Security Information and Event Management (SIEM) Logs Overview
Security Information and Event Management (SIEM) Logs Overview
Security Information and Event Management (SIEM) Logs Overview
Moveworks provides a JSON-based SIEM log export (via SFTP) that captures API calls, authentication events, permission changes, config changes, and other platform activities. These logs can be ingested into any organizational SIEM, data lake, or analytics pipeline to support incident response, monitoring, and compliance workflows.
Customers can export these logs from SFTP into their internal storage systems or forward them using a SIEM/log forwarder.
This document describes:
Both versions are documented here for customers who may still be using the existing pipeline during the transition.
This section applies to all customers until their migration date to the upgraded pipeline.
Logs are provided daily in the following structure:
Example:
logs/2024-08-20/2024-08-20_audit_log.json
All logs include the following fields:
External API Example
Authentication failure, permission change, and config change examples (from your existing helpdoc) are retained for backward compatibility.
This section describes the enhanced logging pipeline that you will need to migrate your workflows to
Logs now reside under a versioned subdirectory:
Log files refresh every 3 hours instead of once daily.
All supported event types now use standardized, fully documented JSON schemas.
New event types such as AGENT_STUDIO_LOG and USER_TOKEN_LOG are part of the new pipeline.
The upgraded logs use schema version “2” and follow consistent structured definitions.
CONFIG_CHANGE Event Enhancement:
Starting in 2026, CONFIG_CHANGE events now include an operation_type field that distinguishes between configuration updates and deletions:
This enhancement enables SIEM systems to easily distinguish between configuration modifications and deletions for improved audit tracking and security monitoring.
You already provided full examples — they are preserved exactly and included here, grouped by event type.
Configuration Update Example:
Configuration Deletion Example:
Depending on your pipeline version:
Check:
Check:
If neither folder appears, verify SFTP access configuration and root folder permissions.