Skip to content
Telemetry
For teams investigating authentication and privileged actions

Security and Audit-Log Analytics

Design privacy-aware security events for authentication failures, access changes, privileged actions, and incident timelines.

Reviewed by the Telemetry product team on . Event contract, recommended analysis, and privacy boundaries. Review standards and ownership

Start with sample dataCopy the prompt
Why this works
  • Measure failure rate and blast radius without collecting credentials.
  • Preserve actor, target, reason, and authorization outcome as controlled fields.
  • Build reproducible incident timelines from append-only audit events.
Use-case evidence path

Security and Audit-Log Analytics: from implementation to decision

A complete security and audit-log analytics measurement loop connects one owned workflow, a bounded event contract, a controlled fixture, and a question someone can act on.

  1. 1

    Set the boundary

    Inventory authentication and privileged-action boundaries.

  2. 2

    Capture the outcome

    Begin with authentication_completed, authorization_denied, privileged_action_completed and document the grain of each event.

  3. 3

    Prove the rows

    Exercise denied, failed, successful, and suspicious paths before alerting.

  4. 4

    Make the decision

    Which login method has a sustained failure spike?

Agent prompt

Paste this into your coding agent

Replace YOUR_API_KEY after signup, then ask the agent to run the product flow and verify the first events.

agent prompt

Security and Audit-Log Analytics setup prompt

text
Instrument security and audit-log workflows with Telemetry.

Use /skill.md and this Telemetry API key: YOUR_API_KEY

Log controlled authentication and authorization outcomes with event_id, actor_id, target_id, authentication_method, action, outcome, failure_reason, policy_version, session_id, ip_country when approved, environment, release, and timestamp_utc.

Create queries for authentication failure rate, affected identities, denied actions, policy changes, and an incident timeline. Document retention and access ownership.

Never log passwords, tokens, cookies, full IP addresses, authorization headers, recovery codes, or raw identity-provider payloads. Route suspicious behavior through the security response process rather than treating a generic product alert as an intrusion detector.

Setup steps

  1. 1Inventory authentication and privileged-action boundaries.
  2. 2Define controlled outcomes and reasons with a security owner.
  3. 3Use privacy-safe actor and target identifiers with explicit retention.
  4. 4Exercise denied, failed, successful, and suspicious paths before alerting.

Events to capture

authentication_completedauthorization_deniedprivileged_action_completedaccess_policy_changedsecurity_investigation_opened

Questions unlocked

  • Which login method has a sustained failure spike?
  • How many distinct identities are affected?
  • Which privileged actions occurred during an incident window?

Event schema starting points

Event contracts for this workflow

Review the row grain, emit boundary, required types, privacy classes, example payload, and validation checklist before adapting a query or snippet to production.

Identity security8 fields

authentication_attempt_completed

One completed authentication attempt.

Inspect contract

Related product capability

Continue this workflow in Structured events

Capture stable event names, typed fields, and privacy-reviewed operational context.

Explore Structured eventsReview customer evidence

Related SQL recipes

Answer the next question with SQL

Run the query against the structured fields from this workflow, inspect the example result, and turn a useful answer into a dashboard or alert.

Browse all recipes
Security and auditIntermediate

Analyze Authentication Failure Rate

Which authentication methods and failure reasons need investigation?

Open recipe
Security and auditAdvanced

Detect Suspicious Authentication Bursts

Which authentication windows show concentrated failure activity?

Open recipe
Security and auditBeginner

Analyze Access-Policy Denials

Which access policies deny the most actors and actions?

Open recipe
Security and auditIntermediate

Audit API-Key Lifecycle Events

Which API-key lifecycles require owner review?

Open recipe
Security and auditIntermediate

Review Sensitive Data Exports with SQL

Which sensitive export classes or actor roles require review?

Open recipe
Security and auditBeginner

Audit Privileged Actions with SQL

Which privileged actions fail or require human review most often?

Open recipe
Complete collectionsSecurity and audit SQL

Next step

Create the API key your agent will use

The free plan is enough to run the prompt, send test events, and review the first dashboard.

Prompt packStart with sample data

Related pages

AI Agent Security Monitoring

Monitor tool authorization, policy denials, approval queues, risky action classes, and release changes without storing prompts, credentials, or tool payloads.

Open page