Audit Events Reference

Event	Workflow	Metadata
alert_received	Alert investigation	Incident ID, event ID, and affected entity.
context_retrieved	Reasoning Run	Retrieval count and bounded context metadata.
skill_selected	Reasoning Run	Selected skill name and host selection source.
tool_call	Chat, OpenAI chat, alert, or bot	Tool name and optional bounded error code.
investigation_result	Alert investigation	Finding status, actionability, confidence, and evidence count.
notification_delivery	Alert investigation	Receiver name/type, delivery ID, status code, and stable error code; no payload, response body, or secret.
bot_reply	Telegram or Mattermost bot Run	Receiver/type, delivery ID, status code, and stable error code; no message text or provider secret.
proposal	Change preview	Changed-file count and whether approval is required.
workspace_apply	Change apply	Changed-file count.

Event status records host outcome. Metadata keys containing authorization, API-key, password, secret, or token terms are discarded. Maps are limited to 32 entries; string values and errors are limited to 512 Unicode code points; each JSONL record is limited to 256 KiB.