Codex code scanning finding log (event_type = CODEX_SECURITY_LOG)
| # | Field | Type | Display name | Description |
|---|---|---|---|---|
| 1 | _time | DATE | Time | |
| 2 | user | STRING | Account | e.g. user01@example.com |
| 3 | finding_severity | STRING | Severity | |
| 4 | finding_status | STRING | Finding status | |
| 5 | detail_type | STRING | Event | |
| 6 | scan_type | STRING | Scan type | |
| 7 | repo_url | URL | Repository URL | e.g. https://github.com/example-org/example-repo |
| 8 | repo_id | STRING | Repository ID | e.g. 000000000 |
| 9 | scan_configuration_id | STRING | Scan configuration ID | e.g. 00000000-0000-0000-0000-000000000000 |
| 10 | environment_id | STRING | Environment ID | e.g. 00000000-0000-0000-0000-000000000000 |
| 11 | type | STRING | Event type | e.g. AUDIT_LOG |
| 12 | event_id | STRING | Event ID | e.g. 00000000-0000-0000-0000-000000000000 |
| 13 | user_id | STRING | User ID | e.g. user-A1b2C3d4E5f6G7h8I9j0K1l2 |
| 14 | actor_type | STRING | Actor type | ACCOUNT_USER, SERVICE_ACCOUNT |
| 15 | principal_id | STRING | Workspace ID | e.g. 00000000-0000-0000-0000-000000000000 |
| 16 | principal_type | STRING | Workspace type | CHATGPT_WORKSPACE |
| 17 | file_id | STRING | Log file ID | e.g. eclf_0000000000000000000000000000000000 |
| 18 | extra | MAP | Unmapped fields | Fields the API added that this schema does not name yet |