Zendesk audit logs

Lakewatch provides an API connector to ingest account audit logs from Zendesk Support. This page covers prerequisites, configuration instructions, the connector schema, and Lakewatch parser indicators.

Prerequisites

The connector requires:

1. Serverless Lakeflow pipelines turned on in your workspace.
2. Unity Catalog, with privileges to create or use a Unity Catalog connection. See Connection permissions.
3. A Zendesk Support account with permission to create OAuth clients. See Using OAuth authentication with your application.
4. Access to the Zendesk Support Audit Logs API. See Audit Logs.

Known limitations

• Slowly changing dimension (SCD) type 2 is not supported.
• The connector supports only OAuth user-to-machine (U2M) authentication. OAuth machine-to-machine and basic authentication aren't supported.
• The first sync of the audit_logs table starts at the datasource start time, which must be within the last 30 days. If you don't set a start time, ingestion starts when you create the datasource. Later syncs resume from the last ingested time value. See Choose how far back to ingest.

Configure Zendesk Support for ingestion

Create a confidential OAuth client in Zendesk Support. The Unique identifier is the client ID you enter in Databricks.

1. Go to the admin center at https://<subdomain>.zendesk.com/admin/home.

2. Click Apps and integrations > APIs > OAuth clients.

3. Click Add OAuth client on the right side of the OAuth client list.

4. Complete the required fields to create a client:

   • Client name: Enter the name that appears in the list of apps with access to your Zendesk Support instance.

   • Unique identifier: Click the field to populate it with the client name automatically. You can change it if needed. This value is the Client ID in Databricks.

   • Client kind: Select Confidential.

   • Redirect URLs: Enter https://<your_workspace_domain>/login/oauth/lakehousefederation.html.

     Replace <your_workspace_domain> with your workspace instance name, for example dbc-a1b2345c-d6e7.cloud.databricks.com.

5. Click Save. Copy the new, pre-populated Secret value that appears, which is the client secret you use when creating the connection. Zendesk shows it one time.

6. Click Save again.

7. Note the Zendesk subdomain (for example, your-company from https://your-company.zendesk.com).

tip

When you create a connection through the Lakewatch UI, enter the Subdomain, Client ID (the unique identifier), and Client secret from the previous steps. Click Sign in with Zendesk Support and authorize the application.

See Configure Zendesk Support for OAuth.

Next steps

After you configure Zendesk Support, create a datasource with the Zendesk connector in the Lakewatch UI. See API connectors for instructions.

---

Connector and Lakewatch schemas

The connector ingests the following source table from the default source schema:

Source table	Zendesk data	Built-in Lakewatch parser
audit_logs	Account-level administrative actions and changes	zendesk_audit

Source table	Zendesk data	Built-in Lakewatch parser
audit_logs	Account-level administrative actions and changes	zendesk_audit

The connector writes the source table to the datasource's raw destination. The built-in parser writes a separate parsed table named after the parser, unless you set a parsed destination when you configure the datasource.

Lakewatch-managed columns

The connector adds the following columns to each raw source row:

• lw_id: A non-null string that Lakewatch uses as the primary key. The connector derives a stable, time-sortable ID from the source created_at and id fields.
• time: A non-null UTC timestamp converted from the source created_at value. The connector uses time as the cursor field for incremental ingestion.

The connector does not write the source id field to the destination table.

The parsed table carries lw_id forward and adds lw_meta and lw_observables. lw_meta contains standard Lakewatch processing metadata. lw_observables contains values extracted from fields marked as security indicators in the parser. See Parser reference.

Raw connector table schema

The following schema includes the Zendesk Support audit log fields. For field definitions, see the Zendesk Support connector reference and the Zendesk Audit Logs API.

Schema

Column	Data type
lw_id	STRING
time	TIMESTAMP
action	STRING
action_label	STRING
actor_id	BIGINT
actor_name	STRING
change_description	STRING
created_at	STRING
ip_address	STRING
source_id	BIGINT
source_label	STRING
source_type	STRING
url	STRING

Column	Data type
lw_id	STRING
time	TIMESTAMP
action	STRING
action_label	STRING
actor_id	BIGINT
actor_name	STRING
change_description	STRING
created_at	STRING
ip_address	STRING
source_id	BIGINT
source_label	STRING
source_type	STRING
url	STRING

Parser indicators

The zendesk_audit parser extracts the following fields into lw_observables.

Indicators

Field	Indicator
actor_name	username
ip_address	ip
url	url

Field	Indicator
actor_name	username
ip_address	ip
url	url