When to use Audit Logs

Audit Logs allows you to view and filter events for your tenant. This article helps you understand which filters to set when you investigate specific situations, such as:

When you suspect a security incident.
When resource changes lead to unexpected spending.

Audit events are stored per region, so repeat the search in each relevant region.

Prerequisites

Web console
CLI
Go SDK
Python SDK
JavaScript SDK

Make sure you are in a group that has the admin or auditlogs.audit-event-viewer role within your tenant. You can check this in the Administration → IAM section of the web console.
Identify the regions to search for the audit events you need.

Install and configure the Nebius AI Cloud CLI.
Make sure you are in a group that has the admin or auditlogs.audit-event-viewer role within your tenant. You can check this in the Administration → IAM section of the web console.
Identify the regions to search for the audit events you need.

Install and initialize the Nebius SDK for Go.
Make sure you are in a group that has the admin or auditlogs.audit-event-viewer role within your tenant. You can check this in the Administration → IAM section of the web console.
Identify the regions to search for the audit events you need.

Install and initialize the Nebius SDK for Python.
Make sure you are in a group that has the admin or auditlogs.audit-event-viewer role within your tenant. You can check this in the Administration → IAM section of the web console.
Identify the regions to search for the audit events you need.

Install and initialize the Nebius SDK for JavaScript.
Make sure you are in a group that has the admin or auditlogs.audit-event-viewer role within your tenant. You can check this in the Administration → IAM section of the web console.
Identify the regions to search for the audit events you need.

Potential security incidents

If you suspect a security incident in your tenant, Audit Logs can help you track down the events that occurred at the time and investigate possible causes.

Who made changes to resources, and when?

If you encounter a suspicious change in resources of a given type, review the events that involve resource changes:

Web console
CLI
Go SDK
Python SDK
JavaScript SDK

Enter CREATE, UPDATE or DELETE in the Action field to see all resource changes.
Fill in the Resource type field to see the changes that concern a specific resource type.

For example, enter DELETE in the Action field and computeinstance in the Resource type field to find out which Compute virtual machines were deleted.See the Subject column to find out who made the change.

Set the following filters:

action equal to CREATE, UPDATE or DELETE.
resource.metadata.type equal to the resource type. For example, computeinstance for a Compute virtual machine.

For example, to find out which Compute virtual machines were created in the period:

nebius audit v2 audit-event list \
   --parent-id <tenant_ID> \
   --start <time_in_ISO_8601> --end <time_in_ISO_8601> \
   --filter "action='CREATE' AND resource.metadata.type='computeinstance'" \
   --region <region_ID>

In the command, specify:

--parent-id: Tenant ID.
--start: Start time for the search, in the ISO 8601 format.
--end: End time for the search, in the ISO 8601 format.
--filter: action='CREATE' and resource.metadata.type='computeinstance'.
--region: Region where the events are stored.

See the authentication.subject parameter of the response to find out who made the change.

Set Filter to action equal to CREATE, UPDATE or DELETE and resource.metadata.type equal to the resource type. For example, use computeinstance for a Compute virtual machine.To find out which Compute virtual machines were created in the period:

createActionStart, err := time.Parse(
    time.RFC3339, "<time_in_ISO_8601>",
)
if err != nil {
    return fmt.Errorf("parse start time: %w", err)
}
createActionEnd, err := time.Parse(
    time.RFC3339, "<time_in_ISO_8601>",
)
if err != nil {
    return fmt.Errorf("parse end time: %w", err)
}
createActionFilter := "action='CREATE'" +
    " AND resource.metadata.type='computeinstance'"
createActionService := sdk.Services().Audit().V2().AuditEvent()
createActionEvents, err := createActionService.List(
    ctx,
    &audit.ListAuditEventRequest{
        ParentId: "<tenant_ID>",
        Start: timestamppb.New(createActionStart),
        End: timestamppb.New(createActionEnd),
        Filter: createActionFilter,
        Region: "<region_ID>",
    },
)
if err != nil {
    return fmt.Errorf("list audit events: %w", err)
}
fmt.Println(createActionEvents)

In the code, specify:

ParentId: Tenant ID.
Start: Start time for the search, in the ISO 8601 format with a timezone.
End: End time for the search, in the ISO 8601 format with a timezone.
Filter: action='CREATE' and resource.metadata.type='computeinstance'.
Region: Region to search for audit events.

The output includes the authentication subject that made the change.

Set filter to action equal to CREATE, UPDATE or DELETE and resource.metadata.type equal to the resource type. For example, use computeinstance for a Compute virtual machine.To find out which Compute virtual machines were created in the period:

event_service = AuditEventServiceClient(sdk)
event_filter = (
    "action='CREATE'"
    + " AND resource.metadata.type='computeinstance'"
)
events = await event_service.list(
    ListAuditEventRequest(
        parent_id="<tenant_ID>",
        start=datetime.fromisoformat("<time_in_ISO_8601>"),
        end=datetime.fromisoformat("<time_in_ISO_8601>"),
        filter=event_filter,
        region="<region_ID>",
    ),
)
print(events)

In the code, specify:

parent_id: Tenant ID.
start: Start time for the search, in the ISO 8601 format with a timezone, for example, 2026-05-07T00:00:00Z. On Python 3.10, use +00:00 instead of Z.
end: End time for the search, in the ISO 8601 format with a timezone, for example, 2026-05-08T00:00:00Z. On Python 3.10, use +00:00 instead of Z.
filter: action='CREATE' and resource.metadata.type='computeinstance'.
region: Region to search for audit events.

The output includes the authentication subject that made the change.

const createActionService = new AuditEventService(sdk);
const createActionFilter =
  "action='CREATE'" +
  " AND resource.metadata.type='computeinstance'";
const createActionEvents = await createActionService.list(
  ListAuditEventRequest.create({
    parentId: "<tenant_ID>",
    start: dayjs("<time_in_ISO_8601>"),
    end: dayjs("<time_in_ISO_8601>"),
    filter: createActionFilter,
    region: "<region_ID>",
  }),
).result;
console.log(createActionEvents);

In the code, specify:

parentId: Tenant ID.
start: Start time for the search, in the ISO 8601 format.
end: End time for the search, in the ISO 8601 format.
filter: action='CREATE' and resource.metadata.type='computeinstance'.
region: Region to search for audit events.

The output includes the authentication subject that made the change.

What happened at the time of the incident?

To gain more context when investigating an incident, create granular filters to review the events. To combine filters, use the following options:

AND logical operator.
Comparison operators: = (equals), != (not equals), : (contains).
Regular expressions (for example, regex(resource.name, '^.*prod.*$') to show resources with prod in their names).

For example, to view 10 events where the user example@nebius.com deleted virtual machines between April 1 and April 5:

CLI
Go SDK
Python SDK
JavaScript SDK

Limit the number of entries you receive by using the --page-size parameter:

nebius audit v2 audit-event list \
   --parent-id <tenant_ID> \
   --start 2025-04-01T00:00:00Z --end 2025-04-06T00:00:00Z \
   --filter "authentication.subject.name='example@nebius.com' \
      AND action='DELETE' \
      AND resource.metadata.type='computeinstance'" \
   --page-size=10 \
   --region <region_ID>

In the command, specify:

--parent-id: Tenant ID.
--start: 2025-04-01T00:00:00Z.
--end: 2025-04-06T00:00:00Z.
--filter: Events where example@nebius.com deleted Compute virtual machines.
--page-size: 10.
--region: Region where the events are stored.

If there are more than 10 events, get the next_page_token value from the response and run the same command again with an additional --page-token=<next_page_token> parameter to get the next batch.

pagedStart, err := time.Parse(
    time.RFC3339, "2025-04-01T00:00:00Z",
)
if err != nil {
    return fmt.Errorf("parse start time: %w", err)
}
pagedEnd, err := time.Parse(
    time.RFC3339, "2025-04-06T00:00:00Z",
)
if err != nil {
    return fmt.Errorf("parse end time: %w", err)
}
pagedFilter := "authentication.subject.name='" +
    "example@nebius.com" +
    "' " +
    " AND action='DELETE' " +
    " AND resource.metadata.type='computeinstance'"
pagedService := sdk.Services().Audit().V2().AuditEvent()
pagedEvents, err := pagedService.List(
    ctx,
    &audit.ListAuditEventRequest{
        ParentId: "<tenant_ID>",
        Start: timestamppb.New(pagedStart),
        End: timestamppb.New(pagedEnd),
        Filter: pagedFilter,
        PageSize: 10,
        Region: "<region_ID>",
    },
)
if err != nil {
    return fmt.Errorf("list audit events: %w", err)
}
fmt.Println(pagedEvents)

In the code, specify:

ParentId: Tenant ID.
Start: 2025-04-01T00:00:00Z.
End: 2025-04-06T00:00:00Z.
Filter: Events where example@nebius.com deleted Compute virtual machines.
PageSize: 10. The response contains at most 10 events.
Region: Region to search for audit events.

event_service = AuditEventServiceClient(sdk)
event_filter = (
    "authentication.subject.name='"
    + "example@nebius.com"
    + "' "
    + " AND action='DELETE' "
    + " AND resource.metadata.type='computeinstance'"
)
events = await event_service.list(
    ListAuditEventRequest(
        parent_id="<tenant_ID>",
        start=datetime.fromisoformat("2025-04-01T00:00:00Z"),
        end=datetime.fromisoformat("2025-04-06T00:00:00Z"),
        filter=event_filter,
        page_size=10,
        region="<region_ID>",
    ),
)
print(events)

In the code, specify:

parent_id: Tenant ID.
start: 2025-04-01T00:00:00Z. On Python 3.10, use +00:00 instead of Z.
end: 2025-04-06T00:00:00Z. On Python 3.10, use +00:00 instead of Z.
filter: Events where example@nebius.com deleted Compute virtual machines.
page_size: 10. The response contains at most 10 events.
region: Region to search for audit events.

const pagedService = new AuditEventService(sdk);
const pagedFilter =
  "authentication.subject.name='" +
  "example@nebius.com" +
  "' " +
  " AND action='DELETE' " +
  " AND resource.metadata.type='computeinstance'";
const pagedEvents = await pagedService.list(
  ListAuditEventRequest.create({
    parentId: "<tenant_ID>",
    start: dayjs("2025-04-01T00:00:00Z"),
    end: dayjs("2025-04-06T00:00:00Z"),
    filter: pagedFilter,
    pageSize: 10,
    region: "<region_ID>",
  }),
).result;
console.log(pagedEvents);

In the code, specify:

parentId: Tenant ID.
start: 2025-04-01T00:00:00Z.
end: 2025-04-06T00:00:00Z.
filter: Events where example@nebius.com deleted Compute virtual machines.
pageSize: 10. The response contains at most 10 events.
region: Region to search for audit events.

Unexpected spending

If you see a sudden increase in spending, Audit Logs can help you find out more about the resources that are used in your tenant.

What happened with a specific resource?

A particular resource may cause more spending than you expected. Get the events that are associated with this resource:

Web console
CLI
Go SDK
Python SDK
JavaScript SDK

Enter the resource ID in the Resource ID field.

If you know the resource name, filter by resource.metadata.name.
If you know the resource ID, filter by resource.metadata.id.

For example:

nebius audit v2 audit-event list \
   --parent-id <tenant_ID> \
   --start <time_in_ISO_8601> --end <time_in_ISO_8601> \
   --filter "resource.metadata.name='<name>'" \
   --region <region_ID>

In the command, specify:

--parent-id: Tenant ID.
--start: Start time for the search, in the ISO 8601 format.
--end: End time for the search, in the ISO 8601 format.
--filter: resource.metadata.name equal to the resource name.
--region: Region where the events are stored.

If you know the resource name, set Filter to match resource.metadata.name.
If you know the resource ID, set Filter to match resource.metadata.id.

For example:

resourceNameStart, err := time.Parse(
    time.RFC3339, "<time_in_ISO_8601>",
)
if err != nil {
    return fmt.Errorf("parse start time: %w", err)
}
resourceNameEnd, err := time.Parse(
    time.RFC3339, "<time_in_ISO_8601>",
)
if err != nil {
    return fmt.Errorf("parse end time: %w", err)
}
resourceNameFilter := "resource.metadata.name='" +
    "<name>" +
    "'"
resourceNameService := sdk.Services().Audit().V2().AuditEvent()
resourceNameEvents, err := resourceNameService.List(
    ctx,
    &audit.ListAuditEventRequest{
        ParentId: "<tenant_ID>",
        Start: timestamppb.New(resourceNameStart),
        End: timestamppb.New(resourceNameEnd),
        Filter: resourceNameFilter,
        Region: "<region_ID>",
    },
)
if err != nil {
    return fmt.Errorf("list audit events: %w", err)
}
fmt.Println(resourceNameEvents)

In the code, specify:

ParentId: Tenant ID.
Start: Start time for the search, in the ISO 8601 format with a timezone.
End: End time for the search, in the ISO 8601 format with a timezone.
Filter: resource.metadata.name equal to the resource name.
Region: Region to search for audit events.

If you know the resource name, set filter to match resource.metadata.name.
If you know the resource ID, set filter to match resource.metadata.id.

For example:

event_service = AuditEventServiceClient(sdk)
event_filter = (
    "resource.metadata.name='"
    + "<name>"
    + "'"
)
events = await event_service.list(
    ListAuditEventRequest(
        parent_id="<tenant_ID>",
        start=datetime.fromisoformat("<time_in_ISO_8601>"),
        end=datetime.fromisoformat("<time_in_ISO_8601>"),
        filter=event_filter,
        region="<region_ID>",
    ),
)
print(events)

In the code, specify:

parent_id: Tenant ID.
start: Start time for the search, in the ISO 8601 format with a timezone, for example, 2026-05-07T00:00:00Z. On Python 3.10, use +00:00 instead of Z.
end: End time for the search, in the ISO 8601 format with a timezone, for example, 2026-05-08T00:00:00Z. On Python 3.10, use +00:00 instead of Z.
filter: resource.metadata.name equal to the resource name.
region: Region to search for audit events.

If you know the resource name, set filter to match resource.metadata.name.
If you know the resource ID, set filter to match resource.metadata.id.

For example:

const resourceNameService = new AuditEventService(sdk);
const resourceNameFilter =
  "resource.metadata.name='" +
  "<name>" +
  "'";
const resourceNameEvents = await resourceNameService.list(
  ListAuditEventRequest.create({
    parentId: "<tenant_ID>",
    start: dayjs("<time_in_ISO_8601>"),
    end: dayjs("<time_in_ISO_8601>"),
    filter: resourceNameFilter,
    region: "<region_ID>",
  }),
).result;
console.log(resourceNameEvents);

In the code, specify:

parentId: Tenant ID.
start: Start time for the search, in the ISO 8601 format.
end: End time for the search, in the ISO 8601 format.
filter: resource.metadata.name equal to the resource name.
region: Region to search for audit events.

Who created a new resource?

Unexpected spending may be caused by creating more resources than necessary. To investigate who created them, get the resource creation events:

Web console
CLI
Go SDK
Python SDK
JavaScript SDK

Fill in the Resource type field and enter CREATE in the Action field to see when resources of a specific type were created.For example, enter computeinstance in the Resource type field and CREATE in the Action field to see all events where a Compute virtual machine was created.See the Subject column to find out who made the change.

Set the following filters:

action equal to CREATE.
resource.metadata.type equal to the resource type. For example, computeinstance for a Compute virtual machine.

For example:

nebius audit v2 audit-event list \
   --parent-id <tenant_ID> \
   --start <time_in_ISO_8601> --end <time_in_ISO_8601> \
   --filter "action='CREATE' AND resource.metadata.type='computeinstance'" \
   --region <region_ID>

In the command, specify:

--parent-id: Tenant ID.
--start: Start time for the search, in the ISO 8601 format.
--end: End time for the search, in the ISO 8601 format.
--filter: action='CREATE' and resource.metadata.type='computeinstance'.
--region: Region where the events are stored.

See the authentication.subject parameter of the response to find out who made the change.

Set Filter to action equal to CREATE and resource.metadata.type equal to the resource type. For example, use computeinstance for a Compute virtual machine.

createActionStart, err := time.Parse(
    time.RFC3339, "<time_in_ISO_8601>",
)
if err != nil {
    return fmt.Errorf("parse start time: %w", err)
}
createActionEnd, err := time.Parse(
    time.RFC3339, "<time_in_ISO_8601>",
)
if err != nil {
    return fmt.Errorf("parse end time: %w", err)
}
createActionFilter := "action='CREATE'" +
    " AND resource.metadata.type='computeinstance'"
createActionService := sdk.Services().Audit().V2().AuditEvent()
createActionEvents, err := createActionService.List(
    ctx,
    &audit.ListAuditEventRequest{
        ParentId: "<tenant_ID>",
        Start: timestamppb.New(createActionStart),
        End: timestamppb.New(createActionEnd),
        Filter: createActionFilter,
        Region: "<region_ID>",
    },
)
if err != nil {
    return fmt.Errorf("list audit events: %w", err)
}
fmt.Println(createActionEvents)

In the code, specify:

ParentId: Tenant ID.
Start: Start time for the search, in the ISO 8601 format with a timezone.
End: End time for the search, in the ISO 8601 format with a timezone.
Filter: action='CREATE' and resource.metadata.type='computeinstance'.
Region: Region to search for audit events.

The output includes the authentication subject that made the change.

Set filter to action equal to CREATE and resource.metadata.type equal to the resource type. For example, use computeinstance for a Compute virtual machine.

event_service = AuditEventServiceClient(sdk)
event_filter = (
    "action='CREATE'"
    + " AND resource.metadata.type='computeinstance'"
)
events = await event_service.list(
    ListAuditEventRequest(
        parent_id="<tenant_ID>",
        start=datetime.fromisoformat("<time_in_ISO_8601>"),
        end=datetime.fromisoformat("<time_in_ISO_8601>"),
        filter=event_filter,
        region="<region_ID>",
    ),
)
print(events)

In the code, specify:

parent_id: Tenant ID.
start: Start time for the search, in the ISO 8601 format with a timezone, for example, 2026-05-07T00:00:00Z. On Python 3.10, use +00:00 instead of Z.
end: End time for the search, in the ISO 8601 format with a timezone, for example, 2026-05-08T00:00:00Z. On Python 3.10, use +00:00 instead of Z.
filter: action='CREATE' and resource.metadata.type='computeinstance'.
region: Region to search for audit events.

The output includes the authentication subject that made the change.

Set filter to action equal to CREATE and resource.metadata.type equal to the resource type. For example, use computeinstance for a Compute virtual machine.

const createActionService = new AuditEventService(sdk);
const createActionFilter =
  "action='CREATE'" +
  " AND resource.metadata.type='computeinstance'";
const createActionEvents = await createActionService.list(
  ListAuditEventRequest.create({
    parentId: "<tenant_ID>",
    start: dayjs("<time_in_ISO_8601>"),
    end: dayjs("<time_in_ISO_8601>"),
    filter: createActionFilter,
    region: "<region_ID>",
  }),
).result;
console.log(createActionEvents);

In the code, specify:

parentId: Tenant ID.
start: Start time for the search, in the ISO 8601 format.
end: End time for the search, in the ISO 8601 format.
filter: action='CREATE' and resource.metadata.type='computeinstance'.
region: Region to search for audit events.

The output includes the authentication subject that made the change.

Security

Audit Logs

Key Management Service

SecretStash (formerly MysteryBox)

Prerequisites

Potential security incidents

Who made changes to resources, and when?

What happened at the time of the incident?

Unexpected spending

What happened with a specific resource?

Who created a new resource?

​Prerequisites

​Potential security incidents

​Who made changes to resources, and when?

​What happened at the time of the incident?

​Unexpected spending

​What happened with a specific resource?

​Who created a new resource?

Prerequisites

Potential security incidents

Who made changes to resources, and when?

What happened at the time of the incident?

Unexpected spending

What happened with a specific resource?

Who created a new resource?