADMIN_INDETERMINATE`
`AUTH_RETIRE_INDETERMINATE`	`AUTH_RETIRE_INDETERMINATE`
`EXECUTION_GRANT_CREATED`	`EXECUTION_GRANT_CREATED`
`EXECUTION_GRANT_REJECTED`	`EXECUTION_GRANT_REJECTED`
`EXECUTION_GRANT_BOUND`	`EXECUTION_GRANT_BOUND`
`EXECUTION_GRANT_DERIVED`	`EXECUTION_GRANT_DERIVED`
`EXECUTION_GRANT_VALIDATED`	`EXECUTION_GRANT_VALIDATED`
`EXECUTION_GRANT_REVOKED`	`EXECUTION_GRANT_REVOKED`
`EXECUTION_GRANT_EXPIRED`	`EXECUTION_GRANT_EXPIRED`
`authz.audit.policy.updated`	`AUTHZ_AUDIT_POLICY_UPDATED`
`isolation.policy.updated`	`ISOLATION_POLICY_UPDATED`
`INTEGRATION_ENTITLEMENT_MODE_CHANGE`	`INTEGRATION_ENTITLEMENT_MODE_CHANGE`
`INTEGRATION_ENTITLEMENT_GRANT`	`INTEGRATION_ENTITLEMENT_GRANT`
`INTEGRATION_ENTITLEMENT_REVOKE`	`INTEGRATION_ENTITLEMENT_REVOKE`
`INTEGRATION_ENTITLEMENT_UPDATE`	`INTEGRATION_ENTITLEMENT_UPDATE`
`INTEGRATION_ACCESS_DENIED`	`INTEGRATION_ACCESS_DENIED`
`INTEGRATION_CREDENTIAL_RESOLVED`	`INTEGRATION_CREDENTIAL_RESOLVED`
`INTEGRATION_UPGRADED`	`INTEGRATION_UPGRADED`
`INTEGRATION_ROLLED_BACK`	`INTEGRATION_ROLLED_BACK`
`INTEGRATION_ENABLE`	`INTEGRATION_ENABLE`
`INTEGRATION_DISABLE`	`INTEGRATION_DISABLE`
`INTEGRATION_DEPRECATE`	`INTEGRATION_DEPRECATE`
`INTEGRATION_CANCEL_DEPRECATION`	`INTEGRATION_CANCEL_DEPRECATION`
`MCP_TOOL_EXECUTED`	`MCP_TOOL_EXECUTED`
`MCP_SERVER_AVAILABILITY_CHANGED`	`MCP_SERVER_AVAILABILITY_CHANGED`
`pack.catalog.uploaded`	`PACK_CATALOG_UPLOADED`
`pack.catalog.retired`	`PACK_CATALOG_RETIRED`
`pack.environment.enabled`	`PACK_ENVIRONMENT_ENABLED`
`pack.environment.disabled`	`PACK_ENVIRONMENT_DISABLED`
`pack.upgrade.proposed`	`PACK_UPGRADE_PROPOSED`
`pack.upgrade.published`	`PACK_UPGRADE_PUBLISHED`
`pack_source.created`	`PACK_SOURCE_CREATED`
`pack_source.updated`	`PACK_SOURCE_UPDATED`
`pack_source.deleted`	`PACK_SOURCE_DELETED`
`pack_source.signature_policy_changed`	`PACK_SOURCE_SIGNATURE_POLICY_CHANGED`
`pack_source.sync_triggered`	`PACK_SOURCE_SYNC_TRIGGERED`
`pack_source.sync_failed`	`PACK_SOURCE_SYNC_FAILED`
`pack_source.unsigned_policy_used`	`PACK_SOURCE_UNSIGNED_POLICY_USED`
`environment.create`	`WORKSPACE_ENVIRONMENT_CREATED`
`environment.update`	`WORKSPACE_ENVIRONMENT_UPDATED`
`environment.delete`	`WORKSPACE_ENVIRONMENT_DELETED`
`SUBSCRIPTION_CREATE`	`AUDIT_SUBSCRIPTION_CREATE`
`audit.test`	`AUDIT_TEST`
`audit.export`	`AUDIT_EXPORT`
`audit.retention.updated`	`AUDIT_RETENTION_UPDATED`
`audit.chain.checkpoint`	`AUDIT_CHAIN_CHECKPOINT`
`audit.chain.verify`	`AUDIT_CHAIN_VERIFY`
`dlp.policy.activated`	`DLP_POLICY_ACTIVATED`
`dlp.policy.updated`	`DLP_POLICY_UPDATED`
`dlp.policy.reviewed`	`DLP_POLICY_REVIEWED`
`dlp.policy.review_overdue`	`DLP_POLICY_REVIEW_OVERDUE`
`dlp.scan.input`	`DLP_SCAN_INPUT`
`dlp.scan.output`	`DLP_SCAN_OUTPUT`
`dlp.violation`	`DLP_VIOLATION`
`dlp.action_taken`	`DLP_ACTION_TAKEN`
`dlp.override.granted`	`DLP_OVERRIDE_GRANTED`
`dlp.override.rejected`	`DLP_OVERRIDE_REJECTED`
`dlp.classifier.degraded`	`DLP_CLASSIFIER_DEGRADED`
`dlp.prompt_injection.detected`	`DLP_PROMPT_INJECTION_DETECTED`
`dlp.hits.acknowledged`	`DLP_HITS_ACKNOWLEDGED`
`dlp.exception.activated`	`DLP_EXCEPTION_ACTIVATED`
`dlp.exception.expired`	`DLP_EXCEPTION_EXPIRED`
`dlp.pre_action.blocked`	`DLP_PRE_ACTION_BLOCKED`
`company_context.ensured`	`COMPANY_CONTEXT_ENSURED`
`company_context.page.create`	`COMPANY_CONTEXT_PAGE_CREATE`
`company_context.page.update`	`COMPANY_CONTEXT_PAGE_UPDATE`
`company_context.page.delete`	`COMPANY_CONTEXT_PAGE_DELETE`
`company_context.page.reclassify`	`COMPANY_CONTEXT_PAGE_RECLASSIFY`
`company_context.source.ingest`	`COMPANY_CONTEXT_SOURCE_INGEST`
`company_context.source.retry`	`COMPANY_CONTEXT_SOURCE_RETRY`
`company_context.source.bulk-delete`	`COMPANY_CONTEXT_SOURCE_BULK_DELETE`
`company_context.folder.delete`	`COMPANY_CONTEXT_FOLDER_DELETE`
`moderation.policy.updated`	`MODERATION_POLICY_UPDATED`
`moderation.policy.hit`	`MODERATION_POLICY_HIT`
`classification.scheme_updated`	`CLASSIFICATION_SCHEME_UPDATED`
`classification.document_labelled`	`CLASSIFICATION_DOCUMENT_LABELLED`
`classification.endpoint_rated`	`CLASSIFICATION_ENDPOINT_RATED`
`classification.aggregation_capped`	`CLASSIFICATION_AGGREGATION_CAPPED`
`security.clearance_granted`	`CLEARANCE_GRANTED`
`security.clearance_override_created`	`CLEARANCE_OVERRIDE_CREATED`
`security.clearance_baseline_set`	`CLEARANCE_BASELINE_SET`
`security.clearance_revoked`	`CLEARANCE_REVOKED`
`security.sessions_terminated`	`SESSIONS_TERMINATED`
`security.spillage_detected`	`SPILLAGE_DETECTED`
`security.clearance_egress_blocked`	`CLEARANCE_EGRESS_BLOCKED`
`impersonation.session.created`	`IMPERSONATION_SESSION_CREATED`
`scim.user.provisioned`	`SCIM_USER_PROVISIONED`
`scim.user.updated`	`SCIM_USER_UPDATED`
`scim.user.deactivated`	`SCIM_USER_DEACTIVATED`
`scim.user.reactivated`	`SCIM_USER_REACTIVATED`
`scim.user.linked`	`SCIM_USER_LINKED`
`scim.group.created`	`SCIM_GROUP_CREATED`
`scim.group.updated`	`SCIM_GROUP_UPDATED`
`scim.group.deleted`	`SCIM_GROUP_DELETED`
`scim.group.member_added`	`SCIM_GROUP_MEMBER_ADDED`
`scim.group.member_removed`	`SCIM_GROUP_MEMBER_REMOVED`
`scim.token.generated`	`SCIM_TOKEN_GENERATED`
`scim.token.revoked`	`SCIM_TOKEN_REVOKED`
`table.create`	`TABLE_CREATE`
`table.update`	`TABLE_UPDATE`
`table.delete`	`TABLE_DELETE`
`table.archive`	`TABLE_ARCHIVE`
`table.restore`	`TABLE_RESTORE`
`table.write`	`TABLE_WRITE`
`table.external_commit_reconciled`	`TABLE_EXTERNAL_COMMIT_RECONCILED`
`table.maintenance_snapshots_expired`	`TABLE_MAINTENANCE_SNAPSHOTS_EXPIRED`
`table.maintenance_completed`	`TABLE_MAINTENANCE_COMPLETED`
`table.orphan_reclaimed`	`TABLE_ORPHAN_RECLAIMED`
`table.warehouse_drift_detected`	`TABLE_WAREHOUSE_DRIFT_DETECTED`
`table.warehouse_profile_reconciled`	`TABLE_WAREHOUSE_PROFILE_RECONCILED`
`table.orphan_detected`	`TABLE_ORPHAN_DETECTED`
`table.cutover_started`	`TABLE_CUTOVER_STARTED`
`table.cutover_completed`	`TABLE_CUTOVER_COMPLETED`
`table.cutover_failed`	`TABLE_CUTOVER_FAILED`
`policy.compile`	`POLICY_COMPILE`
`data_source.applied`	`DATA_SOURCE_APPLIED`
`data-source.resolve-conflict`	`DATA_SOURCE_RESOLVE_CONFLICT`
`data-source.remove`	`DATA_SOURCE_REMOVE`
`policy.create`	`POLICY_CREATE`
`policy.update`	`POLICY_UPDATE`
`policy.delete`	`POLICY_DELETE`
`iceberg.config`	`ICEBERG_CONFIG`
`iceberg.catalog`	`ICEBERG_CATALOG`
`egress.blocked`	`EGRESS_BLOCKED`
`egress.allowed`	`EGRESS_ALLOWED`
`integration.connection.created`	`INTEGRATION_CONNECTION_CREATED`
`integration.connection.updated`	`INTEGRATION_CONNECTION_UPDATED`
`integration.connection.deleted`	`INTEGRATION_CONNECTION_DELETED`
`chat.admin.access`	`CHAT_ADMIN_ACCESS`
`chat.message.truncated`	`CHAT_MESSAGE_TRUNCATED`
`chat.history.search`	`CHAT_HISTORY_SEARCH`
`chat.conversation.archived`	`CHAT_CONVERSATION_ARCHIVED`
`chat.conversation.deleted`	`CHAT_CONVERSATION_DELETED`
`chat.conversation.created`	`CHAT_CONVERSATION_CREATED`
`chat.message.sent`	`CHAT_MESSAGE_SENT`
`chat.message.received`	`CHAT_MESSAGE_RECEIVED`
`chat.message.aborted`	`CHAT_MESSAGE_ABORTED`
`cortex.plan.built`	`CORTEX_PLAN_BUILT`
`cortex.plan.failed`	`CORTEX_PLAN_FAILED`
`cortex.plan.message`	`CORTEX_PLAN_MESSAGE`
`SIGNIN_FAILED`	`SIGNIN_FAILED`
`SIGNIN_RATE_LIMITED`	`SIGNIN_RATE_LIMITED`
`2FA_FAILED`	`TWO_FACTOR_FAILED`
`SESSION_CREATE`	`SESSION_CREATE`
`SESSION_REVOKE`	`SESSION_REVOKE`
`super_admin.role.granted`	`SUPER_ADMIN_ROLE_GRANTED`
`super_admin.org_membership.granted`	`SUPER_ADMIN_ORG_MEMBERSHIP_GRANTED`
`super_admin.org_membership.elevated`	`SUPER_ADMIN_ORG_MEMBERSHIP_ELEVATED`

Types de ressources d'audit

Type de ressource	Clé du registre
`secret`	`SECRET`
`secretProvider`	`SECRET_PROVIDER`
`user`	`USER`
`organization`	`ORGANIZATION`
`organizationMember`	`ORGANIZATION_MEMBER`
`workspace`	`WORKSPACE`
`workspaceEnvironment`	`WORKSPACE_ENVIRONMENT`
`file`	`FILE`
`workflow`	`WORKFLOW`
`knowledgeBase`	`KNOWLEDGE_BASE`
`kb_page`	`KB_PAGE`
`document`	`DOCUMENT`
`folder`	`FOLDER`
`template`	`TEMPLATE`
`processFlow`	`PROCESS_FLOW`
`processTemplate`	`process_flow`
`schedule`	`SCHEDULE`
`memory`	`MEMORY`
`chat`	`CHAT`
`webhook`	`WEBHOOK`
`copilotTool`	`COPILOT_TOOL`
`integration`	`INTEGRATION`
`integrationEntitlement`	`INTEGRATION_ENTITLEMENT`
`mcpServer`	`MCP_SERVER`
`pack_source`	`PACK_SOURCE`
`eventLogReceiver`	`AUDIT_LOG_SUBSCRIPTION`
`eventLog`	`AUDIT_LOG`
`eventLogRetentionConfig`	`AUDIT_LOG_RETENTION_CONFIG`
`auditChain`	`AUDIT_CHAIN`
`session`	`SESSION`
`userClearance`	`USER_CLEARANCE`
`organizationPolicy`	`ORGANIZATION_POLICY`
`integration_connection`	`INTEGRATION_CONNECTION`
`dlpHits`	`DLP_HITS`
`organizationIntegrationAccount`	`ORGANIZATION_INTEGRATION_ACCOUNT`
`dlpPolicy`	`DLP_POLICY`
`moderationPolicy`	`MODERATION_POLICY`
`User`	`SCIM_USER`
`Group`	`SCIM_GROUP`
`Token`	`SCIM_TOKEN`
`sandbox-egress`	`SANDBOX_EGRESS`
`managed_table`	`MANAGED_TABLE`
`managed-table`	`MANAGED_TABLE_HYPHENATED`
`policy-bundle`	`POLICY_BUNDLE`
`data_source`	`DATA_SOURCE`
`data-source`	`DATA_SOURCE_HYPHENATED`
`data-access-policy`	`DATA_ACCESS_POLICY`
`iceberg_catalog`	`ICEBERG_CATALOG`
`chat_conversation`	`CHAT_CONVERSATION`
`chat_message_embedding`	`CHAT_MESSAGE_EMBEDDING`
`chat_message`	`CHAT_MESSAGE`
`workflow_plan`	`WORKFLOW_PLAN`
`packInstall`	`PACK_INSTALL`
`policyExecutionGrant`	`POLICY_EXECUTION_GRANT`
`objectType`	`OBJECT_TYPE`
`linkType`	`LINK_TYPE`
`actionType`	`ACTION_TYPE`
`objectInstance`	`OBJECT_INSTANCE`
`linkInstance`	`LINK_INSTANCE`
`ontologyBranch`	`ONTOLOGY_BRANCH`
`packCatalog`	`PACK_CATALOG`

Événements de workflow

Action	Clé du registre
`workflow.scheduled`	`SCHEDULED`
`workflow.started`	`STARTED`
`workflow.paused`	`PAUSED`
`workflow.resumed`	`RESUMED`
`workflow.completed`	`COMPLETED`
`workflow.failed`	`FAILED`
`workflow.terminated`	`TERMINATED`
`workflow.cancelled`	`CANCELLED`
`workflow.purged`	`PURGED`

Ressources : workflowworkflow-executionworkflow-schedule

Événements d'intégrité

Action	Clé du registre
`integrity.event-log.verification-failed`	`EVENT_LOG_VERIFICATION_FAILED`
`integrity.event-log.checkpoint-failed`	`EVENT_LOG_CHECKPOINT_FAILED`
`integrity.dapr-history.verification-failed`	`DAPR_HISTORY_VERIFICATION_FAILED`
`integrity.dapr-history.configuration-mismatch`	`DAPR_SIGNING_CONFIGURATION_MISMATCH`
`integrity.incident.acknowledged`	`INCIDENT_ACKNOWLEDGED`
`integrity.incident.recovered`	`INCIDENT_RECOVERED`

Ressources : event-log-chainevent-log-checkpointdapr-workflow-historyintegrity-incident

Événements classifiés

La liste, la liste filtrée et l'exportation NDJSON appliquent la même règle d'habilitation. Si un événement dépasse le rang du lecteur ou utilise un autre schéma de classification, Scrydon conserve l'action, l'acteur, l'organisation, l'horodatage, les éléments de décision et la chaîne d'intégrité, mais remplace l'identifiant de ressource et le contexte sensible par null. La ligne contient redacted: true et l'interface affiche un cadenas.

Les organisations sans données d'habilitation conservent le comportement antérieur. Les lignes historiques ne sont pas reclassifiées.

Intégrité

Chaque nouvel événement rejoint une chaîne SHA-256 obligatoire propre à son organisation ou au périmètre global. Les points de contrôle signés avec ML-DSA-65 sont vérifiables depuis le journal d'événements ou par l'API. La chaîne ne s'applique qu'aux nouvelles lignes ; les anciennes conservent des champs de chaîne nuls.

La preuve des décisions d'autorisation est toujours complète par politique ; il n'existe aucun niveau de journalisation à l'exécution. Une mise en file locale dégradée déclenche une alerte et ne peut être réconciliée qu'avec l'identifiant et le payload exacts de la décision d'origine.