Box Audit Logs connector reference

Beta

This feature is in Beta. To use it, a workspace admin must turn on Lakeflow Connect for Box Audit Logs from the Previews page. See Manage Databricks previews.

Reference information for the managed Box Audit Logs connector, including the supported source table, the event_logs destination schema, and connector options.

Supported source tables

The Box Audit Logs connector supports the following source table, under the default source schema:

Source table	Primary key	Description	Sync mode	Cursor field
event_logs	event_id	Enterprise audit events for your Box enterprise, such as user, file, and configuration activity.	Incremental	created_at

Source table	Primary key	Description	Sync mode	Cursor field
event_logs	event_id	Enterprise audit events for your Box enterprise, such as user, file, and configuration activity.	Incremental	created_at

Connector options

The Box Audit Logs connector has no additional configuration options beyond the pipeline settings available for all managed connectors. See Ingest data from Box.

Destination table schemas

event_logs

• Primary key: event_id
• Cursor field: created_at

Field	Data type
event_id	STRING
event_type	STRING
type	STRING
created_at	TIMESTAMP
recorded_at	TIMESTAMP
session_id	STRING
ip_address	STRING
created_by	VARIANT
action_by	VARIANT
source	VARIANT
additional_details	VARIANT

Field	Data type
event_id	STRING
event_type	STRING
type	STRING
created_at	TIMESTAMP
recorded_at	TIMESTAMP
session_id	STRING
ip_address	STRING
created_by	VARIANT
action_by	VARIANT
source	VARIANT
additional_details	VARIANT

note

This table does not support SCD Type 2 because it has VARIANT columns.

Required OAuth permissions

The Box Server Authentication app must include the following scope. See Scopes.

Permission	Required for
Manage enterprise properties	event_logs

Permission	Required for
Manage enterprise properties	event_logs

Required Box account permissions

Permission	Required for
Enterprise admin, or co-admin with Run new reports and access existing reports	Reading enterprise events from the Events API

Permission	Required for
Enterprise admin, or co-admin with Run new reports and access existing reports	Reading enterprise events from the Events API