Core Platform

Security Information and Event Management (SIEM) Logs Overview

View as Markdown

Moveworks provides a JSON-based SIEM log export (via SFTP) that captures API calls, authentication events, permission changes, config changes, and other platform activities. These logs can be ingested into any organizational SIEM, data lake, or analytics pipeline to support incident response, monitoring, and compliance workflows.

Customers can export these logs from SFTP into their internal storage systems or forward them using a SIEM/log forwarder.

📂 File Structure & Delivery Cadence

Directory Layout

Logs are delivered to a versioned subdirectory (v1) within your SFTP bucket:

logs/v1/YYYY-MM-DD/YYYY-MM-DD_audit_log.json

Example: logs/v1/2024-08-20/2024-08-20_audit_log.json

Files are delivered under the v1 subdirectory, which denotes the delivery pipeline version. This is separate from the version field inside each log entry, which is the log schema version (currently "2").

Refresh Frequency

Each day’s log file is updated every 3 hours — new activity is appended to that day’s existing file; a new file is not created for each refresh.

All date folders and event_time timestamps are in UTC.

🧩 Log Schema

All logs use a consistent, well-defined structure. Each supported log type has a documented schema so parsing and integration with your SIEM solution is reliable.

Top-Level Fields

Every log includes the following fields:

FieldDescription
versionSchema version number (currently "2").
severityEvent severity (e.g., INFO, ERROR).
event_idUnique identifier for the event.
event_typeCategory of event (e.g., EXTERNAL_API).
event_sourceAlways MOVEWORKS.
event_timeTime when the event occurred (YYYY-MM-DD HH:MM:SS.ffffff).
event_dataKey–value metadata specific to the event type. Sensitive request/response bodies are excluded.

The fields inside event_data differ by event_type — see the examples below for the fields included with each type.

Supported Log Types

  • EXTERNAL_API
  • EXTERNAL_LDAP_API
  • CONFIG_CHANGE
  • PERMISSION_CHANGE
  • AUTHENTICATION
  • AGENT_STUDIO_LOG
  • USER_TOKEN_LOG

📄 Example Logs

Example payloads for each supported log type are shown below.

EXTERNAL_API

Outbound API calls Moveworks makes to external/integrated systems, including the request URI and method, response status, and timing.

1{
2    "version": "2",
3    "severity": "INFO",
4    "event_id": "Que5vMmYkJuB",
5    "event_type": "EXTERNAL_API",
6    "event_source": "MOVEWORKS",
7    "event_time": "2025-10-16 19:00:23.850992",
8    "event_data": {
9        "user_id": "9422067216216842966",
10        "request_uri": "https://slack.com/api/chat.postMessage",
11        "request_method": "POST",
12        "response_status_code": "200",
13        "execution_time_ms": 172,
14        "response_size_bytes": 1194
15    }
16}

EXTERNAL_LDAP_API

LDAP queries Moveworks issues against your directory (for example, user lookups), including the search request that was run.

1{
2  "version": "2",
3  "severity": "INFO",
4  "event_id": "7UUWTmuqR1-I",
5  "event_type": "EXTERNAL_LDAP_API",
6  "event_source": "MOVEWORKS",
7  "event_time": "2025-07-25 23:08:06.715425",
8  "event_data": {
9    "user_id": "12608431283658477771",
10    "request": "{'search_request': {'base_dn': '{{dc_base_filter}}', 'scope': 2, 'filter': '(&(objectClass=user)(mail=coryweb*))'}}"
11  }
12}

CONFIG_CHANGE

Changes to Moveworks configuration, capturing which config was changed, its version, the origin of the change, the operation type, and the specific fields updated.

The operation_type field distinguishes configuration updates from deletions:

ValueDescription
CONFIG_OPERATION_TYPE_UPDATEConfiguration was modified or updated
CONFIG_OPERATION_TYPE_DELETEConfiguration was removed or deleted

Configuration update

1{
2  "version": "2",
3  "severity": "INFO",
4  "event_id": "hLOXixn7T1iW",
5  "event_type": "CONFIG_CHANGE",
6  "event_source": "MOVEWORKS",
7  "event_time": "2026-01-06 03:49:38.763026",
8  "event_data": {
9    "user_id": "412307323227731938",
10    "config_version": 3,
11    "config_name": "ScriptConfig",
12    "change_origin_type": "CONFIG_SOURCE_USER",
13    "operation_type": "CONFIG_OPERATION_TYPE_UPDATE",
14    "updated_configs": [
15      {
16        "op": "update",
17        "path": "root['code']"
18      }
19    ]
20  }
21}

Configuration deletion

1{
2  "version": "2",
3  "severity": "INFO",
4  "event_id": "mN8PqX2wR5tZ",
5  "event_type": "CONFIG_CHANGE",
6  "event_source": "MOVEWORKS",
7  "event_time": "2026-01-06 04:15:22.891037",
8  "event_data": {
9    "user_id": "412307323227731938",
10    "config_version": 4,
11    "config_name": "NotificationOrgConfig",
12    "change_origin_type": "CONFIG_SOURCE_USER",
13    "operation_type": "CONFIG_OPERATION_TYPE_DELETE",
14    "updated_configs": [
15      {
16        "op": "remove",
17        "path": "root['notification_noise_control_config']"
18      }
19    ]
20  }
21}

PERMISSION_CHANGE

Changes to user role and permission assignments across Moveworks apps, including the roles assigned or revoked and the user’s resulting full role set.

1{
2    "version": "2",
3    "severity": "INFO",
4    "event_id": "LU8QgcnSTQ2m",
5    "event_type": "PERMISSION_CHANGE",
6    "event_source": "MOVEWORKS",
7    "event_time": "2025-07-29 15:53:42.047730",
8    "event_data": {
9        "user_id": "16054822774505271985",
10        "assigned_roles": [
11            {
12                "app": "APP_CREATOR_STUDIO",
13                "roles": ["ROLE_CREST_ADMIN"],
14                "grantee": "3743745632043933493"
15            }
16        ],
17        "all_roles": [
18            {
19                "app": "APP_CREATOR_STUDIO",
20                "roles": ["ROLE_CREST_ADMIN"],
21                "grantee": "3743745632043933493"
22            },
23            {
24                "app": "APP_BOT_ANALYTICS",
25                "roles": ["ROLE_BOT_ANALYTICS_ADMIN"],
26                "grantee": "3743745632043933493"
27            },
28            {
29                "app": "APP_MW_SETUP",
30                "roles": ["ROLE_MW_SETUP_ADMIN"],
31                "grantee": "3743745632043933493"
32            }
33        ]
34    }
35}

AUTHENTICATION

Authentication events such as logins (success or failure), including the app, source IP, and user agent.

1{
2    "version": "2",
3    "severity": "INFO",
4    "event_id": "OqsC6ItzTL6f",
5    "event_type": "AUTHENTICATION",
6    "event_source": "MOVEWORKS",
7    "event_time": "2025-10-15 15:38:31.883000",
8    "event_data": {
9        "user_id": "9733382206290329491",
10        "authn_event_type": "AUTHN_EVENT_LOGIN_SUCCESS",
11        "app": "AUTHN_APP_MY_MOVEWORKS",
12        "idp_metadata": {},
13        "source_ip": "208.127.82.164",
14        "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36"
15    }
16}

AGENT_STUDIO_LOG

Actions taken in Agent Studio, including the method invoked, the result, and the object or log type that was acted on.

1{
2    "version": "2",
3    "severity": "INFO",
4    "event_id": "SorjFyTNZnDK",
5    "event_type": "AGENT_STUDIO_LOG",
6    "event_source": "MOVEWORKS",
7    "event_time": "2025-10-16 19:44:59.325022",
8    "event_data": {
9        "user_id": "10769617033889969982",
10        "uivar_uuid": "5d6edaaa-fe72-4ef1-8c3f-875c5f634726",
11        "result": "AGENT_STUDIO_LOG_RESULT_SUCCESS",
12        "method": "AGENT_STUDIO_LOG_METHOD_READ",
13        "log_type": "AGENT_STUDIO_LOG_TYPE_AGENT_STUDIO_CONNECTORS"
14    }
15}

USER_TOKEN_LOG

User-token operations, such as retrieving an access token for a connected integration, with sanitized token information.

1{
2    "version": "2",
3    "severity": "INFO",
4    "event_id": "HFm8ZebzGHdu",
5    "event_type": "USER_TOKEN_LOG",
6    "event_source": "MOVEWORKS",
7    "event_time": "2025-10-16 19:44:59.325022",
8    "event_data": {
9        "user_id": "8340006963328694015",
10        "status": "USER_TOKEN_EXECUTION_STATUS_SUCCESS",
11        "retrieve_access_token_log": {
12            "integration_id": "enterprise_search_google_drive_connector",
13            "sanitized_access_token_info": {
14                "integration_id": "enterprise_search_google_drive_connector",
15                "expires_at": "2025-10-16T19:58:13.331639Z"
16            }
17        }
18    }
19}

❓ FAQ

How do I get SFTP access to these logs?

If SFTP access isn’t set up yet — or you’re missing credentials or the bucket path — contact your Moveworks account team or Moveworks Support.

Why don’t I see logs in my SFTP folder?

Check the versioned directory:

logs/v1/YYYY-MM-DD/

If the folder does not appear, verify your SFTP access configuration and root folder permissions.