# Audit Log Event Categories on Confluent Cloud Confluent Cloud audit logs capture event records from auditable event methods for the following event categories. For details on the auditable event methods, click the event category name. For conceptual information about audit logs, see [Audit Log Concepts on Confluent Cloud](cloud-audit-log-concepts.md#cloud-audit-logs). For the events that display by default in the Confluent Cloud Console, see [Events displayed by default](#audit-logs-display-categories). #### NOTE Resource types indicate the scope at which the audited event occurs (for example, topic-level, cluster-level, and organization-level). An event type identifies the specific auditable action recorded in an audit log, in the form `io.confluent./`. An event category groups related event types by the service or resource they apply to. ## Event type reference For quick reference, here are all the event types used in Confluent Cloud audit logs: | Event type | Service | Description | |---------------------------------------------|--------------------------------|-----------------------------------------------------------------------------------------------------------------------------| | `io.confluent.kafka.server/authentication` | Apache Kafka® | User or service account sign-in attempts to Kafka clusters | | `io.confluent.kafka.server/authorization` | Kafka | Permission checks for Kafka operations (produce, consume, admin) | | `io.confluent.kafka.server/request` | Kafka | Administrative operations on Kafka clusters, such as topic management,
access control lists (ACLs), and cluster linking | | `io.confluent.sg.server/authentication` | Schema Registry | User or service account sign-in attempts to Schema Registry clusters | | `io.confluent.sg.server/authorization` | Schema Registry | Permission checks for Schema Registry operations | | `io.confluent.sg.server/request` | Schema Registry | Schema management operations (create, update, delete schemas) | | `io.confluent.ksql.server/authentication` | ksqlDB | User or service account sign-in attempts to ksqlDB clusters | | `io.confluent.ksql.server/authorization` | ksqlDB | Permission checks for ksqlDB stream processing operations | | `io.confluent.flink.server/authentication` | Apache Flink® | User or service account sign-in attempts to Flink regions and clusters | | `io.confluent.flink.server/authorization` | Flink | Permission checks for Flink SQL statements and workspace access | | `io.confluent.cloud/request` | Flink, Tableflow, Organization | Organization and resource management operations | | `io.confluent.cloud/authorization` | Organization | Organization-level authorization checks (for example, IP filters) | | `io.confluent.context.engine/authorization` | Real-Time Context Engine | Permission checks for Real-Time Context Engine operations | | `io.confluent.context.engine/request` | Real-Time Context Engine | Organization and resource management operations | | `io.confluent.cloud/access-transparency` | Access Transparency | Confluent personnel access to customer resources for support, maintenance,
or operational purposes | ## Kafka cluster event categories Kafka cluster event categories capture authentication, authorization, and management operations performed on Kafka clusters. These events track user and service account access, permission checks, and administrative operations like topic creation and ACL management. | Event category | Event type | Resource type | Description | |--------------------------------------------------------------------------------------------------------------------|--------------------------------------------|-------------------------------------------------------------|--------------------------------------------------------------------------------| | [Authentication](event-methods/authorization-authentication-events.md#kafka-authentication-examples) | `io.confluent.kafka.server/authentication` | Not applicable | User and service account authentication to Kafka clusters | | [Authorization](event-methods/authorization-authentication-events.md#kafka-authorization-events) | `io.confluent.kafka.server/authorization` | `Topic`, `Cluster`, `Group` | Authorization checks for Kafka operations (produce, consume, admin) | | [Management and operations](event-methods/kafka-management.md#kafka-management-auditable-events) | `io.confluent.kafka.server/request` | `Topic`, `Cluster`, `Group`, `ClusterLink` | Administrative operations like creating topics, managing ACLs, cluster linking | | [Role-based access control (RBAC)](event-methods/authorization-authentication-events.md#kafka-cluster-rbac-events) | `io.confluent.kafka.server/authorization` | `Environment`, `CloudApiKey`, `SecurityMetadata`, `Billing` | Role-based access control authorization for cluster resources | #### NOTE Kafka authentication events show “Not applicable” for resource type because authentication occurs at the cluster connection level, before any resource-specific operations. After authentication, subsequent operations (authorization, management) operate on specific resource types like `Topic`, `Cluster`, or `Group`. ## Schema Registry cluster event categories Schema Registry cluster event categories capture authentication, authorization, and management operations performed on Schema Registry clusters. These events track access to schema operations and schema lifecycle management activities. | Event category | Event type | Resource type | Description | |----------------------------------------------------------------------------------------------------|-----------------------------------------|-------------------|---------------------------------------------------------------| | [Authentication](event-methods/sr-authn-authz.md#sr-authentication-authorization-auditable-events) | `io.confluent.sg.server/authentication` | `SCHEMA_REGISTRY` | Authentication to Schema Registry clusters | | [Authorization](event-methods/sr-authn-authz.md#sr-authentication-authorization-auditable-events) | `io.confluent.sg.server/authorization` | `SCHEMA_REGISTRY` | Authorization checks for schema operations | | [Management and operations](event-methods/sr-management.md#sr-management-auditable-events) | `io.confluent.sg.server/request` | `SCHEMA_REGISTRY` | Schema management operations (create, update, delete schemas) | ## ksqlDB cluster event categories ksqlDB cluster event categories capture authentication and authorization operations performed on ksqlDB clusters. These events track access to stream processing operations and SQL statement execution. | Event category | Event type | Resource type | Description | |----------------------------------------------------------------------------------------------------|-------------------------------------------|-----------------|-------------------------------------------------------| | [Authentication](event-methods/ksql-authn-authz.md#ksqldb-cluster-authentication-auditable-events) | `io.confluent.ksql.server/authentication` | `KSQL` | Authentication to ksqlDB clusters | | [Authorization](event-methods/ksql-authn-authz.md#ksqldb-cluster-authorization-auditable-events) | `io.confluent.ksql.server/authorization` | `KSQL` | Authorization checks for stream processing operations | ## Flink cluster event categories Flink cluster event categories capture authentication, authorization, and management operations performed on Flink regions and clusters. These events track access to Flink SQL statements, workspace operations, and resource management. | Event category | Event type | Resource type | Description | |--------------------------------------------------------------------------------------------|--------------------------------------------|--------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------| | [Authentication](event-methods/flink-authn-authz.md#flink-authentication-auditable-events) | `io.confluent.flink.server/authentication` | `FLINK_REGION` | Authentication to Flink regions and clusters | | [Authorization](event-methods/flink-authn-authz.md#flink-authorization-auditable-events) | `io.confluent.flink.server/authorization` | `STATEMENT`, `WORKSPACE` | Authorization checks for Flink SQL statements and workspace access | | [Management and operations](event-methods/flink.md#event-methods-flink) | `io.confluent.cloud/request` | `FLINK_REGION`, `COMPUTE_POOL`, `FLINK_WORKSPACE`, `STATEMENT`, `MATERIALIZED_TABLE` | Management of Flink resources (regions, compute pools, workspaces, statements, materialized tables) | ## Tableflow event categories Tableflow event categories capture operations related to data lake management and table operations. These events track catalog integration, topic management, data plane operations, and OAuth authentication for Tableflow services. | Event category | Event type | Resource type | Description | |----------------------------------------------------------------------------------------------------------------|------------------------------|-----------------------------------------------------|---------------------------------------------------------------------| | [Catalog integration](event-methods/tableflow-control-plane.md#tableflow-catalog-integration-auditable-events) | `io.confluent.cloud/request` | `TABLEFLOW_CATALOG`, `PROVIDER_INTEGRATION` | Integration with external catalog systems (for example, AWS Glue) | | [Control plane operations](event-methods/tableflow-control-plane.md#tableflow-control-plane-auditable-events) | `io.confluent.cloud/request` | `TOPIC` | Creating, updating, and managing Tableflow topics | | [Data plane catalog](event-methods/tableflow-data-plane.md#tableflow-catalog-auditable-events) | `io.confluent.cloud/request` | `ICEBERG_NAMESPACE`, `ICEBERG_TABLE`, `ENVIRONMENT` | Data plane catalog operations for Iceberg tables and namespaces | | [OAuth](event-methods/tableflow-data-plane.md#tableflow-oauth-auditable-events) | `io.confluent.cloud/request` | `ORGANIZATION` | OAuth authentication and authorization for Tableflow | | [Signer](event-methods/tableflow-data-plane.md#tableflow-data-plane-signer-auditable-events) | `io.confluent.cloud/request` | `ICEBERG_SIGNER` | Data plane signing operations for secure access | | [Topic operations](event-methods/tableflow-control-plane.md#tableflow-topics-auditable-events) | `io.confluent.cloud/request` | `TOPIC` | Tableflow topic enablement, configuration, and lifecycle management | ## Real-Time Context Engine event categories Real-Time Context Engine event categories capture authorization and management operations performed on Real-Time Context Engine topics. | Event subcategory | Event type | Resource type | Description | |-----------------------------------------------------------------------------------------------------------|---------------------------------------------|-----------------|--------------------------------------------------------------| | [Authorization](event-methods/real-time-context-engine.md#rtce-auditable-events-authorization) | `io.confluent.context.engine/authorization` | `TOPIC` | Authorization checks for Real-Time Context Engine operations | | [Management and operations](event-methods/real-time-context-engine.md#rtce-auditable-events-organization) | `io.confluent.context.engine/request` | `TOPIC` | Real-Time Context Engine management operations | ## Access Transparency event categories Access Transparency event categories capture when Confluent personnel access customer resources for support, maintenance, or operational purposes. These events provide visibility into privileged access for compliance and transparency requirements. For an overview of Access Transparency, see [Access Transparency on Confluent Cloud](access-transparency-overview.md#access-transparency-overview). | Event category | Event type | Resource type | Description | |------------------------------------------------------------------------------------------------|------------------------------------------|------------------------------------------------|----------------------------------------------------------------------------------------------------| | [Privileged access](event-methods/access-transparency.md#access-transparency-auditable-events) | `io.confluent.cloud/access-transparency` | `KAFKA_CLUSTER`, `ENVIRONMENT`, `ORGANIZATION` | Confluent personnel access to customer resources for support, maintenance, or operational purposes | ## Organization event categories Organization event categories capture management operations on organization-level resources, including API keys, identity providers, networking, and billing. Organization events are split into separate sections due to the large number of management operations. #### NOTE Users might attempt to authorize a task solely to find out if they can perform the task, and not follow through with it. In these instances, the authorization is still captured in the audit log. ### Organization authorization The following organization authorization events are part of Confluent Cloud organization audit logs: | Event category | Event type | Resource type | Description | |--------------------------------------------------------------------------------|------------------------------------|-----------------|----------------------------------------------------| | [IP filter](event-methods/ip-filter-authz.md#ip-filter-authz-auditable-events) | `io.confluent.cloud/authorization` | `ORGANIZATION` | Authorization checks for IP-based access filtering | ### Organization management and operations The following subcategories represent different resource types and their associated operations (create, read, update, delete): #### Access management The following access management events are part of Confluent Cloud organization audit logs: | Event subcategory | Event type | Resource type | Description | |-----------------------------------------------------------------------------------------------------|------------------------------|---------------------|-----------------------------------------| | [API key](event-methods/organization-events.md#organization-api-key) | `io.confluent.cloud/request` | `API_KEY` | API key management operations | | [Identity pool (OAuth/OIDC)](event-methods/identity-provider.md#org-events-identity-provider) | `io.confluent.cloud/request` | `IDENTITY_POOL` | Identity pool management operations | | [Identity provider (OAuth/OIDC)](event-methods/identity-provider.md#org-events-identity-provider) | `io.confluent.cloud/request` | `IDENTITY_PROVIDER` | Identity provider management operations | | [IP filter](event-methods/ip-filter-management.md#ip-filter-management-auditable-events) | `io.confluent.cloud/request` | `IP_FILTER` | IP filter management operations | | [IP group](event-methods/ip-filter-management.md#ip-filter-management-auditable-events) | `io.confluent.cloud/request` | `IP_GROUP` | IP group management operations | | [Role-based access control (RBAC)](event-methods/rbac.md#rbac-auditable-events) | `io.confluent.cloud/request` | `CLOUD_CLUSTER` | RBAC management operations | | [Service account](event-methods/organization-events.md#organization-service-account) | `io.confluent.cloud/request` | `ORGANIZATION` | Service account management operations | | [Single sign-on (SSO) connection](event-methods/organization-events.md#organization-sso-connection) | `io.confluent.cloud/request` | `SSO_CONNECTION` | SSO connection management operations | | [User account](event-methods/organization-events.md#organization-user-account) | `io.confluent.cloud/request` | `USER` | User account management operations | | [User invitation](event-methods/organization-events.md#organization-invitation) | `io.confluent.cloud/request` | `USER_INVITATION` | User invitation management operations | #### Infrastructure and resources The following infrastructure and resources events are part of Confluent Cloud organization audit logs: | Event subcategory | Event type | Resource type | Description | |-----------------------------------------------------------------------------------------------------------|------------------------------|---------------------------|-----------------------------------------------| | [Connector](event-methods/connector.md#organization-connector) | `io.confluent.cloud/request` | `CONNECTOR` | Connector management operations | | [Custom connector plugin](event-methods/custom-connector-plugin.md#event-methods-custom-connector-plugin) | `io.confluent.cloud/request` | `CUSTOM_CONNECTOR_PLUGIN` | Custom connector plugin management operations | | [Environment](event-methods/organization-events.md#organization-environment) | `io.confluent.cloud/request` | `ENVIRONMENT` | Environment management operations | | [Kafka cluster](event-methods/organization-events.md#organization-kafka-cluster) | `io.confluent.cloud/request` | `KAFKA_CLUSTER` | Kafka cluster management operations | | [ksqlDB cluster](event-methods/organization-events.md#organization-ksql) | `io.confluent.cloud/request` | `KSQL_CLUSTER` | ksqlDB cluster management operations | | [Schema Registry cluster](event-methods/organization-events.md#organization-schema-registry) | `io.confluent.cloud/request` | `SCHEMA_REGISTRY` | Schema Registry cluster management operations | #### Networking The following networking events are part of Confluent Cloud organization audit logs: | Event subcategory | Event type | Resource type | Description | |-------------------------------------------------------------------------------------------------------------------|------------------------------|--------------------------------------|----------------------------------------------------------| | [Domain Name System (DNS) forwarder](event-methods/networking.md#organization-dns-forwarder) | `io.confluent.cloud/request` | `DNS_FORWARDER` | DNS forwarder management operations | | [Network](event-methods/networking.md#organization-network) | `io.confluent.cloud/request` | `NETWORK` | Network management operations | | [Peering connection](event-methods/networking.md#organization-peering-connection) | `io.confluent.cloud/request` | `PEERING` | Peering connection management operations | | [Private link access](event-methods/networking.md#organization-private-link-access) | `io.confluent.cloud/request` | `PRIVATE_LINK_ACCESS` | Private link access management operations | | [Private link attachment](event-methods/networking.md#organization-private-link-attachment) | `io.confluent.cloud/request` | `PRIVATE_LINK_ATTACHMENT` | Private link attachment management operations | | [Private link attachment connection](event-methods/networking.md#organization-private-link-attachment-connection) | `io.confluent.cloud/request` | `PRIVATE_LINK_ATTACHMENT_CONNECTION` | Private link attachment connection management operations | | [Transit gateway attachment](event-methods/networking.md#organization-transit-gateway-attachment) | `io.confluent.cloud/request` | `ENVIRONMENT` | Transit gateway attachment management operations | #### Services and integrations The following services and integrations events are part of Confluent Cloud organization audit logs: | Event subcategory | Event type | Resource type | Description | |------------------------------------------------------------------------------------------------------|------------------------------|---------------------------|-------------------------------------------------| | [Billing](event-methods/organization-events.md#organization-billing) | `io.confluent.cloud/request` | `ORGANIZATION` | Billing management operations | | [Marketplace entitlement](event-methods/organization-events.md#organization-marketplace-entitlement) | `io.confluent.cloud/request` | `MARKETPLACE_ENTITLEMENT` | Marketplace entitlement management operations | | [Notification integration](event-methods/notification-service.md#organization-notification-service) | `io.confluent.cloud/request` | `NS_INTEGRATION` | Notification integration management operations | | [Notification subscription](event-methods/notification-service.md#organization-notification-service) | `io.confluent.cloud/request` | `NS_SUBSCRIPTION` | Notification subscription management operations | | [Notification type](event-methods/notification-service.md#organization-notification-service) | `io.confluent.cloud/request` | `NS_NOTIFICATION_TYPE` | Notification type management operations | | [Sign-in attempt](event-methods/organization-events.md#organization-sign-in-attempt) | `io.confluent.cloud/request` | `ORGANIZATION` | Sign-in attempt tracking operations | ## Events displayed by default Management events record administrative operations that affect your organization’s security posture, identity boundaries, and infrastructure configuration. These events track operations that modify your environment’s state or access levels. Management events display by default in the Confluent Cloud Console. This requires appropriate permissions and at least one Kafka cluster type that supports audit logs. Examples include: - **Global actions**: Organization-level changes, SSO configurations, and environment lifecycles - **Resource management**: Creating or deleting Kafka topics, configuring Schema Registry, or setting up Tableflow catalogs - **Security policy**: Adding or removing ACLs and managing service accounts For more information on viewing these events, see [View your audit logs](configure.md#view-audit-logs). ## Related content - [Access and Consume Audit Logs on Confluent Cloud](configure.md#cloud-activate-audit-logs) - [Audit Log Concepts on Confluent Cloud](cloud-audit-log-concepts.md#cloud-audit-logs)