> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/learn-more/administration/audit-log/audit-log-updates-version-1.39.md).

# Audit Log Updates (Version 1.39)

{% @arcade/embed url="<https://app.arcade.software/share/cAHGRZwksT0tjgXfN2j2>" flowId="cAHGRZwksT0tjgXfN2j2" %}

## Overview

We're excited to announce significant improvements to Material Security's audit log system that will provide better visibility, enhanced security coverage, and a more intuitive experience for your compliance and security teams.

{% hint style="warning" %}
Beginning with version 1.39, these changes may require immediate updates to your Audit Log Updated event subscriptions. Review the information below for detail.
{% endhint %}

### Who does this affect?

* Anyone with existing subscriptions to Audit Log Updated events

<details>

<summary>Determine if you have Audit Log Updated events</summary>

1. As a Global or Tenant Admin, click **Integrations**. <img src="/files/HgvxuM6KQOr9ch6HogPv" alt="" data-size="line">
2. Click **Event Subscriptions**.
3. Subscriptions with **Audit Log Updated** in the event title may need to be updated as of version 1.39 (see below).

   <figure><img src="/files/2UBVdIyNuaHhPFc7yers" alt=""><figcaption></figcaption></figure>

</details>

***

## What changed?

{% stepper %}
{% step %}
**New categories**

We redesigned our audit log categories with a focus on clarity and user experience, consolidated from 18 to 11 intuitive, noun-centric naming conventions:

* **Messages:** Email interactions, searches, marking, deletion
* **Files:** File access, search, policy changes
* **Accounts:** Account management, syncing, updates
* **Groups:** Group management operations
* **Apps:** Application and integration management
* **Detections:** Security detection events
* **Issues:** Case management and workflow
* **Integrations:** Event subscriptions and webhooks
* **Authentication/Authorization:** Login, session, and auth events
* **Administration:** Domain enrollment, syncing, system admin
* **API:** API errors and generic system events

[See tables below.](#updated-categories)
{% endstep %}

{% step %}
**Removed fields**

We removed the `subcategory` field entirely, and we removed the `forRequestor` field in favor of the newer `auditLog.actor` field. This change significantly decreases the payload size for webhook subscriptions.
{% endstep %}

{% step %}
**Better logging coverage**

We implemented architectural improvements that ensure comprehensive audit logging:

* **Strict categorization**: Every audit event now requires explicit categorization - no more generic logs
* **Type-safe logging**: New metadata-driven system prevents audit log creation errors
* **Comprehensive feature auditing**: Automatic checks to ensure auditing coverage
  {% endstep %}

{% step %}
**Improved Design**

The audit log interface is now more intuitive and actionable:

* **Clearer event descriptions**: Human-readable audit messages that explain exactly what happened
* **Better filtering**: More logical category groupings make finding events easier
* **Enhanced details**: Richer context for configuration changes with before/after comparisons
* **Consistent formatting**: Standardized audit log structure across all event types
  {% endstep %}
  {% endstepper %}

{% hint style="warning" %}
**Backwards Compatibility**

* **Historical data**: All existing audit logs remain accessible with original categorization
* **Existing integrations**: Existing event subscriptions or API integrations will continue to work, but deprecated actions and categories will no longer be logged. Follow the steps and tables below to update your existing integrations.
  {% endhint %}

Any of your existing subscriptions that use a deprecated filter will display a warning banner:

<figure><img src="/files/3uLU1S9IPF4wlQjIhbN1" alt=""><figcaption></figcaption></figure>

***

## What do you need to do?

### In Material

**Pre-requisites:**

Identify all your existing Audit Log event subscriptions with potential changes:

* Any email or Slack event subscriptions, update any notification templates that reference `${auditLog.subcategory}`
* Any filters that use `${auditLog.category}`, `${auditLog.subcategory}`, or `${auditLog.action}`

**Update subscriptions**:

1. For any email or Slack event subscriptions, update any notification templates that reference `${auditLog.subcategory}` . (This field will no longer be available beginning in version 1.38). Use the [reference tables](#updated-categories) below to update accordingly.

   <figure><img src="/files/muuQJ1dhBdgLxtabGICK" alt=""><figcaption></figcaption></figure>
2. Update any filters that use `${auditLog.category}`, `${auditLog.subcategory}`, or `${auditLog.action}` to make sure they are not using a deprecated value.

### Downstream

If you're doing your own audit log event processing, review the new set of categories and actions to ensure your downstream processors aren't relying on a category or action that is now deprecated.

***

## Updated Categories

These include categories that existed before version 1.39, plus new categories we added.

### Previous to New Category Mapping

<table data-full-width="true"><thead><tr><th width="236.578125">Previous Category</th><th>Previous Display Name</th><th>New Category</th><th>Description</th></tr></thead><tbody><tr><td><code>acct_interaction</code></td><td>Accounts (deprecated)</td><td><code>accounts</code></td><td>Account Management</td></tr><tr><td><code>challenges</code></td><td>Challenges</td><td><code>administration</code></td><td>Administrative Functions</td></tr><tr><td><code>domain_enrollment_change</code></td><td>Enrollment</td><td><code>administration</code></td><td>Administrative Functions</td></tr><tr><td><code>event_subscriptions</code></td><td>Event subscriptions</td><td><code>integrations</code></td><td>Integrations &#x26; Extensions</td></tr><tr><td><code>extensibility_interaction</code></td><td>Extensibility</td><td><code>integrations</code></td><td>Integrations &#x26; Extensions</td></tr><tr><td><code>file_interaction</code></td><td>Files (deprecated)</td><td><code>files</code></td><td>File Operations</td></tr><tr><td><code>file_search_interaction</code></td><td>File search</td><td><code>files</code></td><td>File Operations</td></tr><tr><td><code>generic_error</code></td><td>Generic error</td><td><code>api</code></td><td>API &#x26; Errors</td></tr><tr><td><code>message_interaction</code></td><td>Messages (deprecated)</td><td><code>messages</code></td><td>Message Operations</td></tr><tr><td><code>nato_case_interaction</code></td><td>Cases (deprecated)</td><td><code>issues</code></td><td>Issues</td></tr><tr><td><code>nato_cases</code></td><td>Cases</td><td><code>issues</code></td><td>Issues</td></tr><tr><td><code>risk_analytics</code></td><td>Risk Analytics</td><td><code>administration</code></td><td>Administrative Functions</td></tr><tr><td><code>search_interaction</code></td><td>Search</td><td><code>messages</code></td><td>Message Operations</td></tr><tr><td><code>session</code></td><td>Session</td><td><code>auth</code></td><td>Authentication &#x26; Authorization</td></tr><tr><td><code>setting_change</code></td><td>Settings</td><td><code>administration</code></td><td>Administrative Functions</td></tr><tr><td><code>sync</code></td><td>Sync</td><td><code>administration</code></td><td>Administrative Functions</td></tr><tr><td><code>trusted_entities</code></td><td>Trusted Entities</td><td><code>administration</code></td><td>Administrative Functions</td></tr></tbody></table>

### Actions by Category (as of Version 1.39)

<details>

<summary>Accounts</summary>

| Action                       | Display Name                      |
| ---------------------------- | --------------------------------- |
| `account_unlock_job_created` | Force unlock request created      |
| `account_unlock_job_started` | Force unlock request started      |
| `account_unlock_job_done`    | Force unlock request completed    |
| `acct_csp_update`            | Account updated in cloud provider |
| `delegates_changed`          | Delegates updated                 |

</details>

<details>

<summary>Administration</summary>

| Action                                                | Display Name                              |
| ----------------------------------------------------- | ----------------------------------------- |
| `account_deleted`                                     | Account deleted                           |
| `account_invited`                                     | External account invited                  |
| `challenge_bypass_created`                            | Challenge bypass created                  |
| `challenge_bypass_deleted`                            | Challenge bypass deleted                  |
| `challenge_bypass_updated`                            | Challenge bypass updated                  |
| `challenge_bypassed`                                  | Challenge bypassed                        |
| `google_domain_enrolled`                              | Google domain enrolled                    |
| `microsoft_domain_enrolled`                           | Microsoft domain enrolled                 |
| `purgatory_server_side_routing_email_address_changed` | Server side routing email address updated |
| `resync`                                              | Resync requested                          |
| `role_changed`                                        | Roles updated                             |
| `settings_modified`                                   | Settings updated                          |
| `trusted_entity_created`                              | Trusted entity created                    |
| `trusted_entity_deleted`                              | Trusted entity deleted                    |
| `trusted_entity_updated`                              | Trusted entity updated                    |

</details>

<details>

<summary>API</summary>

| Action               | Display Name               |
| -------------------- | -------------------------- |
| `api_token_created`  | API token created          |
| `api_token_deleted`  | API token deleted          |
| `api_token_updated`  | API token updated          |
| `api_tokens_changed` | API token settings updated |

</details>

<details>

<summary>Authentication</summary>

| Action                  | Display Name          |
| ----------------------- | --------------------- |
| `api_request_attempted` | API request attempted |
| `domain_access`         | Domain accessed       |
| `login`                 | Logged in             |
| `logout`                | Logged out            |

</details>

<details>

<summary>Detections</summary>

| Action                              | Display Name                      |
| ----------------------------------- | --------------------------------- |
| `detection_created`                 | Detection created                 |
| `detection_updated`                 | Detection updated                 |
| `locker_custom_category_created`    | Sensitive category created        |
| `locker_custom_category_deleted`    | Sensitive category deleted        |
| `material_detection_matches_viewed` | Material detection matches viewed |

</details>

<details>

<summary>Files</summary>

| Action                     | Display Name             |
| -------------------------- | ------------------------ |
| `file_content_viewed`      | File content viewed      |
| `file_labels_updated`      | File labels updated      |
| `file_list_viewed`         | File list viewed         |
| `file_permissions_revoked` | File permissions revoked |
| `file_permissions_updated` | File permissions updated |
| `file_search_performed`    | File search performed    |

</details>

<details>

<summary>Integrations</summary>

| Action                        | Display Name                 |
| ----------------------------- | ---------------------------- |
| `create_integration`          | Integration created          |
| `delete_integration`          | Integration deleted          |
| `event_subscription_created`  | Event subscription created   |
| `event_subscription_deleted`  | Event subscription deleted   |
| `event_subscription_edited`   | Event subscription updated   |
| `update_integration_metadata` | Integration metadata updated |
| `update_integration_secret`   | Integration secret updated   |

</details>

<details>

<summary>Issues</summary>

| Action                | Display Name              |
| --------------------- | ------------------------- |
| `case_cleared`        | Case cleared              |
| `cases_merged`        | Cases merged              |
| `case_shared`         | Case shared with Material |
| `case_updated`        | Case updated              |
| `case_viewed`         | Case viewed               |
| `custom_view_created` | View created              |
| `custom_view_deleted` | View deleted              |
| `custom_view_updated` | View updated              |
| `issue_updated`       | Issue updated             |
| `issue_viewed`        | Issue viewed              |

</details>

<details>

<summary>Messages</summary>

| Action                              | Display Name                      |
| ----------------------------------- | --------------------------------- |
| `message_attachment_details_viewed` | Message attachment details viewed |
| `message_attachment_downloaded`     | Message attachment downloaded     |
| `message_deleted`                   | Message deleted                   |
| `message_downloaded`                | Message downloaded                |
| `message_list_viewed`               | Message list viewed               |
| `message_search_performed`          | Message search performed (legacy) |
| `message_shared`                    | Message shared with Material      |
| `message_viewed`                    | Message viewed                    |
| `mql_message_search_performed`      | Message search performed          |
| `safe_mark_changed`                 | Safe mark updated                 |
| `sensitive_mark_changed`            | Sensitive mark updated            |
| `similarity_matching_changed`       | Similarity matching updated       |
| `suspicious_mark_changed`           | Suspicious mark updated           |

</details>

### Deprecated Actions (64 total)

<table data-full-width="true"><thead><tr><th width="369.2109375">Action</th><th width="435.91796875">Display Name</th><th>Category</th><th>Replacement/Notes</th></tr></thead><tbody><tr><td><code>acct_settings_modified</code></td><td>Account updated in cloud provider (deprecated)</td><td>accounts</td><td>Use <code>acct_csp_update</code> (Account updated in cloud provider)</td></tr><tr><td><code>account_connection_changed</code></td><td>Account connection toggled</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>admin_console_session_length_changed</code></td><td>Session lifespan changed</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>case_analysis_auto_action_enabled_changed</code></td><td>Material Case Analysis Automatic Actions setting changed</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>case_analysis_enabled_changed</code></td><td>Material Case Analysis setting changed</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>custom_end_user_footer_edited</code></td><td>Edited custom end-user support footer</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>custom_end_user_support_email_edited</code></td><td>Edited end-user support email</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>custom_logo_edited</code></td><td>Edited organizational logo</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>custom_owa_url_edited</code></td><td>Edited OWA url</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>custom_team_name_edited</code></td><td>Edited organizational team name</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>email_platform_alert_ingestion_changed</code></td><td>Email platform alert ingestion toggled</td><td>administration</td><td>Deprecated admin-facing setting</td></tr><tr><td><code>end_user_verification_allow_mobile_auth_changed</code></td><td>End user verification allow mobile auth changed</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>end_user_verification_identify_provider_changed</code></td><td>End user verification identify provider changed</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>locker_built_in_categories_settings_changed</code></td><td>Built-in categories settings changed</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>locker_changed</code></td><td>Email Redaction toggled</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>locker_custom_categories_settings_changed</code></td><td>Custom categories settings changed</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>locker_locking_grace_period_changed</code></td><td>Locking grace period changed</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>locker_msip_changed</code></td><td>Microsoft information protection toggled</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>locker_retrieval_grace_period_changed</code></td><td>Retrieval grace period changed</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>locker_third_party_categories_settings_changed</code></td><td>Third party categories settings changed</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>mailbox_mirroring_changed</code></td><td>Mailbox mirroring changed</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>mailbox_syncing_changed</code></td><td>Mailbox syncing toggled</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>mailbox_syncing_historical_limit_changed</code></td><td>Mailbox syncing historical limit changed</td><td>administration</td><td>Deprecated admin-facing setting</td></tr><tr><td><code>nato_auto_review_cases_changed</code></td><td>Auto review cases changed</td><td>administration</td><td>Deprecated admin-facing setting</td></tr><tr><td><code>nato_built_in_detection_auto_case_creation_changed</code></td><td>Built-in detection auto case creation changed</td><td>administration</td><td>Deprecated admin-facing setting</td></tr><tr><td><code>nato_changed</code></td><td>Email Threats toggled</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>nato_csp_reports_remediation_changed</code></td><td>Csp reports remediation changed</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>nato_custom_detection_auto_case_creation_changed</code></td><td>Custom detection auto case creation changed</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>nato_default_remediation_changed</code></td><td>Default remediation changed</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>nato_exempt_address_patterns_changed</code></td><td>Exempt address patterns changed</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>nato_exempt_ip_address_patterns_changed</code></td><td>Trusted IP address changed</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>nato_google_workspace_alert_center_changed</code></td><td>Google workspace alert center changed</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>nato_material_detections_changed</code></td><td>Material Detections settings changed</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>nato_reporter_acknowledgements_changed</code></td><td>Reporter acknowledgements changed</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>nato_reporting_threshold_changed</code></td><td>Reporting threshold changed</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>nato_user_reporting_email_address_changed</code></td><td>User reporting email address changed</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>nato_user_reporting_email_provider_ui_changed</code></td><td>User reporting email provider ui changed</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>nato_user_reporting_intermediary_email_address_changed</code></td><td>User reporting intermediary email address changed</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>nato_user_reporting_label_changed</code></td><td>User reporting label changed</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>nato_user_reports_remediation_changed</code></td><td>User reports remediation changed</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>nato_user_report_auto_triage_enabled_changed</code></td><td>User report auto triage setting updated</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>nato_user_report_auto_triage_classification_remediation_changed</code></td><td>User report auto triage remediation updated</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>nato_similarity_matching_changed</code></td><td>Similarity matching settings updated</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>open_webauthn_enrollment</code></td><td>WebAuthn enrollment opened</td><td>administration</td><td>Deprecated admin-facing setting</td></tr><tr><td><code>openai_datashare_consent_changed</code></td><td>Material setting changed</td><td>administration</td><td>Deprecated admin-facing setting</td></tr><tr><td><code>purgatory_changed</code></td><td>Identity Protection toggled</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>purgatory_services_settings_changed</code></td><td>Services settings changed</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>saml_allow_sso_changed</code></td><td>SAML: Allow SSO toggled</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>saml_enforce_login_changed</code></td><td>SAML: Enforce login toggled</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>disable_google_auto_forwarding</code></td><td>Disabled Google auto-forwarding</td><td>administration</td><td>Deprecated risk report</td></tr><tr><td><code>disable_microsoft_auto_forwarding</code></td><td>Disabled Microsoft auto-forwarding</td><td>administration</td><td>Deprecated risk report</td></tr><tr><td><code>snooze_report_changed</code></td><td>Snoozed report</td><td>administration</td><td>Deprecated risk report</td></tr><tr><td><code>snooze_report_item_changed</code></td><td>Hide row</td><td>administration</td><td>Deprecated risk report</td></tr><tr><td><code>file_policy_created</code></td><td>File detection created</td><td>files</td><td>Use <code>detection</code> actions instead</td></tr><tr><td><code>file_policy_deleted</code></td><td>File detection deleted</td><td>files</td><td>Use <code>detection</code> actions instead</td></tr><tr><td><code>file_policy_updated</code></td><td>File detection updated</td><td>files</td><td>Use <code>detection</code> actions instead</td></tr><tr><td><code>file_drive_syncing_setting_updated</code></td><td>Google Drive Connection updated</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>file_shared_drive_syncing_setting_updated</code></td><td>Google Drive Shared Drive Syncing updated</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>file_my_drive_syncing_setting_updated</code></td><td>Google Drive My Drive Syncing updated</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>file_my_drive_remediation_setting_updated</code></td><td>Google Drive My Drive Remediation updated</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>file_shared_drive_remediation_setting_updated</code></td><td>Google Drive Shared Drive Remediation updated</td><td>administration</td><td>Use <code>settings_modified</code> (Settings updated)</td></tr><tr><td><code>nato_custom_category_created</code></td><td>Custom suspicious category created</td><td>detections</td><td>Use <code>detection</code> actions instead</td></tr><tr><td><code>nato_custom_category_deleted</code></td><td>Custom suspicious category deleted</td><td>detections</td><td>Use <code>detection</code> actions instead</td></tr><tr><td><code>search_performed</code></td><td>Search performed</td><td>messages</td><td>Use message_search_performed (Message search performed (legacy) or <code>mql_message_search_performed</code> (Message search performed)</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.material.security/learn-more/administration/audit-log/audit-log-updates-version-1.39.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.