Yandex Audit Trails event reference
Written by
Updated at August 5, 2026
Audit Trails supports monitoring of both control plane (configuration level) and data plane (service level) events for Yandex Security Deck.
The general format of the event_type value is as follows:
yandex.cloud.audit.securitydeck.<module_name><event_name>
Control plane event reference
Cloud Security Posture Management (CSPM)
Module name: cspm.
| Event name | Description |
|---|---|
CreateScanJob |
Creating a scan job |
CreateScopeFilter |
Creating a scope filter |
DeleteScanJob |
Deleting a scan job |
DeleteScopeFilter |
Deleting a scope filter |
UpdateScanJob |
Updating a scan job |
UpdateScopeFilter |
Updating a scope filter |
Data Security Posture Management (DSPM)
Module name: dspm.
| Event name | Description |
|---|---|
ExportDiscoveryResults |
Exporting data discovery results |
Kubernetes® Security Posture Management (KSPM)
Module name: kspm.
| Event name | Description |
|---|---|
CreateException |
Creating an exception |
CreateProject |
Creating a project |
DeleteException |
Deleting an exception |
DeleteProject |
Deleting a project |
EnableProject |
Enabling a project |
EnableSDProject |
Enabling a Security Deck project |
UpdateException |
Updating exception parameters |
UpdateProject |
Updating project parameters |
UpdateProjectControl |
Updating project control settings |
Alerts module
Module name: alerts.
| Event name | Description |
|---|---|
CreateAlertSink |
Creating an alert sink |
DeleteAlertSink |
Deleting an alert sink |
UpdateAlertSink |
Updating an alert sink |
Security Deck workspaces
Module name: orchestrator.
| Event name | Description |
|---|---|
CreateConnector |
Creating a connector |
CreateScope |
Creating a scope |
CreateWorkspace |
Creating a workspace |
DeleteConnector |
Deleting a connector |
DeleteScope |
Deleting a scope |
DeleteWorkspace |
Delete the environments. |
UpdateConnector |
Updating a connector |
UpdateScope |
Updating a scope |
UpdateWorkspace |
Updating a workspace |
Data plane event reference
Access Transparency module
Module name: accesstransparency.
| Event name | Description |
|---|---|
ComputeNodeAccess |
Connecting the Access Transparency module to the Yandex Data Processing subcluster |
MDBClusterAccess |
Connecting the Access Transparency module to a database cluster |
Cloud Security Posture Management (CSPM)
Module name: cspm.
| Event name | Description |
|---|---|
AssetFailedRuleCheck |
CSPM failed object check report |
AssetPassedRuleCheck |
CSPM passed object check report |
AssetRuleCheckCouldNotBeExecuted |
CSPM object check error report |
AssetRuleCheckNoLongerInScope |
CSPM report about excluding a rule from a scope |
Kubernetes® Security Posture Management (KSPM)
Module name: kspm.
| Event name | Description |
|---|---|
AddCluster |
Adding a cluster |
DeleteCluster |
Deleting a cluster |
TriggerAdmissionControl |
Triggering of KSPM when checking newly created and updated resources |
TriggerInventoryControlBatch |
Triggering of KSPM when checking the configuration |
TriggerInventoryControlEvent |
Triggering of KSPM when checking the configuration by event |
TriggerInventoryControlSnapshot |
Triggering of KSPM when checking the configuration by snapshot |
TriggerRuntimeControl |
Triggering of KSPM when monitoring workload security |
TriggerRuntimeProcessInfo |
Triggering of KSPM when getting process information |
Alerts module
Module name: alerts.
| Event name | Description |
|---|---|
CreateAlert |
Creating an alert |