Event Log Publication delivers your workspace's activity and audit events to your organization's Amazon S3 bucket as JSON files, in near real-time. Your security team can load them into a SIEM, and your data team into a warehouse.
It is an Enterprise and Signature feature. The first setup is done with SmartSuite, together with your network security team.
Example: a compliance team on Enterprise must show auditors who changed control records and who was granted access. It sends SmartSuite's event log to its S3 bucket and alerts in its SIEM on permission grants to the Policy Management solution.
Plan Availability | Enterprise, Signature. |
Permissions | Administrators. |
Platform | Web |
Related Reading |
Setting it up
Contact your SmartSuite customer service representative.
Agree the S3 bucket and access with your network security team.
SmartSuite turns on the feed. From then on, files arrive in your bucket in near real-time.
Note: The first configuration needs your network security team. Plan it with them before you contact SmartSuite.
What you can do with the feed
Load activity into a SIEM, such as Splunk, Datadog or Microsoft Sentinel, for threat detection and incident response.
Load events into a data warehouse, such as Snowflake, BigQuery or Redshift, for reporting.
Keep a durable, timestamped audit trail for regulatory and change management requirements.
Each file holds a JSON array of event objects. Each object is one action by a member, an automation or the system.
The fields in every event
Field. | Type. | What it holds. |
id. | String. | A unique ID for this log entry. |
account_slug. | String. | The ID of the workspace where the event happened. |
actor_email. | String. | The email of the member or automation that acted. |
solution_id. | String. | The ID of the solution. |
application_id. | String. | The ID of the table where the event happened. |
record_id. | String. | The ID of the record affected. |
activity_type. | String. | What happened. See the event types below. |
activity_at. | Timestamp. | The UTC time of the event, such as 2025-09-26T23:34:24.697Z. |
metadata. | String. | A JSON string with details for this event type. |
command_id. | String. | An internal ID that ties related actions in one transaction or automation together. |
The metadata field
The metadata changes with the event type. The richest is record_field_update, which holds:
field: the field that changed, with its slug, label and field_type.
currentValue: the new value.
previousValue: the value before the change.
automationData: the automation ID, when an automation made the change.
Examples, shortened:
record_field_update: {"field": {"slug": "s8b2a91a55", "label": "Project Status", "field_type": "statusfield"}, "currentValue": "Completed", "previousValue": "In Progress"}
solution_grant_permission: {"grantee_type": "team", "team_id": "64aef36e31e4f17d0cb2ce9e", "permission_level": "Full Access"}
comment_create: {"comment_id": "9b1d8c7b-f6a5-4e3d-2c1b-a0e9f8d7c6b5", "content_preview": "This is a new comment on the task..."}
records_export: {"format": "csv", "record_count": 250}
Event types
Event types fall into three groups: records and fields, permissions and access, and comments and email.
Records and fields
record_field_update: a field value changed. It carries the old and new values.
record_delete: a record was deleted.
record_restore: a deleted record was restored.
records_export: a member exported records, usually to CSV or Excel.
field_create: a field was added.
field_delete: a field was deleted.
field_restore: a deleted field was restored.
Permissions and access
solution_grant_permission: a member or team was given access to a solution.
solution_remove_permission: a member's or team's access to a solution was removed.
application_grant_permission: a member or team was given access to a table.
application_remove_permission: a member's or team's access to a table was removed.
Comments and email
comment_create, comment_edit and comment_delete: a comment was added, changed or deleted.
comment_resolve and comment_unresolve: a comment thread was resolved or reopened.
communication_center_email_send: an email was sent from a record through the Communication Center.
communication_center_email_reply: a reply was sent in a Communication Center thread.
communication_center_email_delete: an email was deleted from the Communication Center.
Tip: Filter on activity_type. Alert on solution_grant_permission to catch new access, and on record_field_update for critical fields.
Frequently asked questions
Which plans include Event Log Publication?
Which plans include Event Log Publication?
Event Log Publication is available on the Enterprise and Signature plans. Setup is done with your SmartSuite customer service representative.
Where are the events delivered?
Where are the events delivered?
Events are delivered as JSON files to your organization's Amazon S3 bucket, in near real-time.
Does the log show the old value of a changed field?
Does the log show the old value of a changed field?
Yes. The record_field_update event carries both previousValue and currentValue in its metadata.
Can I tell automation changes from member changes?
Can I tell automation changes from member changes?
Yes. When an automation made a change, the metadata includes automationData with the automation ID.
Need more help? Ask the SmartSuite Community, where builders, administrators and the SmartSuite team answer questions about building on SmartSuite. For your account, billing or data, select the chat button in the lower-right corner of SmartSuite to reach support.
Last verified 1 Nov 2026.