Audit Log Updates (Version 1.39)

Overview

We're excited to announce significant improvements to Material Security's audit log system that will provide better visibility, enhanced security coverage, and a more intuitive experience for your compliance and security teams.

Beginning with version 1.39, these changes may require immediate updates to your Audit Log Updated event subscriptions. Review the information below for detail.

Who does this affect?

• Anyone with existing subscriptions to Audit Log Updated events

Determine if you have Audit Log Updated events

1. As a Global or Tenant Admin, click Integrations.
2. Click Event Subscriptions.
3. Subscriptions with Audit Log Updated in the event title may need to be updated as of version 1.39 (see below).

   

---

What changed?

1

New categories

We redesigned our audit log categories with a focus on clarity and user experience, consolidated from 18 to 11 intuitive, noun-centric naming conventions:

• Messages: Email interactions, searches, marking, deletion
• Files: File access, search, policy changes
• Accounts: Account management, syncing, updates
• Groups: Group management operations
• Apps: Application and integration management
• Detections: Security detection events
• Issues: Case management and workflow
• Integrations: Event subscriptions and webhooks
• Authentication/Authorization: Login, session, and auth events
• Administration: Domain enrollment, syncing, system admin
• API: API errors and generic system events

See tables below.

2

Removed fields

We removed the subcategory field entirely, and we removed the forRequestor field in favor of the newer auditLog.actor field. This change significantly decreases the payload size for webhook subscriptions.

3

Better logging coverage

We implemented architectural improvements that ensure comprehensive audit logging:

• Strict categorization: Every audit event now requires explicit categorization - no more generic logs
• Type-safe logging: New metadata-driven system prevents audit log creation errors
• Comprehensive feature auditing: Automatic checks to ensure auditing coverage

4

Improved Design

The audit log interface is now more intuitive and actionable:

• Clearer event descriptions: Human-readable audit messages that explain exactly what happened
• Better filtering: More logical category groupings make finding events easier
• Enhanced details: Richer context for configuration changes with before/after comparisons
• Consistent formatting: Standardized audit log structure across all event types

Backwards Compatibility

• Historical data: All existing audit logs remain accessible with original categorization
• Existing integrations: Existing event subscriptions or API integrations will continue to work, but deprecated actions and categories will no longer be logged. Follow the steps and tables below to update your existing integrations.

Any of your existing subscriptions that use a deprecated filter will display a warning banner:

---

What do you need to do?

In Material

Pre-requisites:

Identify all your existing Audit Log event subscriptions with potential changes:

• Any email or Slack event subscriptions, update any notification templates that reference ${auditLog.subcategory}
• Any filters that use ${auditLog.category}, ${auditLog.subcategory}, or ${auditLog.action}

Update subscriptions:

1. For any email or Slack event subscriptions, update any notification templates that reference ${auditLog.subcategory} . (This field will no longer be available beginning in version 1.38). Use the reference tables below to update accordingly.

   
2. Update any filters that use ${auditLog.category}, ${auditLog.subcategory}, or ${auditLog.action} to make sure they are not using a deprecated value.

Downstream

If you're doing your own audit log event processing, review the new set of categories and actions to ensure your downstream processors aren't relying on a category or action that is now deprecated.

---

Updated Categories

These include categories that existed before version 1.39, plus new categories we added.

Previous to New Category Mapping

Previous Category	Previous Display Name	New Category	Description
acct_interaction	Accounts (deprecated)	accounts	Account Management
challenges	Challenges	administration	Administrative Functions
domain_enrollment_change	Enrollment	administration	Administrative Functions
event_subscriptions	Event subscriptions	integrations	Integrations & Extensions
extensibility_interaction	Extensibility	integrations	Integrations & Extensions
file_interaction	Files (deprecated)	files	File Operations
file_search_interaction	File search	files	File Operations
generic_error	Generic error	api	API & Errors
message_interaction	Messages (deprecated)	messages	Message Operations
nato_case_interaction	Cases (deprecated)	issues	Issues
nato_cases	Cases	issues	Issues
risk_analytics	Risk Analytics	administration	Administrative Functions
search_interaction	Search	messages	Message Operations
session	Session	auth	Authentication & Authorization
setting_change	Settings	administration	Administrative Functions
sync	Sync	administration	Administrative Functions
trusted_entities	Trusted Entities	administration	Administrative Functions

Actions by Category (as of Version 1.39)

Accounts

Action	Display Name
account_unlock_job_created	Force unlock request created
account_unlock_job_started	Force unlock request started
account_unlock_job_done	Force unlock request completed
acct_csp_update	Account updated in cloud provider
delegates_changed	Delegates updated

Administration

Action	Display Name
account_deleted	Account deleted
account_invited	External account invited
challenge_bypass_created	Challenge bypass created
challenge_bypass_deleted	Challenge bypass deleted
challenge_bypass_updated	Challenge bypass updated
challenge_bypassed	Challenge bypassed
google_domain_enrolled	Google domain enrolled
microsoft_domain_enrolled	Microsoft domain enrolled
purgatory_server_side_routing_email_address_changed	Server side routing email address updated
resync	Resync requested
role_changed	Roles updated
settings_modified	Settings updated
trusted_entity_created	Trusted entity created
trusted_entity_deleted	Trusted entity deleted
trusted_entity_updated	Trusted entity updated

API

Action	Display Name
api_token_created	API token created
api_token_deleted	API token deleted
api_token_updated	API token updated
api_tokens_changed	API token settings updated

Authentication

Action	Display Name
api_request_attempted	API request attempted
domain_access	Domain accessed
login	Logged in
logout	Logged out

Detections

Action	Display Name
detection_created	Detection created
detection_updated	Detection updated
locker_custom_category_created	Sensitive category created
locker_custom_category_deleted	Sensitive category deleted
material_detection_matches_viewed	Material detection matches viewed

Files

Action	Display Name
file_content_viewed	File content viewed
file_labels_updated	File labels updated
file_list_viewed	File list viewed
file_permissions_revoked	File permissions revoked
file_permissions_updated	File permissions updated
file_search_performed	File search performed

Integrations

Action	Display Name
create_integration	Integration created
delete_integration	Integration deleted
event_subscription_created	Event subscription created
event_subscription_deleted	Event subscription deleted
event_subscription_edited	Event subscription updated
update_integration_metadata	Integration metadata updated
update_integration_secret	Integration secret updated

Issues

Action	Display Name
case_cleared	Case cleared
cases_merged	Cases merged
case_shared	Case shared with Material
case_updated	Case updated
case_viewed	Case viewed
custom_view_created	View created
custom_view_deleted	View deleted
custom_view_updated	View updated
issue_updated	Issue updated
issue_viewed	Issue viewed

Messages

Action	Display Name
message_attachment_details_viewed	Message attachment details viewed
message_attachment_downloaded	Message attachment downloaded
message_deleted	Message deleted
message_downloaded	Message downloaded
message_list_viewed	Message list viewed
message_search_performed	Message search performed (legacy)
message_shared	Message shared with Material
message_viewed	Message viewed
mql_message_search_performed	Message search performed
safe_mark_changed	Safe mark updated
sensitive_mark_changed	Sensitive mark updated
similarity_matching_changed	Similarity matching updated
suspicious_mark_changed	Suspicious mark updated

Deprecated Actions (64 total)

Action	Display Name	Category	Replacement/Notes
acct_settings_modified	Account updated in cloud provider (deprecated)	accounts	Use acct_csp_update (Account updated in cloud provider)
account_connection_changed	Account connection toggled	administration	Use settings_modified (Settings updated)
admin_console_session_length_changed	Session lifespan changed	administration	Use settings_modified (Settings updated)
case_analysis_auto_action_enabled_changed	Material Case Analysis Automatic Actions setting changed	administration	Use settings_modified (Settings updated)
case_analysis_enabled_changed	Material Case Analysis setting changed	administration	Use settings_modified (Settings updated)
custom_end_user_footer_edited	Edited custom end-user support footer	administration	Use settings_modified (Settings updated)
custom_end_user_support_email_edited	Edited end-user support email	administration	Use settings_modified (Settings updated)
custom_logo_edited	Edited organizational logo	administration	Use settings_modified (Settings updated)
custom_owa_url_edited	Edited OWA url	administration	Use settings_modified (Settings updated)
custom_team_name_edited	Edited organizational team name	administration	Use settings_modified (Settings updated)
email_platform_alert_ingestion_changed	Email platform alert ingestion toggled	administration	Deprecated admin-facing setting
end_user_verification_allow_mobile_auth_changed	End user verification allow mobile auth changed	administration	Use settings_modified (Settings updated)
end_user_verification_identify_provider_changed	End user verification identify provider changed	administration	Use settings_modified (Settings updated)
locker_built_in_categories_settings_changed	Built-in categories settings changed	administration	Use settings_modified (Settings updated)
locker_changed	Email Redaction toggled	administration	Use settings_modified (Settings updated)
locker_custom_categories_settings_changed	Custom categories settings changed	administration	Use settings_modified (Settings updated)
locker_locking_grace_period_changed	Locking grace period changed	administration	Use settings_modified (Settings updated)
locker_msip_changed	Microsoft information protection toggled	administration	Use settings_modified (Settings updated)
locker_retrieval_grace_period_changed	Retrieval grace period changed	administration	Use settings_modified (Settings updated)
locker_third_party_categories_settings_changed	Third party categories settings changed	administration	Use settings_modified (Settings updated)
mailbox_mirroring_changed	Mailbox mirroring changed	administration	Use settings_modified (Settings updated)
mailbox_syncing_changed	Mailbox syncing toggled	administration	Use settings_modified (Settings updated)
mailbox_syncing_historical_limit_changed	Mailbox syncing historical limit changed	administration	Deprecated admin-facing setting
nato_auto_review_cases_changed	Auto review cases changed	administration	Deprecated admin-facing setting
nato_built_in_detection_auto_case_creation_changed	Built-in detection auto case creation changed	administration	Deprecated admin-facing setting
nato_changed	Email Threats toggled	administration	Use settings_modified (Settings updated)
nato_csp_reports_remediation_changed	Csp reports remediation changed	administration	Use settings_modified (Settings updated)
nato_custom_detection_auto_case_creation_changed	Custom detection auto case creation changed	administration	Use settings_modified (Settings updated)
nato_default_remediation_changed	Default remediation changed	administration	Use settings_modified (Settings updated)
nato_exempt_address_patterns_changed	Exempt address patterns changed	administration	Use settings_modified (Settings updated)
nato_exempt_ip_address_patterns_changed	Trusted IP address changed	administration	Use settings_modified (Settings updated)
nato_google_workspace_alert_center_changed	Google workspace alert center changed	administration	Use settings_modified (Settings updated)
nato_material_detections_changed	Material Detections settings changed	administration	Use settings_modified (Settings updated)
nato_reporter_acknowledgements_changed	Reporter acknowledgements changed	administration	Use settings_modified (Settings updated)
nato_reporting_threshold_changed	Reporting threshold changed	administration	Use settings_modified (Settings updated)
nato_user_reporting_email_address_changed	User reporting email address changed	administration	Use settings_modified (Settings updated)
nato_user_reporting_email_provider_ui_changed	User reporting email provider ui changed	administration	Use settings_modified (Settings updated)
nato_user_reporting_intermediary_email_address_changed	User reporting intermediary email address changed	administration	Use settings_modified (Settings updated)
nato_user_reporting_label_changed	User reporting label changed	administration	Use settings_modified (Settings updated)
nato_user_reports_remediation_changed	User reports remediation changed	administration	Use settings_modified (Settings updated)
nato_user_report_auto_triage_enabled_changed	User report auto triage setting updated	administration	Use settings_modified (Settings updated)
nato_user_report_auto_triage_classification_remediation_changed	User report auto triage remediation updated	administration	Use settings_modified (Settings updated)
nato_similarity_matching_changed	Similarity matching settings updated	administration	Use settings_modified (Settings updated)
open_webauthn_enrollment	WebAuthn enrollment opened	administration	Deprecated admin-facing setting
openai_datashare_consent_changed	Material setting changed	administration	Deprecated admin-facing setting
purgatory_changed	Identity Protection toggled	administration	Use settings_modified (Settings updated)
purgatory_services_settings_changed	Services settings changed	administration	Use settings_modified (Settings updated)
saml_allow_sso_changed	SAML: Allow SSO toggled	administration	Use settings_modified (Settings updated)
saml_enforce_login_changed	SAML: Enforce login toggled	administration	Use settings_modified (Settings updated)
disable_google_auto_forwarding	Disabled Google auto-forwarding	administration	Deprecated risk report
disable_microsoft_auto_forwarding	Disabled Microsoft auto-forwarding	administration	Deprecated risk report
snooze_report_changed	Snoozed report	administration	Deprecated risk report
snooze_report_item_changed	Hide row	administration	Deprecated risk report
file_policy_created	File detection created	files	Use detection actions instead
file_policy_deleted	File detection deleted	files	Use detection actions instead
file_policy_updated	File detection updated	files	Use detection actions instead
file_drive_syncing_setting_updated	Google Drive Connection updated	administration	Use settings_modified (Settings updated)
file_shared_drive_syncing_setting_updated	Google Drive Shared Drive Syncing updated	administration	Use settings_modified (Settings updated)
file_my_drive_syncing_setting_updated	Google Drive My Drive Syncing updated	administration	Use settings_modified (Settings updated)
file_my_drive_remediation_setting_updated	Google Drive My Drive Remediation updated	administration	Use settings_modified (Settings updated)
file_shared_drive_remediation_setting_updated	Google Drive Shared Drive Remediation updated	administration	Use settings_modified (Settings updated)
nato_custom_category_created	Custom suspicious category created	detections	Use detection actions instead
nato_custom_category_deleted	Custom suspicious category deleted	detections	Use detection actions instead
search_performed	Search performed	messages	Use message_search_performed (Message search performed (legacy) or mql_message_search_performed (Message search performed)