Telemetry
For teams investigating authentication and privileged actions

Security and Audit-Log Analytics

Design privacy-aware security events for authentication failures, access changes, privileged actions, and incident timelines.

Reviewed by the Telemetry product team on . Event contract, recommended analysis, and privacy boundaries. Editorial ownership

Get an API keyCopy the prompt
Why this works
  • Measure failure rate and blast radius without collecting credentials.
  • Preserve actor, target, reason, and authorization outcome as controlled fields.
  • Build reproducible incident timelines from append-only audit events.

Agent prompt

Paste this into your coding agent

Replace YOUR_API_KEY after signup, then ask the agent to run the product flow and verify the first events.

agent prompt

Security and Audit-Log Analytics setup prompt

text
Instrument security and audit-log workflows with Telemetry.

Use /skill.md and this Telemetry API key: YOUR_API_KEY

Log controlled authentication and authorization outcomes with event_id, actor_id, target_id, authentication_method, action, outcome, failure_reason, policy_version, session_id, ip_country when approved, environment, release, and timestamp_utc.

Create queries for authentication failure rate, affected identities, denied actions, policy changes, and an incident timeline. Document retention and access ownership.

Never log passwords, tokens, cookies, full IP addresses, authorization headers, recovery codes, or raw identity-provider payloads. Route suspicious behavior through the security response process rather than treating a generic product alert as an intrusion detector.

Setup steps

  1. 1Inventory authentication and privileged-action boundaries.
  2. 2Define controlled outcomes and reasons with a security owner.
  3. 3Use privacy-safe actor and target identifiers with explicit retention.
  4. 4Exercise denied, failed, successful, and suspicious paths before alerting.

Events to capture

authentication_completedauthorization_deniedprivileged_action_completedaccess_policy_changedsecurity_investigation_opened

Questions unlocked

  • Which login method has a sustained failure spike?
  • How many distinct identities are affected?
  • Which privileged actions occurred during an incident window?

Related SQL recipes

Answer the next question with SQL

Run the query against the structured fields from this workflow, inspect the example result, and turn a useful answer into a dashboard or alert.

Browse all recipes
Structured eventsIntermediate

Analyze Authentication Failure Rate

Which authentication methods and failure reasons need investigation?

Open recipe
API reliabilityBeginner

Rank Error Fingerprints by Customer Impact

Which error groups affect the most customer accounts?

Open recipe
API reliabilityIntermediate

Compare API Reliability by Release

Which releases coincide with worse API errors or tail latency?

Open recipe
Structured eventsAdvanced

Detect Error-Rate Spikes With a Rolling Baseline

Which hourly error-rate buckets are far above their recent baseline?

Open recipe

Next step

Create the API key your agent will use

The free plan is enough to run the prompt, send test events, and review the first dashboard.

Prompt packStart free

Related pages

Claude Code Observability

Give Claude Code a prompt that makes telemetry part of the implementation pass instead of a separate cleanup project.

Open page

Cursor Telemetry Setup

A copyable setup prompt for adding event tables, funnel tracking, and dashboards from inside Cursor.

Open page

Codex Instrumentation Prompt

A focused prompt that asks Codex to instrument the rest of the product, verify events, and summarize coverage gaps.

Open page