From 683b3dd334637078fc81d7940f75a1f8bf808af6 Mon Sep 17 00:00:00 2001 From: anthony-dgx Date: Thu, 27 Nov 2025 09:59:09 +0100 Subject: [PATCH 1/2] Add Product Analytics and global filter to Audit Trail o provide users with a quick method to filter all notable events and to ensure the reference table includes recent Product Analytics event definitions. Modifications Notable Events Query: Inserted documentation for is_notable_event:true. Reference Table: Added row for Product Analytics: Query: @evt.name:"Product Analytics" @asset.type:product_analytics @action:(enabled OR disabled OR modified) --- content/en/account_management/audit_trail/_index.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/content/en/account_management/audit_trail/_index.md b/content/en/account_management/audit_trail/_index.md index d42e412b2cc..f249eb93eba 100644 --- a/content/en/account_management/audit_trail/_index.md +++ b/content/en/account_management/audit_trail/_index.md @@ -135,7 +135,7 @@ Notable events are a subset of audit events that show potential critical configu {{< img src="account_management/audit_logs/notable_events.png" alt="The audit event facet panel showing notable events checked" style="width:30%;">}} -Events that match the following queries are marked as notable. +Events that match the following queries are marked as notable. You can also retrieve all notable events using the query is_notable_event:true. | Description of audit event | Query in audit explorer | | ------------------------------------------------------------------- | --------------------------------------------------| @@ -148,6 +148,7 @@ Events that match the following queries are marked as notable. | Creations and deletion of RUM applications | `@evt.name:"Real User Monitoring" @asset.type:real_user_monitoring_application @action:(created OR deleted)` | | Changes to Sensitive Data Scanner scanning groups | `@evt.name:"Sensitive Data Scanner" @asset.type:sensitive_data_scanner_scanning_group` | | Creation or deletion of Synthetic tests | `@evt.name:"Synthetics Monitoring" @asset.type:synthetics_test @action:(created OR deleted)` | +| Activation, deactivation, and modification of Product Analytics for applications | `@evt.name:"Product Analytics" @asset.type:product_analytics @action:(enabled OR disabled OR modified)` | ### Inspect Changes (Diff) From dd366b2640570e0505bde4d4d55d102ea7f36c16 Mon Sep 17 00:00:00 2001 From: anthony-dgx Date: Fri, 28 Nov 2025 09:31:51 +0100 Subject: [PATCH 2/2] Update content/en/account_management/audit_trail/_index.md Co-authored-by: Janine Chan <64388808+janine-c@users.noreply.github.com> --- content/en/account_management/audit_trail/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/account_management/audit_trail/_index.md b/content/en/account_management/audit_trail/_index.md index f249eb93eba..314d16adfa5 100644 --- a/content/en/account_management/audit_trail/_index.md +++ b/content/en/account_management/audit_trail/_index.md @@ -135,7 +135,7 @@ Notable events are a subset of audit events that show potential critical configu {{< img src="account_management/audit_logs/notable_events.png" alt="The audit event facet panel showing notable events checked" style="width:30%;">}} -Events that match the following queries are marked as notable. You can also retrieve all notable events using the query is_notable_event:true. +Events that match the following queries are marked as notable. You can also retrieve all notable events using the query `is_notable_event:true`. | Description of audit event | Query in audit explorer | | ------------------------------------------------------------------- | --------------------------------------------------|