Yandex Audit Trails event reference
Written by
Updated at April 29, 2026
Audit Trails supports monitoring of both control plane (configuration level) and data plane (service level) events for Yandex Security Deck.
The general format of the event_type value is as follows:
yandex.cloud.audit.securitydeck.<module_name><event_name>
Control plane event reference
Cloud Security Posture Management (CSPM)
Module name: cspm.
| Event name | Description |
|---|---|
CreateScanJob |
Creating a scan job |
CreateScopeFilter |
Creating a scope filter |
DeleteScanJob |
Deleting a scan job |
DeleteScopeFilter |
Deleting a scope filter |
UpdateScanJob |
Updating a scan job |
UpdateScopeFilter |
Updating a scope filter |
Kubernetes® Security Posture Management (KSPM)
Module name: kspm.
| Event name | Description |
|---|---|
CreateException |
Creating an exception |
CreateProject |
Creating a project |
DeleteException |
Deleting an exception |
DeleteProject |
Deleting a project |
EnableProject |
Enabling a project |
EnableSDProject |
Enabling a Security Deck project |
UpdateException |
Updating exception parameters |
UpdateProject |
Updating project parameters |
Alerts module
Module name: alerts.
| Event name | Description |
|---|---|
CreateAlertSink |
Creating an alert sink |
DeleteAlertSink |
Deleting an alert sink |
UpdateAlertSink |
Updating an alert sink |
Security Deck workspaces
Module name: orchestrator.
| Event name | Description |
|---|---|
CreateConnector |
Creating a connector |
CreateScope |
Creating a scope |
CreateWorkspace |
Creating a workspace |
DeleteConnector |
Deleting a connector |
DeleteScope |
Deleting a scope |
DeleteWorkspace |
Delete the environments. |
UpdateConnector |
Updating a connector |
UpdateScope |
Updating a scope |
UpdateWorkspace |
Updating a workspace |
Data plane event reference
Access Transparency module
Module name: accesstransparency.
| Event name | Description |
|---|---|
ComputeNodeAccess |
Connecting the Access Transparency module to the Yandex Data Processing subcluster |
MDBClusterAccess |
Connecting the Access Transparency module to a database cluster |
Cloud Security Posture Management (CSPM)
Module name: cspm.
| Event name | Description |
|---|---|
AssetFailedRuleCheck |
CSPM failed object check report |
AssetPassedRuleCheck |
CSPM passed object check report |
AssetRemovedFromScope |
CSPM object removed from scope report |
AssetRuleCheckCouldNotBeExecuted |
CSPM object check error report |
Kubernetes® Security Posture Management (KSPM)
Module name: kspm.
| Event name | Description |
|---|---|
TriggerAdmissionControl |
Triggering of KSPM when checking newly created and updated resources |
TriggerRuntimeControl |
Triggering of KSPM when monitoring workload security |
TriggerRuntimeProcessInfo |
Triggering of KSPM when getting process information |
Alerts module
Module name: alerts.
| Event name | Description |
|---|---|
CreateAlert |
Creating an alert |