Audit events
Every event type 3AM writes to its audit log, by family, with when it is written. Search them in the console or follow them from your SIEM.
Everything 3AM does is recorded as an event before it has any effect. Each event has seq (gap-free), ts
(UTC), type, actor (orchestrator, system1, narrator, connector:<name>, console:<person>, keychain, …),
trace_id (the incident), reason (one sentence), data, and the hash chain (prev, hash). Free text is redacted
(passwords, tokens, keys, card numbers) before it's written. Search: type:keychain.* in the
query language; export: GET /v1/ledger?after_seq=N.
| Family | Types | Written when |
|---|---|---|
| Signals | signal.received, signal.pushed, signal.baseline, signal.correlated, signal.resolved, signal.source_failed, signal.source_recovered | An alert arrives (polled or pushed); was already firing at start; joins an open incident; stops; a source fails or recovers |
| Incidents | incident.opened, incident.joined, incident.split, episode.opened, episode.queued, episode.started, episode.closed, episode.recurrence, episode.cause_cleared, episode.failed, episode.abandoned, notify.throttled | Grouping, with its reasons; priority and its terms; open and close; the same failure returning; a cause that no longer holds; a crash; a stop mid-investigation |
| Investigation | flow.node, flow.failed, investigation.step, investigation.branch, evidence.gathered, rca.impact, rca.hypotheses | Each method and the edge taken; the investigator's steps; tree-search branches; the alert's own questions; impact; the differential |
| Checks | check.ground, check.result, check.verdict, check.chronic, check.pack_woken | A round of pack checks; each check with its query and raw result; each cause's verdict; already true before the incident; a pack woken by an alert |
| What changed | snapshot.changed, snapshot.failed | Facts that changed; a connector that couldn't describe itself |
| Models | model.call, model.failed, model.budget_exhausted | Every call (model, redacted prompt and its SHA-256, output, tokens, latency); the daily budget spent |
| Knowledge | knowledge.search, knowledge.sync, knowledge.sync_all, knowledge.sync_failed, knowledge.dense, knowledge.forget, retrieval.runbooks, retrieval.failed | Repositories searched or synced; runbook excerpts |
| Decisions | decision.made, decision.policy, decision.blocked, decision.classified, decision.autonomous | The decision and why; policy's verdict; the ActionEvaluator's tier; a safe action run unasked |
| Resolution | resolution.state, action.autonomous, outcome.mitigation, restore.suggested, action.reversed, handover.sent | Every loop transition; a mitigation before proof and whether it worked; a restore move suggested, or taken back; the 90-second triage |
| Drafted fixes | fix.drafted, fix.draft_refused | A drafted fix (origin, proposal, inverse, caveats), or why none |
| Approvals | approval.requested, approval.escalated, approval.decided, approval.closed, approval.withdrawn, approval.impossible, approval.channel_failed, approval.resumed | Sent; escalated; decided; closed (approved, rejected, expired, withdrawn, abandoned); refused because the quorum can't be reached; a channel failed; carried across a restart |
| Actions | action.dry_run, action.executed, outcome.verified | The rehearsal, the execution, whether the cause cleared |
| Changes and tickets | change.opened, change.closed, change.failed, change.lookup_failed, ticket.queued, ticket.flushed, ticket.replayed, ticket.failed, connector.annotate_failed | Change records; ticket updates (queued while the system is down, replayed in order); notes written back on pages |
| Learning | learning.labelled, learning.pattern, learning.reviewed, learning.failed | A diagnosis labelled; a pattern learned; an admin's review |
| Study and lookback | study.started, study.finished, study.stop_requested, study.failed, lookback.done | A study; a lookback's counts |
| Configuration | config.connector_saved, config.connector_removed, config.policy_saved, config.reloaded, config.packs_loaded, config.autonomy_requested, config.autonomy_changed, config.autonomy_refused, config.fix_mode_requested, config.fix_mode_changed, config.fix_mode_refused, config.halted, config.resumed, config.licence_*, config.licence_candidate, config.branding_saved, config.estate_overrides_saved, config.dependency_dismissed, config.ssh_key_generated, config.ssh_hostkey_scanned, config.mail_saved, config.mail_tested | Any setting changed: before, after, by whom |
| People | identity.user_added, identity.user_changed, identity.user_removed, identity.team_saved, identity.team_removed, identity.signed_in, identity.code_sent, identity.code_failed, identity.code_wrong, identity.code_ignored, identity.code_refused, identity.code_rate_limited, identity.access_changed, identity.break_glass, identity.token_sign_in_refused, identity.password_set, identity.password_removed, identity.password_wrong, identity.directory_synced, human.action, human.licence_check_requested | People and teams; sign-in; break-glass; the directory; what a person did; a licence check someone asked for |
| Licence and installs | system.licence_checked, system.licence_in_grace, system.licence_lapsed, system.licence_limit, system.licence_rejected, system.licence_services_held, licence.install_vouched, licence.install_removal | Checks, grace, lapses, limits, refusals; services held beyond the limit; installs added or taken off |
| Keychain | keychain.home, keychain.window, keychain.member_paired, keychain.member_enrolled, keychain.member_removed, keychain.joined, keychain.enrolled, keychain.left, keychain.applied, keychain.sealed, keychain.refused, keychain.site_keys, keychain.site_key_revoked, keychain.auto_vouch_failed, keychain.scope, keychain.override, keychain.override_dropped, keychain.renamed, keychain.handover_offered, keychain.handover_cancelled, keychain.home_handed_over, keychain.home_received, keychain.home_moved, keychain.home_taken_over, keychain.member_silent, keychain.member_gone, keychain.member_back, keychain.home_silent, keychain.home_gone, keychain.home_back, keychain.pairing_cancelled | Keychain |
| Security | security.install_code_mismatch, security.install_log_fork, security.keychain_code_mismatch, security.keychain_site_key_refused, security.keychain_wrong_home, security.keychain_bad_handover | Digits that didn't match; a forked install history; a refused site key; the wrong home; a forged handover |
| System | system.start, system.stop, system.runtime, system.error, system.admin_token_created, system.ml_artifact_refused, estate.built, digest.written | Start and stop, the runtime built, errors, the admin token, an unsigned ML artifact; the estate; the digest |
| Connectors | connector.call, connector.check, connector.down | Every connector call (secret arguments masked); a check; a source that didn't answer in 20 s |
Security and licence events also go to syslog as JSON (THREEAM_SYSLOG, Environment).