From 6da3d8b1959659e034f78307e6c14b30bf3fcd8e Mon Sep 17 00:00:00 2001 From: Melinda Moreland Date: Thu, 27 Aug 2026 16:51:48 -0700 Subject: [PATCH 1/2] docs: document OCSF actor type_id changes and new event classes Adds a breaking-change note for the upcoming actor.user.type_id remap (admin vs. user, service vs. other), plus docs for the new unmapped.audience field and four new Identity & Access event classes. --- product/admin/system-log.mdx | 39 +++++++++++++++++++++++++++++++++++- 1 file changed, 38 insertions(+), 1 deletion(-) diff --git a/product/admin/system-log.mdx b/product/admin/system-log.mdx index 1a88a58f..f8003a90 100644 --- a/product/admin/system-log.mdx +++ b/product/admin/system-log.mdx @@ -5,7 +5,7 @@ og:description: Export system log data on every call made to the C1 API description: Access C1 system log via API or export log data for storage or usage in SIEM. sidebarTitle: System logs --- -{/* Editor Refresh: 2026-01-07 */} +{/* Editor Refresh: 2026-08-27 */} ## What's included in C1 system logs? @@ -97,4 +97,41 @@ C1 system logs use the Open Cybersecurity Schema Framework (OCSF) to format log - "activity_id":3 - "Update" activity - "activity_id":4 - "Delete" activity +### Actor type classification + + +**Breaking change, effective [RELEASE DATE]:** two `actor.user.type_id` values below are changing for events generated from that date forward. If your queries or automation filter on these values, update them before this date. Events logged before [RELEASE DATE] aren't affected. + + +The `actor.user.type_id` field identifies what kind of actor triggered an event. + +| type_id | Meaning | Notes | +| :--- | :--- | :--- | +| 1 | User | Non-administrator human actor | +| 2 | Admin | Human actor holding an administrator-tier role. New as of [RELEASE DATE] — previously logged as `1`, the same as non-admin users. | +| 4 | Service | Machine or service identity. As of [RELEASE DATE], replaces `99`. | + +If you have queries that filter `type_id = 1` to capture all human activity, update them to `type_id IN (1, 2)`. If you have automation that filters `type_id = 99` for machine identities, switch it to `type_id = 4`, or filter on the unaffected `type` string field instead. + +Each actor's platform roles are listed by display name in `actor.user.groups[]`, with a stable `uid` for each role. + +### API operation audience + +API Activity events (`class_uid` 6003) include an `unmapped.audience` field describing who's allowed to call that operation: `basic_user`, `admin_only`, `super_admin_only`, `machine_only`, or `unassigned`. The same value is available as `audience=` in `api.request.flags`. + +### Identity & Access events + +C1 emits four Identity & Access event classes in addition to existing event types: + +| class_uid | Event type | Reports | +| :--- | :--- | :--- | +| 3001 | Account Change | User account changes, invitations | +| 3004 | Entity Management | Role definition updates | +| 3005 | User Access Management | Role and entitlement grants and revocations | +| 3006 | Group Management | Group creation and deletion | + +If your pipeline routes events by `class_uid` and has a fallthrough or default handler, make sure these four classes are handled explicitly instead of falling into that default. + +Privilege-changing operations emit a paired API Activity event and Identity & Access event that share the same `metadata.correlation_uid`, so you can join them. This means privilege-changing operations now produce two events instead of one — if you have dashboards or metrics based on event volume, scope them to avoid double-counting. + From 80d242a9ac084776569937ec401890e94dd39ecb Mon Sep 17 00:00:00 2001 From: Melinda Moreland Date: Mon, 31 Aug 2026 12:10:51 -0700 Subject: [PATCH 2/2] docs: fill in release date and close gaps in OCSF actor type docs Sets the effective date to September 3, 2026 and adds coverage for the type string change on admin actors, new class_name/category_name captions, and event-size impact on ingest metering. Co-Authored-By: Claude Sonnet 5 --- product/admin/system-log.mdx | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/product/admin/system-log.mdx b/product/admin/system-log.mdx index f8003a90..3c80a633 100644 --- a/product/admin/system-log.mdx +++ b/product/admin/system-log.mdx @@ -100,18 +100,18 @@ C1 system logs use the Open Cybersecurity Schema Framework (OCSF) to format log ### Actor type classification -**Breaking change, effective [RELEASE DATE]:** two `actor.user.type_id` values below are changing for events generated from that date forward. If your queries or automation filter on these values, update them before this date. Events logged before [RELEASE DATE] aren't affected. +**Breaking change, effective September 3, 2026:** the `actor.user.type_id` and `actor.user.type` values below are changing for events generated from that date forward. If your queries or automation filter on these values, update them before this date. Events logged before September 3, 2026 aren't affected — historical events aren't rewritten. The `actor.user.type_id` field identifies what kind of actor triggered an event. -| type_id | Meaning | Notes | -| :--- | :--- | :--- | -| 1 | User | Non-administrator human actor | -| 2 | Admin | Human actor holding an administrator-tier role. New as of [RELEASE DATE] — previously logged as `1`, the same as non-admin users. | -| 4 | Service | Machine or service identity. As of [RELEASE DATE], replaces `99`. | +| type_id | type | Meaning | Notes | +| :--- | :--- | :--- | :--- | +| 1 | `"user"` | User | Non-administrator human actor | +| 2 | `"admin"` | Admin | Human actor holding an administrator-tier role. New as of September 3, 2026 — previously logged as `type_id` `1` / `type` `"user"`, the same as non-admin users. | +| 4 | `"connector"`, `"function"`, etc. | Service | Connectors, managed connectors, functions, and tunnels. As of September 3, 2026, replaces `99` (Other) — `99` won't appear on any new event. | -If you have queries that filter `type_id = 1` to capture all human activity, update them to `type_id IN (1, 2)`. If you have automation that filters `type_id = 99` for machine identities, switch it to `type_id = 4`, or filter on the unaffected `type` string field instead. +If you have queries that filter `type_id = 1` (or `type = "user"`) to capture all human activity, update them to `type_id IN (1, 2)` (or `type IN ("user", "admin")`) — admin-tier actors now log with both values changed. If you have automation that filters `type_id = 99` for machine identities, switch it to `type_id = 4`; the `type` string values for machine actors aren't changing, so filters on those strings are unaffected. Each actor's platform roles are listed by display name in `actor.user.groups[]`, with a stable `uid` for each role. @@ -119,6 +119,8 @@ Each actor's platform roles are listed by display name in `actor.user.groups[]`, API Activity events (`class_uid` 6003) include an `unmapped.audience` field describing who's allowed to call that operation: `basic_user`, `admin_only`, `super_admin_only`, `machine_only`, or `unassigned`. The same value is available as `audience=` in `api.request.flags`. +API Activity events also now include `class_name` and `category_name` captions. + ### Identity & Access events C1 emits four Identity & Access event classes in addition to existing event types: @@ -134,4 +136,6 @@ If your pipeline routes events by `class_uid` and has a fallthrough or default h Privilege-changing operations emit a paired API Activity event and Identity & Access event that share the same `metadata.correlation_uid`, so you can join them. This means privilege-changing operations now produce two events instead of one — if you have dashboards or metrics based on event volume, scope them to avoid double-counting. +Most events are also modestly larger under the updated schema. If you meter ingest by volume, factor this in alongside the event-count changes above. +