Skip to content

Commit 350db6b

Browse files
amee-sumokimsaucejpipkin1
authored
Updated the Airtable app doc (#5428)
* updated the Airtable app doc * deleted duplicate files * Update package.json and yarn.lock files * Fix package.json file * Refresh yarn.lock * revert yarn.lock * revert yarn.lock --------- Co-authored-by: Kim (Sumo Logic) <[email protected]> Co-authored-by: John Pipkin (Sumo Logic) <[email protected]> Co-authored-by: Kim Pohas <[email protected]>
1 parent f8509cb commit 350db6b

File tree

1 file changed

+82
-37
lines changed

1 file changed

+82
-37
lines changed

‎docs/integrations/saas-cloud/airtable.md‎

Lines changed: 82 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -21,57 +21,86 @@ The Airtable app allows you to:
2121

2222
The Airtable app also offers a pre-built dashboard that enables you to start monitoring your Airtable audit logs right away. The Airtable App for Sumo Logic is especially useful for organizations that must comply with regulatory requirements or maintain a high level of security. With the ability to monitor user activity and track changes in real time, you can quickly identify potential issues and respond to security incidents as they occur.
2323

24-
## Log type
24+
:::info
25+
This app includes [built-in monitors](#airtable-monitors). For details on creating custom monitors, refer to the [Create monitors for Airtable app](#create-monitors-for-airtable-app).
26+
:::
2527

26-
The Sumo Logic app for Airtable consumes Audit logs from your Airtable Enterprise account. Audit Logs track user activity and record changes made to the data in the system.
28+
## Log type
2729

28-
To understand how to access detailed records of changes made to the Airtable Enterprise account, refer to the [Airtable Audit logs](https://support.airtable.com/docs/how-to-access-enterprise-audit-logs#interpreting-audit-logs) documentation. This documentation provides information on the different types of logs that are available, how to access them, and what information they contain.
30+
This app uses Sumo Logic’s [Airtable Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/airtable-source/) to collect audit logs from the Airtable platform.
2931

3032
### Sample log messages
3133

3234
<details>
33-
<summary>Click to view the sample log message</summary>
35+
<summary>Audit Log</summary>
3436

3537
```json
3638
{
37-
"enterpriseaccountid": "entdfgc0BXGp",
38-
"originatinguserid": "usrcdagdfQ1B",
39-
"apiname": "PUBLIC_API",
40-
"apiversion": "0.1",
41-
"actionid": "acfdgdfCht9zR",
42-
"client": {
43-
"ipaddress": "100.108.203.58"
44-
},
45-
"context": {
46-
"workspaceid": null,
47-
"applicationid": null,
48-
"tableid": null
49-
},
50-
"request": {
51-
"requestid": "reqesfgstSbadd",
52-
"starttime": "2023-01-18T10:26:45.281Z",
53-
"modelclassname": "enterpriseAccount",
54-
"modelid": "entmDsrgfc0BXGp",
55-
"action": "getEnterpriseAuditLog",
56-
"parametersjson": "{\"enterpriseAuditLogTaskId\":\"ealtossregfCp47\"}"
57-
},
58-
"response": {
59-
"success": true,
60-
"message": null
61-
}
39+
"id": "01JW9KZH4EY2RTXFYFQPP5BMD5",
40+
"timestamp": "2025-05-27T19:37:15.662Z",
41+
"action": "viewBase",
42+
"payloadVersion": "1.0",
43+
"payload": {
44+
"name": "Shipping Dashboard"
45+
},
46+
"modelId": "appmKiUIu71rbi12W",
47+
"modelType": "base",
48+
"origin": {
49+
"ipAddress": "70.117.49.197",
50+
"userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Edg/136.0.0.0",
51+
"sessionId": "sapormPAliTbK05ob"
52+
},
53+
"context": {
54+
"enterpriseAccountId": "enttyhkKGivTO3Gva",
55+
"actionId": "actjW4n0Tzk7Mv5zh",
56+
"workspaceId": "wspATf36YDtiAli5y",
57+
"baseId": "appmKiZPu71rbi12W"
58+
},
59+
"actor": {
60+
"type": "user",
61+
"user": {
62+
"id": "usrq5x1aZdf567ExT",
63+
"email": "[email protected]",
64+
"name": "John"
65+
}
66+
}
6267
}
6368
```
6469
</details>
6570

6671
### Sample queries
6772

68-
```sql="Active Team Members"
69-
_sourceCategory="Labs/airtable"
70-
| Json "enterprise_account_id", "originating_user_id", "api_name", "api_version", "action_id", "client.ipaddress", "request.requestid", "request.starttime", "request.modelclassname", "request.modelid", "request.action", "response.success" as enterprise_account_id, originating_user_id, api_name, api_version, action_id, ipaddress, requestid, starttime, modelclassname, modelid, action, success nodrop
71-
| where api_name matches "{{api}}" or isNull(api_name)
72-
| where modelclassname matches "{{model}}" or isNull(modelclassname)
73-
| where action matches "{{action}}" or isNull(action)
74-
| count_distinct (action_id)
73+
```sql="Total Audit Logs"
74+
_sourceCategory="Labs/Airtable"
75+
| Json "id", "action", "actor.type", "actor.user.id", "actor.user.name", "actor.user.email", "modelId", "modelType", "context.actionId", "origin.ipAddress" as audit_id, action, actor_type, user_id, user_name, user_email, model_id, model_type, action_id, ip_address nodrop
76+
77+
// global filters
78+
| where action matches "{{action}}"
79+
| where actor_type matches "{{actor_type}}"
80+
| where model_type matches "{{model_type}}"
81+
82+
// panel specific
83+
| count audit_id
84+
| count
85+
```
86+
87+
```sql="Newly Created Accounts/Users"
88+
_sourceCategory="Labs/Airtable"
89+
| Json "id", "action", "payload.type", "payload.user.id", "payload.user.name", "payload.user.email", "payload.name", "payload.email", "payload.previous.user.role", "payload.current.user.role", "payload.filename", "payload.user.permissionLevel", "payload.current.user.permissionLevel", "actor.type", "actor.user.email", "actor.user.name" as audit_id, action, payload_type, payload_user_id, payload_user_name, payload_user_email, payload_name, payload_email, previous_role, new_role, file_name, user_permission_level, current_user_permission_level, actor_type, actor_email, actor_name nodrop
90+
91+
// global filters
92+
| where action matches "{{action}}"
93+
| where actor_type matches "{{actor_type}}"
94+
95+
// panel specific
96+
| where toLowerCase(action) matches "createserviceaccount" or toLowerCase(action) matches "createuser" or toLowerCase(action) matches "provisionuser"
97+
| if (isNull(actor_name), "unknown", actor_name) as actor_name
98+
| if (isNull(actor_email), "unknown", actor_email) as actor_email
99+
| payload_name as user_name
100+
| payload_email as email_id
101+
| count by _messageTime, action, user_name, email_id, actor_type, actor_email, actor_name
102+
| sort by _messageTime
103+
| fields - _count, _messageTime
75104
```
76105

77106
## Collection configuration and app installation
@@ -110,7 +139,23 @@ import ViewDashboards from '../../reuse/apps/view-dashboards.md';
110139

111140
### Overview
112141

113-
The **Airtable - Overview** dashboard provides a high-level view of key metrics related to Airtable platform user activity, audits, and execution. It contains widgets that display data such as total audit logs and failed executions, action distribution, and top-performing actions and users. The dashboard also provides information on activity trends over time and user locations. The Audit Log Summary widget provides a quick overview of all platform activity. Overall, the dashboard helps users quickly understand how the platform is used and identify areas for improvement.<br/><img src={useBaseUrl('img/integrations/saas-cloud/airtable-overview.png')} alt="airtable-overview.png" width="600"/>
142+
The **Airtable - Overview** dashboard provides a high-level view of key metrics related to Airtable platform user activity, audits, and execution. It contains widgets that display data such as total audit logs and failed executions, action distribution, and top-performing actions and users. The dashboard also provides information on activity trends over time and user locations. The Audit Log Summary widget provides a quick overview of all platform activity. Overall, the dashboard helps users quickly understand how the platform is used and identify areas for improvement.<br/><img src={useBaseUrl('https://sumologic-app-data-v2.s3.us-east-1.amazonaws.com/dashboards/Airtable/Airtable+-+Overview.png')} alt="airtable-overview.png"/>
143+
144+
### Security Overview
145+
146+
The **Airtable - Security Overview** dashboard provides a high-level view of user activity related to security on the platform. It includes widgets that show data such as newly created accounts, access tokens, and deleted org units and workspaces. The dashboard also tracks changes in authentication methods, downloaded attachments, role updates, and user activity trends. In addition, it highlights users who have been newly assigned admin roles and any collaborator changes, helping to improve overall security monitoring.<br/><img src={useBaseUrl('https://sumologic-app-data-v2.s3.us-east-1.amazonaws.com/dashboards/Airtable/Airtable+-+Security+Overview.png')} alt="airtable-security-overview.png"/>
147+
148+
## Create monitors for Airtable app
149+
150+
import CreateMonitors from '../../reuse/apps/create-monitors.md';
151+
152+
<CreateMonitors/>
153+
154+
### Airtable monitors
155+
156+
| Name | Description | Trigger Type (Critical / Warning / MissingData) | Alert Condition |
157+
|:--|:--|:--|:--|
158+
| `Airtable - Embargoed Geo Locations of Audit Logs` | This alert is triggered when audit logs originating from sanctioned or embargoed regions are detected. This alert helps maintain adherence to legal and regulatory standards. | Critical | Count > 0 |
114159

115160
## Upgrade/Downgrade the Airtable app (Optional)
116161

0 commit comments

Comments
 (0)