# Audit events > Every event type 3AM writes to its audit log, by family, with when it is written. Search them in the console or follow them from your SIEM. Source: https://docs.3am.si/reference/audit-events · Markdown: https://docs.3am.si/reference/audit-events.md · All docs: https://docs.3am.si/llms.txt 3AM is an on-prem AI on-call engineer for regulated enterprises (https://3am.si). Everything 3AM does is recorded as an event **before** it has any effect. Each event has `seq` (gap-free), `ts` (UTC), `type`, `actor` (`orchestrator`, `system1`, `narrator`, `connector:`, `console:`, `keychain`, …), `trace_id` (the incident), `reason` (one sentence), `data`, and the hash chain (`prev`, `hash`). Free text is redacted (passwords, tokens, keys, card numbers) before it's written. Search: `type:keychain.*` in the [query language](https://docs.3am.si/reference/query-language); export: `GET /v1/ledger?after_seq=N`. | Family | Types | Written when | | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Signals | `signal.received`, `signal.pushed`, `signal.baseline`, `signal.correlated`, `signal.resolved`, `signal.source_failed`, `signal.source_recovered` | An alert arrives (polled or pushed); was already firing at start; joins an open incident; stops; a source fails or recovers | | Incidents | `incident.opened`, `incident.joined`, `incident.split`, `episode.opened`, `episode.queued`, `episode.started`, `episode.closed`, `episode.recurrence`, `episode.cause_cleared`, `episode.failed`, `episode.abandoned`, `notify.throttled` | Grouping, with its reasons; priority and its terms; open and close; the same failure returning; a cause that no longer holds; a crash; a stop mid-investigation | | Investigation | `flow.node`, `flow.failed`, `investigation.step`, `investigation.branch`, `evidence.gathered`, `rca.impact`, `rca.hypotheses` | Each method and the edge taken; the investigator's steps; tree-search branches; the alert's own questions; impact; the differential | | Checks | `check.ground`, `check.result`, `check.verdict`, `check.chronic`, `check.pack_woken` | A round of pack checks; each check with its query and raw result; each cause's verdict; already true before the incident; a pack woken by an alert | | What changed | `snapshot.changed`, `snapshot.failed` | Facts that changed; a connector that couldn't describe itself | | Models | `model.call`, `model.failed`, `model.budget_exhausted` | Every call (model, redacted prompt and its SHA-256, output, tokens, latency); the daily budget spent | | Knowledge | `knowledge.search`, `knowledge.sync`, `knowledge.sync_all`, `knowledge.sync_failed`, `knowledge.dense`, `knowledge.forget`, `retrieval.runbooks`, `retrieval.failed` | Repositories searched or synced; runbook excerpts | | Decisions | `decision.made`, `decision.policy`, `decision.blocked`, `decision.classified`, `decision.autonomous` | The decision and why; policy's verdict; the ActionEvaluator's tier; a safe action run unasked | | Resolution | `resolution.state`, `action.autonomous`, `outcome.mitigation`, `restore.suggested`, `action.reversed`, `handover.sent` | Every loop transition; a mitigation before proof and whether it worked; a restore move suggested, or taken back; the 90-second triage | | Drafted fixes | `fix.drafted`, `fix.draft_refused` | A drafted fix (origin, proposal, inverse, caveats), or why none | | Approvals | `approval.requested`, `approval.escalated`, `approval.decided`, `approval.closed`, `approval.withdrawn`, `approval.impossible`, `approval.channel_failed`, `approval.resumed` | Sent; escalated; decided; closed (approved, rejected, expired, withdrawn, abandoned); refused because the quorum can't be reached; a channel failed; carried across a restart | | Actions | `action.dry_run`, `action.executed`, `outcome.verified` | The rehearsal, the execution, whether the cause cleared | | Changes and tickets | `change.opened`, `change.closed`, `change.failed`, `change.lookup_failed`, `ticket.queued`, `ticket.flushed`, `ticket.replayed`, `ticket.failed`, `connector.annotate_failed` | Change records; ticket updates (queued while the system is down, replayed in order); notes written back on pages | | Learning | `learning.labelled`, `learning.pattern`, `learning.reviewed`, `learning.failed` | A diagnosis labelled; a pattern learned; an admin's review | | Study and lookback | `study.started`, `study.finished`, `study.stop_requested`, `study.failed`, `lookback.done` | A study; a lookback's counts | | Configuration | `config.connector_saved`, `config.connector_removed`, `config.policy_saved`, `config.reloaded`, `config.packs_loaded`, `config.autonomy_requested`, `config.autonomy_changed`, `config.autonomy_refused`, `config.fix_mode_requested`, `config.fix_mode_changed`, `config.fix_mode_refused`, `config.halted`, `config.resumed`, `config.licence_*`, `config.licence_candidate`, `config.branding_saved`, `config.estate_overrides_saved`, `config.dependency_dismissed`, `config.ssh_key_generated`, `config.ssh_hostkey_scanned`, `config.mail_saved`, `config.mail_tested` | Any setting changed: before, after, by whom | | People | `identity.user_added`, `identity.user_changed`, `identity.user_removed`, `identity.team_saved`, `identity.team_removed`, `identity.signed_in`, `identity.code_sent`, `identity.code_failed`, `identity.code_wrong`, `identity.code_ignored`, `identity.code_refused`, `identity.code_rate_limited`, `identity.access_changed`, `identity.break_glass`, `identity.token_sign_in_refused`, `identity.password_set`, `identity.password_removed`, `identity.password_wrong`, `identity.directory_synced`, `human.action`, `human.licence_check_requested` | People and teams; sign-in; break-glass; the directory; what a person did; a licence check someone asked for | | Licence and installs | `system.licence_checked`, `system.licence_in_grace`, `system.licence_lapsed`, `system.licence_limit`, `system.licence_rejected`, `system.licence_services_held`, `licence.install_vouched`, `licence.install_removal` | Checks, grace, lapses, limits, refusals; services held beyond the limit; installs added or taken off | | Keychain | `keychain.home`, `keychain.window`, `keychain.member_paired`, `keychain.member_enrolled`, `keychain.member_removed`, `keychain.joined`, `keychain.enrolled`, `keychain.left`, `keychain.applied`, `keychain.sealed`, `keychain.refused`, `keychain.site_keys`, `keychain.site_key_revoked`, `keychain.auto_vouch_failed`, `keychain.scope`, `keychain.override`, `keychain.override_dropped`, `keychain.renamed`, `keychain.handover_offered`, `keychain.handover_cancelled`, `keychain.home_handed_over`, `keychain.home_received`, `keychain.home_moved`, `keychain.home_taken_over`, `keychain.member_silent`, `keychain.member_gone`, `keychain.member_back`, `keychain.home_silent`, `keychain.home_gone`, `keychain.home_back`, `keychain.pairing_cancelled` | [Keychain](https://docs.3am.si/licensing/keychain) | | Security | `security.install_code_mismatch`, `security.install_log_fork`, `security.keychain_code_mismatch`, `security.keychain_site_key_refused`, `security.keychain_wrong_home`, `security.keychain_bad_handover` | Digits that didn't match; a forked install history; a refused site key; the wrong home; a forged handover | | System | `system.start`, `system.stop`, `system.runtime`, `system.error`, `system.admin_token_created`, `system.ml_artifact_refused`, `estate.built`, `digest.written` | Start and stop, the runtime built, errors, the admin token, an unsigned ML artifact; the estate; the digest | | Connectors | `connector.call`, `connector.check`, `connector.down` | Every connector call (secret arguments masked); a check; a source that didn't answer in 20 s | Security and licence events also go to syslog as JSON (`THREEAM_SYSLOG`, [Environment](https://docs.3am.si/reference/environment#syslog-and-siem)).