Activity Logs

Required User Role: Administrator

In Tenable One Vulnerability Management, the activity logs record user events that take place in your organization's Tenable One Vulnerability Management account. For each event, the log includes information about:

• The action taken
• The time at which the action was taken
• The user ID
• The target entity ID

The activity log provides visibility into the actions that users in your organization take in Tenable One Vulnerability Management, and can be helpful for identifying security issues and other potential problems. On the Activity Logs page, you can view a list of events for all users in your organization's Tenable One Vulnerability Management account.

To view your activity logs:

1. In the left navigation, click Settings.

   The Settings page appears.

2. Click the Activity Logs tile.

   The Activity Logs page appears. This page shows a list of activities associated with your organization's Tenable One Vulnerability Management account.

   

3. (Optional) Refine the table data. See Filterable Workbench Tables.

4. (Optional) Apply a filter to the table:

   Filter	Description
   Actor ID	The ID of the account performing the action.
   Target ID	The ID of the account affected by the action, if any.
   Action	The type of action.
   Date	The date the action was performed.

5. (Optional) To refresh the activity logs table, in the upper-right corner, click the Refresh button.

6. (Optional) Filter the table by a specific time period:

   • Last 7 Days

   • Last 14 Days

   • Last 30 Days

   • Last 90 Days

   • All

What to do next:

• (Optional) Export one or more activity logs.

Logged Events

How Activity Log Actions Are Generated

Most actions are generated automatically from the API endpoint that was called and the HTTP method that was used. The action has the format {resource}.{operation}, where the resource is the API path with segments joined by hyphens:

HTTP Method	Action Suffix
POST	create
PUT	update
DELETE	delete

For example, a POST request to /settings/scanner/rekey is logged as settings-scanner-rekey.create. In the API response, the description property shows the API endpoint that triggered the event.

User, Session, and Account Events

Action	Description
audit.log.view	The system received and processed an audit-log request.
session.create	The system created a session for the user. A user login triggers this event.
session.delete	The session aged out, or the user ended a session.
session.impersonation.end	An administrator ended a session where they impersonated another user.
session.impersonation.start	An administrator started a session where they impersonated another user.
user.authenticate.mfa	Two-factor authentication was successful, and login was allowed.
user.authenticate.password	The user authenticated a session start using a password.
user.create	An administrator created a new user account.
user.delete	An administrator deleted a user account.
user.impersonation.end	An administrator stopped impersonating another user.
user.impersonation.start	An administrator started impersonating another user.
user.logout	The user logged out of their session.
user.update	Either an administrator or the user updated a user account.
user.authenticate.api_keys	The user authenticated a session start using an API key.
user.2fa_reset	Two-factor authentication was reset for a user account.
user.roles.update	The roles assigned to a user were changed.
users.delete	An administrator deleted a user account.
users-two-factor-send-verification.create	A two-factor verification code was sent to a user.
users-two-factor-verify-code.create	A two-factor verification code was submitted for validation.
role.create role.update role.delete	A custom role was created, updated, or deleted.
groups.create groups.update groups.delete	A user group was created, updated, or deleted.
groups-users.delete	A user was removed from a user group.
access-groups.create access-groups.update access-groups.delete	An access group was created, updated, or deleted.
api-access-control-permissions.create api-access-control-permissions.update api-access-control-permissions.delete	A permission was created, updated, or deleted.
permissions-policy.update permissions-scan.update permissions-scanner.update permissions-scanner-pool.update permissions-agent-group.update permissions-asset-list.update permissions-connector.update	The permissions for a policy, scan, scanner, scanner group, agent group, asset list, or connector were changed, respectively.
api-saml-configs.create	A SAML single sign-on configuration was created.

Credential Events

Action	Description
credential.create credential.update credential.delete	A credential was created, updated, or deleted.
credential.permission.update	The permissions on a credential were changed.
credentials.create credentials.update credentials.delete	A managed credential was created, updated, or deleted.
credentials-files.create	A credentials file was uploaded.

Scan and Policy Events

Action	Description
scans.create scans.update scans.delete	A scan configuration was created, updated, or deleted.
scans.launch	A scan was launched.
scans-stop.create	A running scan was stopped.
scans-force-stop.create	A running scan was force stopped.
scans-pause.create	A running scan was paused.
scans-resume.create	A paused scan was resumed.
scans-unarchive.create	An archived scan was unarchived.
scans-remediation.create	A remediation scan was created.
was-configs-scans.create	A web application scan was launched.
was-scans.delete	A web application scan was deleted.
folders.create	A folder was created.
policies.create policies.update policies.delete	A scan policy was created, updated, or deleted.
policies-copy.create	A scan policy was copied.
exclusions.create exclusions.update exclusions.delete	A scan exclusion was created, updated, or deleted.
exclusions-upload-targets.create	A list of exclusion targets was uploaded.
networks.create networks.update networks.delete	A network was created, updated, or deleted.
networks-scanners.create networks-scanners.delete	A scanner was assigned to or removed from a network.
target-groups.create	A target group was created.

Scanner and Agent Events

Action	Description
scanners.update scanners.delete	A scanner was updated or deleted.
scanners-scans-control.create	Control of running scans was allowed for a scanner.
scanners-directives.create scanners-bulk-directives.create scanners-directives.delete	Instructions were sent to, or removed from, one or more scanners.
scanner-groups.create scanner-groups.update scanner-groups.delete	A scanner group was created, updated, or deleted.
scanner-groups-deletebyquery.create	Scanner groups were deleted in bulk using a query.
scanner-groups-scanners.delete	A scanner was removed from a scanner group.
sensors.create sensors.update sensors.delete	A sensor was created, updated, or deleted.
sensors-linking-key.create	A linking key was generated for sensors.
settings-scanner-rekey.create	The scanner key was regenerated.
multi-scanner-register.create	Multiple scanners were registered.
scanners-agents.delete	An agent was unlinked.
scanners-agents-exclusions.create scanners-agents-exclusions.update scanners-agents-exclusions.delete	An agent exclusion was created, updated, or deleted.
scanners-agents-directives.create scanners-agents-directives.delete	Instructions were sent to, or removed from, one or more agents.
scanners-agent-groups.create scanners-agent-groups.update scanners-agent-groups.delete	An agent group was created, updated, or deleted.
scanners-agent-groups-agents.update scanners-agent-groups-agents.delete	An agent was added to or removed from an agent group.

Export and Report Events

Action	Description
api-exports.vulns-host.create api-exports.vulns-host.cancel	A user started or canceled a vulnerabilities export.
api-exports.assets.create api-exports.assets.cancel	A user started or canceled an asset export.
api-exports.compliance.create api-exports.compliance.cancel	A user started or canceled a compliance export.
api-exports.vulns-was.create api-exports.vulns-was.cancel	A user started or canceled a web application scanning findings export.
api-exports-jobs.create api-exports-jobs.delete	An export job was created or deleted. For example, exporting the activity log table creates an export job.
api-exports-jobs-schedules.create api-exports-jobs-schedules.update api-exports-jobs-schedules.delete	A scheduled export was created, updated, or deleted.
export.email.sent	An export was sent by email.
chart-export.create	A chart was exported.
report.create report.update report.delete report.read	A report was created, updated, deleted, or viewed.
report.result.create report.result.update report.result.delete report.result.read	A report result was generated, updated, deleted, or viewed.

Asset and Tag Events

Action	Description
asset.hard.delete	An asset was permanently deleted.
automatic.asset.age.out	The system automatically removed an asset after it aged out.
workbenches-assets.delete	An asset was deleted.
asset.tag.assign	A tag was assigned to an asset.
tags-assets-assignments.create	Tags were assigned to or removed from assets.
tags-categories.create tags-categories.update tags-categories.delete	A tag category was created, updated, or deleted.
tags-values.create tags-values.update tags-values.delete	A tag value was created, updated, or deleted.
tags-values-delete-requests.create	Tag values were deleted in bulk.

Connector Events

Action	Description
settings-connectors.create settings-connectors.update settings-connectors.delete	A cloud connector was created, updated, or deleted.

Exposure Management and Other Product Events

Action	Description
connector.event	The system received and processed an event with a Tenable Exposure Management third-party connector.
mobilization.ticket.create	The user created an initiative linked to their third-party ticketing integration.
mobilization.ticket.update	The user made an update to an initiative linked to their third-party ticketing integration.
mobilization.ticket.delete	The user deleted an initiative linked to their third-party ticketing integration.
api-initiatives.create api-initiatives.delete	An exposure response initiative was created or deleted.
exposure-response-initiatives.create exposure-response-initiatives.delete	An exposure response initiative was created or deleted.
remediation.create remediation.update	A remediation project was created or updated.
remediation-goal.create remediation-goal.update	A remediation goal was created or updated.
dashboards-user.update dashboards-user-templates.create	A user dashboard was updated, or a user dashboard template was created.
risk-exclusions-create.create	A risk exclusion was created.
card.update	An Exposure view card was updated.
hexa-ai-conversations.create hexa-ai-conversations-messages.create hexa-ai-conversations-resume.create	A user started a Hexa AI conversation, sent a message in a conversation, or resumed a conversation.
hexa-ai-routines.create	A Hexa AI routine was created.

Search, Query, and Interface Events

These actions record data that a user viewed, searched, or loaded in the interface, rather than a change to your configuration. Many end in .create because the underlying API uses a POST request. A single page load can generate many of these events.

Action	Description
cards.view card.view	A user viewed Exposure view cards or a single card.
api-findings-vulnerabilities-host.create api-findings-vulnerabilities-host-count.create api-findings-vulnerabilities-host_audit.create api-findings-vulnerabilities-host_audit-count.create api-findings-vulnerabilities-webapp.create api-findings-vulnerabilities-webapp-count.create api-findings-vulnerabilities-asm.create api-findings-vulnerabilities-asm-count.create	A user searched vulnerability findings, or requested a count of findings, for host, host audit, web application, or attack surface management data.
api-assets-search.create api-installedsw-analysis.create api-installedsw-analysis-count.create api-installedsw-search-count.create api-tickets-search-count.create	A user searched assets, installed software, or tickets, or requested a count of results.
apa-api-mitre.create apa-api-findings.create apa-api-discover-find-attack-path.create apa-api-discover-get-vectors.create apa-api-discover-get-node-analysis-data.create apa-api-data-sources-technique-detection-node-type.create api-t1-apa-top-attack-paths-search.post	A user viewed or searched attack path data.
api-t1-apa-vectors.read api-t1-inventory.read api-t1-exposure-view.read	A user viewed attack path vectors, inventory, or Exposure view data.
filters-workbenches-vulnerabilities.create filters-workbenches-assets.create	A user loaded filter options for the vulnerabilities or assets workbench.
scan-ts.create	A user requested scan graph data.
risk-exclusions-list.create	A user viewed the list of risk exclusions.
one-cam-tags.create one-cam-tags-tag-categories.create one-cam.create one-lumin-exposure-view-getexposureviewsettings.create unified-analytics-usp-analysis.create vt1-analytics-embed_token_bulk.create registrar-dashboard-templates-query.create	Requests made by the interface for asset inventory, tag, Exposure view, analytics, and dashboard data.

Known Limitations

• This list is not exhaustive. Most actions are generated automatically from API calls, so new actions can appear when features or APIs change.

• Some events have no actor. For example, connector.event records the connector ID as the target but does not identify a user.

• Actions that a user takes through Hexa AI are logged with an actor name in the format Hexa(user email), for example Hexa([email protected]).

• The Description column in the API response shows the API endpoint that triggered an event (for example, POST /api/v3/exports/jobs). Use it to identify events that are not listed here.