Each audit event contains the following fields:
| Field | Description | Example |
|---|---|---|
Source | The component that emitted the event. | Security |
Category | The category path classifying the event. | Security.Authentication |
Event | The specific event name. | Authenticated |
Severity | The severity level: Low,
Medium, High, or
Critical. | Medium |
Message | A human-readable description of what happened. | User 'admin' authenticated successfully |
Username | The user account involved, if applicable. | admin |
Address | The IP address or endpoint involved, if applicable. | 192.168.1.100 |
Timestamp | The date and time the event occurred. | 2025-01-15T14:30:00Z |
Details | Additional structured information, as key-value pairs. | version=10.1.0; build=1234 |
Some events intentionally omit the Username and
Address fields. In particular,
ConfigurationChanged events omit these fields because they
represent the result of a database synchronization rather than a direct user
action.
Every audit event is published as a DataHub data point under the configured audit
domain. The point name follows the pattern
DomainName:Category.CategoryPath.EventName
Because audit events are standard DataHub data points, they can be:
Forwarded to other DataHub instances via tunnelling or bridging.
Monitored by scripts that react to specific event patterns.
Consumed by OPC UA, MQTT, or other protocol clients connected to DataHub.
Displayed in dashboards or visualized in web applications.