Common event contract
Fields that keep these queries reusable
- timestamp_utc, actor_role, action, resource_type, outcome, and environment
- requires_review, policy_version, authentication_method, and controlled reason
- Restricted actor or resource identifiers only when an approved investigation requires them
Definitions before SQL
Decisions the query cannot make for you
- 1Define expected policy denials separately from suspicious failures.
- 2Keep general reporting dimensions bounded and move identifiers to restricted drill-downs.
- 3Set retention, immutability, and access rules with the security owner.
Recommended sequence
Build detection first, then diagnosis
Analysis patterns
Make the result explain a decision
Model terminal action outcomes
Record the controlled action, resource class, actor role, policy result, and review status when the privileged operation completes.
Separate reporting from evidence
Use aggregate SQL for trends and queues while preserving immutable source evidence in the system designed for that requirement.
Alert on reviewed behavior
Distinguish expected denials, accidental failures, repeated attempts, and novel action classes before creating an escalation.
Complete recipes
Copy the query, then validate the assumptions
Analyze Authentication Failure Rate
Measure authentication failures by method and reason while keeping traffic volume and affected identities visible.
Which authentication methods and failure reasons need investigation?
See SQL and resultAudit Privileged Actions with SQL
Summarize sensitive administrative actions, denied attempts, and review-required outcomes without collecting raw secrets or resource contents.
Which privileged actions fail or require human review most often?
See SQL and resultDetect Suspicious Authentication Bursts
Find short authentication windows with repeated failures across many identities or coarse network sources.
Which authentication windows show concentrated failure activity?
See SQL and resultAnalyze Access-Policy Denials
Rank denied actions by policy, resource class, actor role, and affected identities.
Which access policies deny the most actors and actions?
See SQL and resultAudit API-Key Lifecycle Events
Review creation, use, rotation, and revocation events without logging API-key material.
Which API-key lifecycles require owner review?
See SQL and resultReview Sensitive Data Exports with SQL
Summarize export volume, denied attempts, data classifications, and review status without storing exported contents.
Which sensitive export classes or actor roles require review?
See SQL and resultAdapt the event contract before the threshold
Keep the analysis pattern, but validate table names, field types, business definitions, time windows, and minimum-volume rules against your own events. Every published query is also planned and executed against an empty typed table with the pinned engine.