Audit Logs
Changes made to your workspace, instances, and volumes produce audit logging entries which can be used for security and debugging purposes.
Audit entries are available in Namespace's UI and can be filtered for certain actions or actors.
Audit Log Forwarding (SIEM)
Namespace also supports pushing audit events to a customer provided SIEM (Security Information & Event Management) solution. This allows for centralized analysis, streamlined compliance, and real-time threat detection within your existing security tooling.
Audit Log Forwarding is available to Enterprise customers.
To set up Audit Log Forwarding with SIEM for your workspace, reach out via your dedicated support channel or email us at support@namespace.so.
Audit Log Types
Namespace audit logs include many different actions, including contextual data to understand exactly what happened. The most important actions and what data they contain are detailed below:
federation.github.associate
Namespace's GitHub federation application has been associated with the workspace.
{
"action": "federation.github.associate",
"actor": {
"email": "foobar@example.com",
"type": "user",
"user_id": "user_..."
},
"at": "2025-03-14T21:08:41+00:00",
"target": {
"github_installation_id": "1234...",
"type": "github_installation"
},
"tenant_id": "tenant_..."
}federation.github.deassociate
Namespace's GitHub federation application has been deassociated from the workspace.
{
"action": "federation.github.deassociate",
"actor": {
"claims": {
"login": "octocat"
},
"source": "github",
"type": "external"
},
"at": "2025-03-14T21:08:41+00:00",
"target": {
"github_installation_id": "1234...",
"type": "github_installation"
},
"tenant_id": "tenant_..."
}github.installation.associate
Namespace's GitHub runner application has been associated with the workspace.
{
"action": "github.installation.associate",
"actor": {
"email": "foobar@example.com",
"type": "user",
"user_id": "user_..."
},
"at": "2025-03-14T21:08:41+00:00",
"target": {
"github_installation_id": "1234...",
"type": "github_installation"
},
"tenant_id": "tenant_..."
}github.installation.deassociate
Namespace's GitHub runner application has been deassociated from the workspace.
{
"action": "github.installation.deassociate",
"actor": {
"claims": {
"login": "octocat"
},
"source": "github",
"type": "external"
},
"at": "2025-03-14T21:08:41+00:00",
"target": {
"github_installation_id": "1234...",
"type": "github_installation"
},
"tenant_id": "tenant_..."
}github.profile.create
A GitHub runner profile has been created.
{
"action": "github.profile.create",
"actor": {
"email": "foobar@example.com",
"type": "user",
"user_id": "user_..."
},
"at": "2025-03-14T21:08:41+00:00",
"target": {
"github_profile_id": "...",
"type": "github_profile_id"
},
"tenant_id": "tenant_..."
}github.profile.delete
A GitHub runner profile has been deleted.
{
"action": "github.profile.delete",
"actor": {
"email": "foobar@example.com",
"type": "user",
"user_id": "user_..."
},
"at": "2025-03-14T21:08:41+00:00",
"target": {
"github_profile_id": "...",
"type": "github_profile_id"
},
"tenant_id": "tenant_..."
}github.profile.update
A GitHub runner profile has been updated.
{
"action": "github.profile.update",
"actor": {
"email": "foobar@example.com",
"type": "user",
"user_id": "user_..."
},
"at": "2025-03-14T21:08:41+00:00",
"target": {
"github_profile_id": "...",
"type": "github_profile_id"
},
"tenant_id": "tenant_..."
}instance.destroy
An instance was destroyed.
{
"action": "instance.destroy",
"actor": {
"email": "foobar@example.com",
"type": "user",
"user_id": "user_..."
},
"at": "2025-03-14T21:08:41+00:00",
"target": {
"instance_id": "...",
"type": "instance"
},
"tenant_id": "tenant_..."
}instance.ssh
An SSH session was initiated with a workspace instance.
{
"action": "instance.ssh",
"actor": {
"email": "foobar@example.com",
"type": "user",
"user_id": "user_..."
},
"at": "2025-03-14T21:08:41+00:00",
"target": {
"instance_id": "...",
"type": "instance"
},
"tenant_id": "tenant_..."
}volume.release
Emitted when a volume is released by an actor, e.g. by pressing [Release] in the Web application.
{
"action": "volume.release",
"actor": {
"email": "foobar@example.com",
"type": "user",
"user_id": "user_..."
},
"at": "2025-03-14T21:08:41+00:00",
"attributes": {
"tag": "my-volume"
},
"tenant_id": "tenant_..."
}workspace.membership.add
A user has been added to the workspace.
{
"action": "workspace.membership.add",
"actor": {
"email": "foobar@example.com",
"type": "user",
"user_id": "user_..."
},
"at": "2025-03-14T21:08:41+00:00",
"attributes": {
"role": "READER"
},
"target": {
"email": "quux@example.com",
"type": "user",
"user_id": "user_..."
},
"tenant_id": "tenant_..."
}workspace.membership.remove
A user has been removed from the workspace.
{
"action": "workspace.membership.remove",
"actor": {
"email": "foobar@example.com",
"type": "user",
"user_id": "user_..."
},
"at": "2025-03-14T21:08:41+00:00",
"attributes": {
"role": "READER"
},
"target": {
"email": "quux@example.com",
"type": "user",
"user_id": "user_..."
},
"tenant_id": "tenant_..."
}workspace.membership.update
The role of a workspace member was changed.
{
"action": "workspace.membership.update",
"actor": {
"email": "foobar@example.com",
"type": "user",
"user_id": "user_..."
},
"at": "2025-03-14T21:08:41+00:00",
"attributes": {
"role": "ADMIN"
},
"target": {
"email": "quux@example.com",
"type": "user",
"user_id": "user_..."
},
"tenant_id": "tenant_..."
}workspace.ownership.transfer
Ownership of a Workspace has been transferred to a different user
{
"action": "workspace.ownership.transfer",
"actor": {
"email": "foobar@example.com",
"type": "user",
"user_id": "user_..."
},
"at": "2025-03-14T21:08:41+00:00",
"attributes": {
"previous_owner": {
"email": "old-owner@example.com",
"type": "user",
"user_id": "user..."
}
},
"target": {
"email": "quux@example.com",
"type": "user",
"user_id": "user_..."
},
"tenant_id": "tenant_..."
}workspace.token.emit
An authorization token has been emitted for the workspace, e.g. a user signed in.
{
"action": "workspace.token.emit",
"actor": {
"email": "foobar@example.com",
"type": "user",
"user_id": "user_..."
},
"at": "2025-03-14T21:08:41+00:00",
"attributes": {
"duration": "600s"
},
"tenant_id": "tenant_..."
}workspace.update
The Workspace configuration was updated.
{
"action": "workspace.update",
"actor": {
"email": "foobar@example.com",
"type": "user",
"user_id": "user_..."
},
"at": "2025-03-14T21:08:41+00:00",
"attributes": {
"name": "New Workspace Name"
},
"tenant_id": "tenant_..."
}