> This page is for Platform Management. > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.moveworks.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.moveworks.com/_mcp/server. # Security Information and Event Management (SIEM) Logs Overview Moveworks provides a JSON-based SIEM log export (via SFTP) that captures API calls, authentication events, permission changes, config changes, and other platform activities. These logs can be ingested into any organizational SIEM, data lake, or analytics pipeline to support incident response, monitoring, and compliance workflows. Customers can export these logs from SFTP into their internal storage systems or forward them using a SIEM/log forwarder. --- # 📂 File Structure & Delivery Cadence ## Directory Layout Logs are delivered to a versioned subdirectory (`v1`) within your SFTP bucket: ``` logs/v1/YYYY-MM-DD/YYYY-MM-DD_audit_log.json ``` Example: `logs/v1/2024-08-20/2024-08-20_audit_log.json` Files are delivered under the `v1` subdirectory, which denotes the delivery pipeline version. This is separate from the `version` field inside each log entry, which is the log **schema** version (currently `"2"`). ## Refresh Frequency Each day's log file is updated **every 3 hours** — new activity is appended to that day's existing file; a new file is not created for each refresh. All date folders and `event_time` timestamps are in **UTC**. --- # 🧩 Log Schema All logs use a consistent, well-defined structure. Each supported log type has a documented schema so parsing and integration with your SIEM solution is reliable. ## Top-Level Fields Every log includes the following fields: | Field | Description | | ---------------- | ---------------------------------------------------------------------------------------------- | | **version** | Schema version number (currently `"2"`). | | **severity** | Event severity (e.g., `INFO`, `ERROR`). | | **event_id** | Unique identifier for the event. | | **event_type** | Category of event (e.g., `EXTERNAL_API`). | | **event_source** | Always `MOVEWORKS`. | | **event_time** | Time when the event occurred (`YYYY-MM-DD HH:MM:SS.ffffff`). | | **event_data** | Key–value metadata specific to the event type. Sensitive request/response bodies are excluded. | The fields inside `event_data` differ by `event_type` — see the examples below for the fields included with each type. ## Supported Log Types * `EXTERNAL_API` * `EXTERNAL_LDAP_API` * `CONFIG_CHANGE` * `PERMISSION_CHANGE` * `AUTHENTICATION` * `AGENT_STUDIO_LOG` * `USER_TOKEN_LOG` --- # 📄 Example Logs Example payloads for each supported log type are shown below. ### EXTERNAL_API Outbound API calls Moveworks makes to external/integrated systems, including the request URI and method, response status, and timing. ```json { "version": "2", "severity": "INFO", "event_id": "Que5vMmYkJuB", "event_type": "EXTERNAL_API", "event_source": "MOVEWORKS", "event_time": "2025-10-16 19:00:23.850992", "event_data": { "user_id": "9422067216216842966", "request_uri": "https://slack.com/api/chat.postMessage", "request_method": "POST", "response_status_code": "200", "execution_time_ms": 172, "response_size_bytes": 1194 } } ``` ### EXTERNAL_LDAP_API LDAP queries Moveworks issues against your directory (for example, user lookups), including the search request that was run. ```json { "version": "2", "severity": "INFO", "event_id": "7UUWTmuqR1-I", "event_type": "EXTERNAL_LDAP_API", "event_source": "MOVEWORKS", "event_time": "2025-07-25 23:08:06.715425", "event_data": { "user_id": "12608431283658477771", "request": "{'search_request': {'base_dn': '{{dc_base_filter}}', 'scope': 2, 'filter': '(&(objectClass=user)(mail=coryweb*))'}}" } } ``` ### CONFIG_CHANGE Changes to Moveworks configuration, capturing which config was changed, its version, the origin of the change, the operation type, and the specific fields updated. The `operation_type` field distinguishes configuration updates from deletions: | Value | Description | | ------------------------------ | ------------------------------------- | | `CONFIG_OPERATION_TYPE_UPDATE` | Configuration was modified or updated | | `CONFIG_OPERATION_TYPE_DELETE` | Configuration was removed or deleted | #### Configuration update ```json { "version": "2", "severity": "INFO", "event_id": "hLOXixn7T1iW", "event_type": "CONFIG_CHANGE", "event_source": "MOVEWORKS", "event_time": "2026-01-06 03:49:38.763026", "event_data": { "user_id": "412307323227731938", "config_version": 3, "config_name": "ScriptConfig", "change_origin_type": "CONFIG_SOURCE_USER", "operation_type": "CONFIG_OPERATION_TYPE_UPDATE", "updated_configs": [ { "op": "update", "path": "root['code']" } ] } } ``` #### Configuration deletion ```json { "version": "2", "severity": "INFO", "event_id": "mN8PqX2wR5tZ", "event_type": "CONFIG_CHANGE", "event_source": "MOVEWORKS", "event_time": "2026-01-06 04:15:22.891037", "event_data": { "user_id": "412307323227731938", "config_version": 4, "config_name": "NotificationOrgConfig", "change_origin_type": "CONFIG_SOURCE_USER", "operation_type": "CONFIG_OPERATION_TYPE_DELETE", "updated_configs": [ { "op": "remove", "path": "root['notification_noise_control_config']" } ] } } ``` ### PERMISSION_CHANGE Changes to user role and permission assignments across Moveworks apps, including the roles assigned or revoked and the user's resulting full role set. ```json { "version": "2", "severity": "INFO", "event_id": "LU8QgcnSTQ2m", "event_type": "PERMISSION_CHANGE", "event_source": "MOVEWORKS", "event_time": "2025-07-29 15:53:42.047730", "event_data": { "user_id": "16054822774505271985", "assigned_roles": [ { "app": "APP_CREATOR_STUDIO", "roles": ["ROLE_CREST_ADMIN"], "grantee": "3743745632043933493" } ], "all_roles": [ { "app": "APP_CREATOR_STUDIO", "roles": ["ROLE_CREST_ADMIN"], "grantee": "3743745632043933493" }, { "app": "APP_BOT_ANALYTICS", "roles": ["ROLE_BOT_ANALYTICS_ADMIN"], "grantee": "3743745632043933493" }, { "app": "APP_MW_SETUP", "roles": ["ROLE_MW_SETUP_ADMIN"], "grantee": "3743745632043933493" } ] } } ``` ### AUTHENTICATION Authentication events such as logins (success or failure), including the app, source IP, and user agent. ```json { "version": "2", "severity": "INFO", "event_id": "OqsC6ItzTL6f", "event_type": "AUTHENTICATION", "event_source": "MOVEWORKS", "event_time": "2025-10-15 15:38:31.883000", "event_data": { "user_id": "9733382206290329491", "authn_event_type": "AUTHN_EVENT_LOGIN_SUCCESS", "app": "AUTHN_APP_MY_MOVEWORKS", "idp_metadata": {}, "source_ip": "208.127.82.164", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" } } ``` ### AGENT_STUDIO_LOG Actions taken in Tool Studio, including the method invoked, the result, and the object or log type that was acted on. ```json { "version": "2", "severity": "INFO", "event_id": "SorjFyTNZnDK", "event_type": "AGENT_STUDIO_LOG", "event_source": "MOVEWORKS", "event_time": "2025-10-16 19:44:59.325022", "event_data": { "user_id": "10769617033889969982", "uivar_uuid": "5d6edaaa-fe72-4ef1-8c3f-875c5f634726", "result": "AGENT_STUDIO_LOG_RESULT_SUCCESS", "method": "AGENT_STUDIO_LOG_METHOD_READ", "log_type": "AGENT_STUDIO_LOG_TYPE_AGENT_STUDIO_CONNECTORS" } } ``` ### USER_TOKEN_LOG User-token operations, such as retrieving an access token for a connected integration, with sanitized token information. ```json { "version": "2", "severity": "INFO", "event_id": "HFm8ZebzGHdu", "event_type": "USER_TOKEN_LOG", "event_source": "MOVEWORKS", "event_time": "2025-10-16 19:44:59.325022", "event_data": { "user_id": "8340006963328694015", "status": "USER_TOKEN_EXECUTION_STATUS_SUCCESS", "retrieve_access_token_log": { "integration_id": "enterprise_search_google_drive_connector", "sanitized_access_token_info": { "integration_id": "enterprise_search_google_drive_connector", "expires_at": "2025-10-16T19:58:13.331639Z" } } } } ``` --- # ❓ FAQ ### How do I get SFTP access to these logs? If SFTP access isn't set up yet — or you're missing credentials or the bucket path — contact your Moveworks account team or Moveworks Support. ### Why don’t I see logs in my SFTP folder? Check the versioned directory: ``` logs/v1/YYYY-MM-DD/ ``` If the folder does not appear, verify your SFTP access configuration and root folder permissions.