Activity Log

In Tenable's cloud platform, all user events for your organization are recorded in the activity log. This log provides a comprehensive list of events, including when each activity occurred, the action taken, the actor, and other relevant details. To programmatically retrieve these events, use the View activity log endpoint. For more information, see Activity Logs in the Tenable Vulnerability Management User Guide.

📘

Note

Tenable retains activity log data for three years, after which it is permanently deleted from the database.

Example Activity Log

The following is an example of an activity log event entry. Each entry includes the action that triggered the event, the actor, and relevant metadata. The description property specifies the API endpoint that initiated the event.

{
  "id": "bcce3e2fbbe04019a07da098b13e1ad5",
  "action": "audit.log.view",
  "crud": "r",
  "actor": {
    "id": "e23d99b9-e5ae-459e-a8e1-3971bb5e8e40",
    "name": "[email protected]"
  },
  "target": {
    "id": null,
    "name": null,
    "type": null
  },
  "description": "GET /audit-log/v1/events",
  "is_anonymous": null,
  "is_failure": null,
  "fields": null,
  "received": "2025-07-09T16:43:46.904Z"
}

How Actions Are Generated

Understanding how activity log event actions are constructed can help you interpret log entries more effectively. Actions are typically generated based on the API endpoint called and the HTTP method used. For example, if you send a POST request to the /scans endpoint to create a new scan, the activity log records the action as scans.create.

In general, the action follows the format {resource}.{operation}, where the operation corresponds to the HTTP method:

• POST → create
• PUT → update
• PATCH → update
• DELETE → delete
• GET → read

Where an endpoint path contains several segments, the resource portion joins those segments with hyphens and omits identifiers and version prefixes. A DELETE request to /scanners/{scanner_id}/agents/{agent_id} therefore records the action as scanners-agents.delete, and a PUT request to /scanners/{scanner_id}/agent-groups/{group_id}/agents/{agent_id} records scanners-agent-groups-agents.update.

Some actions do not follow the pattern, so use the tables below rather than deriving an action name when one is available. For example, launching a scan records scans.launch rather than scans.create.

Common Event Actions and Descriptions

The following tables highlight common activity log events, along with descriptions to help you understand what each event represents.

User and Session Events

Activity log events related to user administration and authentication:

Agent and Sensor Events

Activity log events related to Tenable Agents, scanners, and sensors:

Export Events

Activity log events related to data export actions: