Yandex Audit Trails event reference
Written by
Updated at January 13, 2026
Audit Trails supports tracking control plane and data plane events for Yandex Security Deck.
The general format of the event_type field value is as follows:
yandex.cloud.audit.securitydeck.<module_name><event_name>
Control plane event reference
Kubernetes® Security Posture Management (KSPM)
Module name: kspm.
| Event name | Description |
|---|---|
CreateException |
Creating an exception |
CreateProject |
Creating a project |
DeleteException |
Deleting an exception |
DeleteProject |
Deleting a project |
EnableProject |
Enabling a project |
EnableSDProject |
Enabling a Security Deck project |
UpdateException |
Updating exception parameters |
UpdateProject |
Updating project parameters |
Cloud Security Posture Management (CSPM)
Module name: cspm.
| Event name | Description |
|---|---|
CreateScanJob |
Creating a scan job |
CreateScopeFilter |
Creating a scope filter |
DeleteScanJob |
Deleting a scan job |
DeleteScopeFilter |
Deleting a scope filter |
UpdateScanJob |
Updating a scan job |
UpdateScopeFilter |
Updating a scope filter |
Security Deck workspaces
Module name: orchestrator.
| Event name | Description |
|---|---|
CreateConnector |
Creating a connector |
CreateScope |
Creating a scope |
CreateWorkspace |
Creating a workspace |
DeleteConnector |
Deleting a connector |
DeleteScope |
Deleting a scope |
DeleteWorkspace |
Delete the environments. |
UpdateConnector |
Updating a connector |
UpdateScope |
Updating a scope |
UpdateWorkspace |
Updating a workspace |
Data plane event reference
Access Transparency module
Module name: accesstransparency.
| Event name | Description |
|---|---|
ComputeNodeAccess |
Connecting the Access Transparency module to the Yandex Data Processing subcluster |
MDBClusterAccess |
Connecting the Access Transparency module to a database cluster |
Alerts module
Module name: alerts.
| Event name | Description |
|---|---|
CreateAlert |
Creating an alert |
Kubernetes® Security Posture Management (KSPM)
Module name: kspm.
| Event name | Description |
|---|---|
TriggerAdmissionControl |
Triggering of KSPM when checking newly created and updated resources |
TriggerRuntimeControl |
Triggering of KSPM when monitoring workload security |