Skip to content
Telemetry
For teams investigating authentication and privileged actions

Security and audit-log analytics

Record authentication failures, access changes, and privileged actions. Use these events to reconstruct an incident timeline, and exclude credentials and private payloads.

Reviewed by the Telemetry product team on . We checked the event fields, suggested queries, and data to exclude. Who reviews this page

Connect real telemetryCopy the prompt
Why this works
  • Measure authentication failures and count affected identities without collecting credentials.
  • Preserve actor, target, reason, and authorization outcome as controlled fields.
  • Build reproducible incident timelines from append-only audit events.
How to test this use case

Measure Security and audit-log analytics and check the results

To measure security and audit-log analytics, choose one workflow and its owner. Define the events, test them with known inputs, and write a query that answers a specific question.

  1. 1

    Choose when to log

    List where users authenticate and where privileged actions run.

  2. 2

    Capture the outcome

    Begin with authentication_completed, authorization_denied, privileged_action_completed and document the grain of each event.

  3. 3

    Check the stored rows

    Exercise denied, failed, successful, and suspicious paths before alerting.

  4. 4

    Make the decision

    Which login method has a sustained failure spike?

Agent prompt

Paste this into your coding agent

Replace YOUR_API_KEY after signup, then ask the agent to run the product flow and verify the first events.

agent prompt

Security and audit-log analytics setup prompt

text
Instrument security and audit-log workflows with Telemetry.

Use /skill.md and this Telemetry API key: YOUR_API_KEY

Log controlled authentication and authorization outcomes with event_id, actor_id, target_id, authentication_method, action, outcome, failure_reason, policy_version, session_id, ip_country when approved, environment, release, and timestamp_utc.

Create queries for authentication failure rate, affected identities, denied actions, policy changes, and an incident timeline. Document retention and access ownership.

Never log passwords, tokens, cookies, full IP addresses, authorization headers, recovery codes, or raw identity-provider payloads. Route suspicious behavior through the security response process rather than treating a generic product alert as an intrusion detector.

Setup steps

  1. 1List where users authenticate and where privileged actions run.
  2. 2Define controlled outcomes and reasons with a security owner.
  3. 3Use privacy-safe actor and target identifiers with explicit retention.
  4. 4Exercise denied, failed, successful, and suspicious paths before alerting.

Events to capture

authentication_completedauthorization_deniedprivileged_action_completedaccess_policy_changedsecurity_investigation_opened

Questions you can answer

  • Which login method has a sustained failure spike?
  • How many distinct identities are affected?
  • Which privileged actions occurred during an incident window?

Example event schemas

Event schemas for this workflow

Check what each event records, when to send it, and which field types it needs. Review the example payload and privacy checklist before using it in production.

Identity security8 fields

authentication_attempt_completed

One completed authentication attempt.

View schema

Use these queries in Telemetry

Learn about Structured events

Send events with consistent names and field types. Choose which context to include before sending it.

Explore Structured eventsRead customer stories

Related SQL recipes

More SQL recipes

Run the query using this workflow's event fields and check the example result. Save the result to a dashboard or set up an alert.

Browse all recipes
Security and auditIntermediate

Analyze authentication failure rate

Which authentication methods and failure reasons need investigation?

Open recipe
Security and auditAdvanced

Detect suspicious authentication bursts

Which authentication windows show concentrated failure activity?

Open recipe
Security and auditBeginner

Analyze access-policy denials

Which access policies deny the most actors and actions?

Open recipe
Security and auditIntermediate

Audit API-key lifecycle events

Which API-key lifecycles require owner review?

Open recipe
Security and auditIntermediate

Review sensitive data exports with SQL

Which sensitive export classes or actor roles require review?

Open recipe
Security and auditBeginner

Audit privileged actions with SQL

Which privileged actions fail or require human review most often?

Open recipe
Recipe collectionsSecurity and audit SQL

Next step

Create the API key your agent will use

The free plan is enough to run the prompt, send test events, and review the first dashboard.

Prompt packConnect real telemetry

Related pages

AI agent security monitoring

Monitor tool authorization, policy denials, approval queues, risky action classes, and release changes without storing prompts, credentials, or tool payloads.

Open page