Viewing Audited Events | Soteri Documentation

To help administrators keep track of various events, Security for Confluence Cloud has an audit log. Due to Atlassian policies, we cannot write to the Atlassian audit log.

Audit log entries are retained for 90 days.

Accessing the audit log

From the Soteri settings page, click on Audit Log in the top right of the page.

Viewing events

The audit log page shows events ordered from most to least recent.

The “Show more” column on the right can be clicked to show the details of individual events, including the Atlassian user ID of the author. (Events with no associated user, such as scans starting and completing, use “System” as the author)

The search boxes at the top of the page can be used to filter events by a substring of the Atlassian user ID, event type, or event details (which are stored as JSON). Click the search icon or press enter in one of the search boxes to filter. For example, the above event matches each of these filters:

Exporting events

The export button on the top right exports events matching the current filters as a CSV file.

Who can view the audit log?

The audit log is available to Confluence administrators, plus any users and groups granted access under App Access on the Soteri settings page.

The audit log covers the entire instance. In order to ensure traceability, it is not filtered to particular spaces like the Dashboard. As such, an App Administrator will be able to see every event recorded for the instance, including events for spaces they cannot see in Confluence.

Audit events record identifiers and metadata only. This includes things like:

Space IDs and keys
content IDs and page titles
version numbers
finding counts
rule names
timestamps
author names
links to Soteri pages

They never include scanned content or the matched text of a finding. Viewing the text content of findings themselves still requires Read permission on the space.

Grant App Access only to people you trust with instance-wide visibility into scanning activity.

List of audited events

Event	Detail fields
Global setting events
Updated app access configuration `updated_app_access` Author: The acting user	`Added`: The users and groups that were granted access, as a comma-separated list. Only recorded when it applies. `Removed`: The users and groups whose access was revoked, as a comma-separated list. Only recorded when it applies.
Updated instance settings `updated_instance_settings` Author: The acting user	`autoScan`: Whether new and updated content is scanned automatically. Only recorded when it applies. `deduplicateExports`: Whether exports report one row per content item rather than one row per version. Only recorded when it applies. `includePlaintextInExports`: Whether exports include the text of each finding rather than a link to it in context. Only recorded when it applies. `mlScanning`: Whether AI model scanning is enabled. Only recorded when it applies. `requireReviewReason`: Whether a reason must be given when a finding is marked as reviewed. Only recorded when it applies. `scanAttachments`: Whether attachments are scanned. Only recorded when it applies.
Sent settings to Soteri Support `sent_settings_to_support` Author: The acting user	This event carries no detail fields.
Rule setting events
Toggled built-in rule `toggled_builtin_rule` Author: The acting user	`enabled`: Whether the rule is enabled. `name`: The name of the built-in rule.
Updated email rule settings `updated_email_rule_settings` Author: The acting user	`domainFilterMode`: How the domain list is applied: `NONE` flags every email address, `IGNORE_DOMAINS` flags every address except those at the listed domains, and `FLAG_ONLY_DOMAINS` flags only addresses at the listed domains. `domains`: The domains the filter mode applies to. Only recorded when it applies. `filterExampleEmails`: Whether example and test addresses, such as `test@` or any address at `example.com`, are treated as false positives. `filterRoleBasedEmails`: Whether role-based addresses, such as `support@` or `noreply@`, are treated as false positives.
Updated generic password rule settings `updated_generic_password_rule_settings` Author: The acting user	`aiPasswordConfirmation`: Whether an AI classifier confirms each generic password finding before it is reported. `aiPasswordConfirmationThreshold`: The lowest confidence score, between 0 and 1, that the AI classifier can give a generic password finding for it to still be reported. `customPlaceholderPatternCount`: How many custom placeholder patterns the generic password rule is configured with. `customRedactedPatternCount`: How many custom redaction patterns the generic password rule is configured with. `filterEnvironmentVariables`: Whether values that reference an environment variable or configuration lookup, rather than a hardcoded credential, are treated as false positives. `filterNullAndRedacted`: Whether values that are empty or already redacted, such as `[REDACTED]` or `****`, are treated as false positives. `filterPlaceholders`: Whether placeholder values, such as `CHANGE_ME`, are treated as false positives. `filterTooShort`: Whether values too short to be a real secret are treated as false positives.
Created custom rule `created_custom_rule` Author: The acting user	`id`: The ID of the custom rule. `name`: The name of the custom rule. `regexp`: The regular expression the custom rule matches.
Updated custom rule `updated_custom_rule` Author: The acting user	`enabled`: Whether the rule is enabled. `id`: The ID of the custom rule. `name`: The name of the custom rule. `previousEnabled`: Whether the rule was enabled before the update. Only recorded when it applies. `previousName`: The rule's name before the update. Only recorded when it applies. `previousRegexp`: The rule's regular expression before the update. Only recorded when it applies. `regexp`: The regular expression the custom rule matches.
Deleted custom rule `deleted_custom_rule` Author: The acting user	`id`: The ID of the custom rule. `name`: The name of the custom rule. `regexp`: The regular expression the custom rule matches.
Globally reviewed finding events
Added globally reviewed false positives `added_globally_reviewed` Author: The acting user	`addedCount`: How many of the uploaded entries were stored. An entry matching one already stored is skipped. `rowsWithoutMatchText`: How many uploaded rows were skipped because they named no text to review. A row holding nothing at all is not counted. `skippedCount`: How many uploaded rows were skipped for their review reason, either because the category named is not recognized or because no reason was given while the app requires one. `updatedCount`: How many already stored entries had their review reason replaced by the upload, which also makes the uploading user their recorded reviewer. `uploadedCount`: How many entries the uploaded file held, before they were matched against the stored ones.
Deleted globally reviewed false positives `deleted_globally_reviewed` Author: The acting user	`deletedCount`: How many stored entries were deleted. `rowsWithoutMatchText`: How many uploaded rows were skipped because they named no text to review. A row holding nothing at all is not counted. `uploadedCount`: How many entries were submitted for deletion, before they were matched against the stored ones.
Exported globally reviewed false positives `exported_globally_reviewed` Author: The acting user	This event carries no detail fields.
Reviewed finding events
Reviewed a finding `reviewed_finding` Author: The acting user	`contentId`: The ID of the page or blog post the review applies to. Only recorded when it applies. `reasonCategory`: The category chosen for the review reason. Only recorded when it applies. `reasonNotes`: The note written to explain the review, truncated to 500 characters. Only recorded when it applies. `ruleName`: The name of the rule the reviewed finding matched. `scope`: `space` when the review applies to every matching finding in the space, or `fine-grained` when it applies to one page, blog post, or comment. `spaceId`: The ID of the space. `spaceKey`: The key of the space.
Deleted a reviewed finding `deleted_reviewed_finding` Author: The acting user	`contentId`: The ID of the page or blog post the review applied to. Only recorded when it applies. `reasonCategory`: The category chosen for the review reason. Only recorded when it applies. `reasonNotes`: The note written to explain the review, truncated to 500 characters. Only recorded when it applies. `reviewTime`: When the finding was originally reviewed. Only recorded when it applies. `reviewer`: The Atlassian account ID of the user who originally reviewed the finding. Only recorded when it applies. `ruleName`: The name of the rule the reviewed finding matched. `scope`: `space` when the review applied to every matching finding in the space, or `fine-grained` when it applied to one page, blog post, or comment. `spaceId`: The ID of the space. `spaceKey`: The key of the space.
Space scan events
Queued full instance rescan `forced_instance_rescan_requested` Author: The acting user	This event carries no detail fields.
Scheduled space scan `scheduled_space_scan` Author: The acting user, System	`forceRescan`: Recorded as `true` when the scan was queued as a forced rescan, which scans content again even when nothing about it has changed since the last scan. Only recorded when it applies. `spaceId`: The ID of the space. `spaceKey`: The key of the space.
Started space scan `started_space_scan` Author: System	`spaceId`: The ID of the space. `spaceKey`: The key of the space.
Finished space scan `finished_space_scan` Author: System	`findingsCount`: How many findings the space holds now that the scan has finished. `spaceId`: The ID of the space. `spaceKey`: The key of the space.
Error while running space scan `space_scan_error` Author: System	`errorMessage`: The error the scan stopped with. Only recorded when it applies. `findingsCount`: How many findings the space held when the scan failed. Only recorded when it applies. `spaceId`: The ID of the space. `spaceKey`: The key of the space.
Findings in content version `findings_found` Author: System	`attachmentFilename`: The filename of the attachment that was scanned. Only recorded when it applies. `attachmentId`: The ID of the attachment. Only recorded when it applies. `authorAccountId`: The Atlassian account ID of the author of the scanned version. Only recorded when it applies. `commentId`: The ID of the comment. Only recorded when it applies. `contentId`: The ID of the page or blog post. Only recorded when it applies. `contentTitle`: The title of the page, blog post, or comment that was scanned. Only recorded when it applies. `findingsCount`: How many new findings were detected. `scanReportUrl`: A link to the app's security analysis of the page, blog post, or comment. `url`: A link to the page, blog post, or comment the findings were detected in. `versionNumber`: The version of the page, blog post, or attachment that was scanned. Only recorded when it applies. `violatedRuleNames`: The names of the rules the new findings matched, as a comma-separated list. `authorName`: The display name of the author of the scanned version. Only recorded when it applies. Webhook-only. `authorProfile`: A link to the Atlassian profile of the author of the scanned version. Only recorded when it applies. Webhook-only.
Could not access space `could_not_access_space` Author: System	`spaceId`: The ID of the space. `spaceKey`: The key of the space.
Could not access content version for scan `could_not_access_content` Author: System	`contentId`: The ID of the page or blog post. `spaceId`: The ID of the space. `spaceKey`: The key of the space. `versionNumber`: The content version that could not be read.
Could not access comment version for scan `could_not_access_comment` Author: System	`commentId`: The ID of the comment. `parentContentId`: The ID of the page or blog post the comment belongs to. `spaceId`: The ID of the space. `spaceKey`: The key of the space. `versionNumber`: The comment version that could not be read.
Webhook events
Added webhook `webhook_added` Author: The acting user, System	`description`: The webhook's description. `url`: The URL the webhook posts to. Not recorded for Slack webhooks, whose URL is itself a credential. Only recorded when it applies.
Updated webhook `webhook_updated` Author: The acting user	`authorizationChange`: How the webhook's authorization header changed: `added`, `updated`, or `removed`. The header's value is never recorded, so this field is what reports the change. Only recorded when it applies. `description`: The webhook's description. Part of a change summary. `enabled`: Whether the webhook is enabled. Part of a change summary. `eventsAdded`: The codes of the event types the webhook was subscribed to by this change. Only recorded when it applies. Part of a change summary. `eventsRemoved`: The codes of the event types the webhook was unsubscribed from by this change. Only recorded when it applies. Part of a change summary. `headersAdded`: The custom headers this change added. The authorization header is excluded, since its value is a credential. Only recorded when it applies. Part of a change summary. `headersRemoved`: The custom headers this change removed. The authorization header is excluded, since its value is a credential. Only recorded when it applies. Part of a change summary. `sharedSecretsAdded`: The shared secrets this change added, each truncated to the same short form the app displays, so that the addition is auditable without the secret itself being recorded. Only recorded when it applies. Part of a change summary. `sharedSecretsRemoved`: The shared secrets this change removed, each truncated to the same short form the app displays, so that the removal is auditable without the secret itself being recorded. Only recorded when it applies. Part of a change summary. `url`: The URL the webhook posts to. Not recorded for Slack webhooks, whose URL is itself a credential. Only recorded when it applies. Part of a change summary.
Deleted webhook `webhook_deleted` Author: The acting user	`description`: The webhook's description. `url`: The URL the webhook posts to. Not recorded for Slack webhooks, whose URL is itself a credential. Only recorded when it applies.
Webhook was disabled `webhook_disabled` Author: System	`error`: The error the webhook endpoint responded with. `temporary`: `true` when the webhook was disabled for a few minutes and will retry by itself, `false` when it stays disabled until an administrator re-enables it. `url`: The URL the webhook posts to. Not recorded for Slack webhooks, whose URL is itself a credential. Only recorded when it applies.
Export finding events
Exported findings `exported_findings` Author: The acting user	`scope`: What the export covered: `all spaces`, `attachment coverage for all spaces`, or `attachment coverage` for the single space named by `spaceKey`. Only recorded when it applies. `spaceKey`: The key of the space. Only recorded when it applies.
Exported reviewed findings `exported_reviewed_findings` Author: The acting user	`scope`: Recorded as `all spaces` when the export covered every space. Only recorded when it applies. `spaceKey`: The key of the space. Only recorded when it applies.
Model rule events
Created model rule `create_model_rule` Author: System	`confidence`: The confidence score, between 0 and 1, above which the model rule reports a finding. `enabled`: Whether the rule is enabled. `name`: The name of the model rule. `ruleId`: The ID of the model rule.
Updated model rule `update_model_rule` Author: The acting user, System	`confidence`: The confidence score, between 0 and 1, above which the model rule reports a finding. Part of a change summary. `enabled`: Whether the rule is enabled. Part of a change summary. `name`: The name of the model rule. Part of a change summary. `ruleId`: The ID of the model rule. Part of a change summary.
Deleted model rule `delete_model_rule` Author: System	`confidence`: The confidence score, between 0 and 1, above which the model rule reports a finding. `enabled`: Whether the rule is enabled. `name`: The name of the model rule. `ruleId`: The ID of the model rule.

Field conventions

Change summary fields

An event that reports an update records a summary of what changed rather than a snapshot of the new state. Within such a summary:

An unchanged single value appears under its own name, with its unchanged value.
A changed single value appears under its own name with the new value, and its previous value appears under previous<Field> (for example name and previousName). The presence of the previous<Field> key is what marks the value as changed.
A list never appears under its own name. Its difference appears as <field>Added and <field>Removed, each holding only the entries on that side, and a side with no entries is omitted. A list that did not change is absent altogether.

Naming

spaceId and spaceKey identify a space. contentId and contentTitle identify a page or a blog post, except on an event about a comment, where they identify the comment itself and parentContentId identifies the page or blog post it was left on.