Collect security logs

ThoughtSpot Cloud provides security audit events related to account activities and user actions within ThoughtSpot. These events can help your SOC team detect potential security threats or compromised user accounts in your organization.

How to fetch security events

To fetch security events from ThoughtSpot, you can push the logs to your SIEM server, or pull the logs using the Audit Logs API.

Push to your SIEM server

ThoughtSpot’s human-readable and comprehensive events can be shipped to your SIEM application in near real-time. Security events remain within the system for 30 days. To integrate with your SIEM or view these logs, contact ThoughtSpot Support.

ThoughtSpot also supports log ingestion to the customer SIEM system. We support multiple output plugins which can be configured to push the security audit events to the configured destination SIEM server at an interval of every 5 seconds.

ThoughtSpot supports the following output plugin options:

  • HTTP

  • Splunk

  • Azure Log Analytics

  • Datadog

Pull via Audit Logs API

The ThoughtSpot log API service allows you to programmatically get security audit events from the ThoughtSpot system. To use this API, make sure you have admin user privileges.

For more information, see Audit logs API.

ThoughtSpot security events

ThoughtSpot security events include the following information:

  • An event ID

  • A unique description of the event (for example, “A user account was created”)

  • Timestamp (in UTC) yyyy/mm/dd:hh:mm:ss

  • User ID of the person initiating the event

  • public IP of the system from which the request originates

  • Fields specific to the event (for example, name of the new account)

Event descriptions

ThoughtSpot defines these events as follows:

ACCOUNT_LOCKED

A local user fails to authenticate x times in a row, locking the account. Administrators can configure the number of authentication attempts before lockout within ThoughtSpot.

AUTH_TOKEN_CREATED_SUCCESSFULLY

Auth token creation succeeds.

CREATE_ANSWER

A user attempts to create a new Answer.

CREATE_CONNECTION

Connection created.

CREATE_CONNECTION_ATTEMPTED

Create connection attempted.

CREATE_PINBOARD

A user attempts to create a new Liveboard.

CREATE_RLS_RULE

A user creates an RLS (row-level-security) rule on a table.

CREATE_TABLES

A user attempts to create a new table.

CSV_UPLOAD_FINISHED

CSV upload finishes.

CSV_UPLOAD_STARTED

CSV upload starts.

DATA_UPLOAD_CONFIGURED

Data upload configured for a connection.

DELETE_ANSWERS

A user attempts to delete an Answer.

DELETE_CONNECTION

Connection deleted.

DELETE_CONNECTION_ATTEMPTED

Connection deletion attempted.

DELETE_PINBOARDS

A user attempts to delete a Liveboard.

DELETE_RLS_RULES

A user deletes an RLS rule on a table.

EDIT_CONNECTION

Connection edited.

EDIT_CONNECTION_ATTEMPTED

Connection edit attempted.

FAILED_TO_CREATE_AUTH_TOKEN

Auth token creation fails.

LOGIN_FAILED

A user fails to log in due to an incorrect password, or IDP/ADP deny the authentication request.

LOGIN_SUCCESSFUL

A local, IDP or AD user logs in to ThoughtSpot.

LOGOUT_FAILED

User logout failed.

LOGOUT_SUCCESSFUL

A user logs out from ThoughtSpot.

PRINCIPALS_IN_GROUP_UPDATE

A user successfully or unsuccessfully attempts to add or remove users or groups from a group.

PRIVILEGE_CHANGES

A user adds or removes one or several privileges from a group.

ROLE_CREATED

Role creation attempted.

ROLE_DELETED

Role deletion attempted.

ROLE_UPDATED

Role update attempted.

ROLES_ASSIGNED

Roles assignment to group attempted.

ROLES_IMPORTED

Roles import attempted.

ROLES_REMOVED

Removal of roles from group attempted.

SHARE_OBJECTS

A user successfully or unsuccessfully attempts to share an object (Liveboard, Worksheet, Answer) with another user or group. The "discoverability" field indicates whether a shared object is discoverable to users of the same user group as the author who have access to the underlying data source.

UPDATE_ANSWERS

A user attempts to modify an existing Answer.

UPDATE_PASSWORD

A user successfully or unsuccessfully attempts to change their password.

UPDATE_PASSWORD_FAILED

A user fails to update their password.

UPDATE_PINBOARDS

A user attempts to modify an existing Liveboard.

UPDATE_RLS_RULE

A user modifies an RLS rule on a table.

USER_ACTIVATE

A user attempts to activate their account.

USER_GROUPS_CREATED

A user creates a new group, either manually through the Admin Portal, or through the internal API.

USER_GROUPS_DELETED

A user deletes a group, either manually through the Admin Portal, or through the internal API.

USER_GROUP_MODIFIED

A user modifies the properties of a group, either in Admin Portal or over internal API. (Properties include group name, display name, and sharing visibility.)

USERS_CREATED

A new user creates an account, either manually in the Admin Portal or through the internal API.

USERS_DELETED

A user account is deleted, either manually in the Admin Portal or through the internal API.

USERS_MODIFIED

A user profile changes, either manually in the Admin Portal or over SAML sync.

Event descriptions

TRIAL_USER_CREATE

A user successfully or unsuccessfully attempts to create a Free Trial account.

TRIAL_USER_DELETE

A user successfully or unsuccessfully attempts to delete a Free Trial account.

TRIAL_USER_END

A user attempts to end their trial.

TRIAL_USER_EXPIRE

A Free Trial account expires.

TRIAL_USER_EXTEND

A user attempts to extend their trial.

USER_INVITED

A user is invited to ThoughtSpot for a free trial.

Event descriptions

TEAM_CHANGE_SUBSCRIPTION

The team subscription changes.

TEAMS_EDITION_USER_DELETE

A Team Edition user successfully or unsuccessfully attempts to delete an account.

TEAM_EDITION_USER_EXPIRE

A Team Edition user account expires.

USER_CHANGE_SUBSCRIPTION

A user attempts to change a subscription.

Event descriptions

ORG_ACCESS_GRANTED_TO_USER

User added to an Org.

ORG_CREATION_FAILED

Org creation failed.

ORG_CREATION_SUCCESSFUL

Successfully created an Org.

ORG_DELETION_FAILED

Org deletion failed.

ORG_DELETION_SUCCESSFUL

Successfully deleted an Org.

ORG_SWITCH_FAILED

Failed to switch Org for user.

ORG_SWITCH_SUCCESSFUL

Successfully switched Org.