Activity Feed Export data reference

Reference for Activity Feed Export file paths, manifests, and OCSF event fields.

Activity Feed Export writes gzip-compressed newline-delimited JSON (NDJSON) event files and a JSON manifest for each completed export window. Event records use Open Cybersecurity Schema Framework (OCSF) version 1.9.0. The manifest has its own schema version, currently 1.

Paths are relative to the bucket root or the optional folder configured for the destination:

event-logs/organization_id=YOUR_ORGANIZATION_ID/kind=activity-feed/dt=YYYY-MM-DD/
  WINDOW_START_MICROSECONDS-part-1.ndjson.gz
  WINDOW_START_MICROSECONDS-manifest.json

YOUR_ORGANIZATION_ID is your organization ID. YYYY-MM-DD is the UTC date of the window start. WINDOW_START_MICROSECONDS is the window start as Unix microseconds. Manifest schema version 1 lists at most one event file per window.

Every completed window has a manifest, including windows with no exported records. Its fields are:

Each entry in files has these fields:

This manifest lists one file containing one exported event:

{
  "schemaVersion": 1,
  "organizationId": "org-0001",
  "windowStart": "2026-09-22T10:00:00Z",
  "windowEnd": "2026-09-22T11:00:00Z",
  "eventCount": 1,
  "files": [
    {
      "name": "1790071200000000-part-1.ndjson.gz",
      "fileFormat": "ndjson",
      "compression": "gzip",
      "eventCount": 1,
      "sizeBytes": 349,
      "sha256": "89af1e46e1966288a0bf1637ff3ca785ccfc3b861f334a81d8f8055a12a18261"
    }
  ]
}

With no exported records, eventCount is 0 and files is empty:

{
  "schemaVersion": 1,
  "organizationId": "org-0001",
  "windowStart": "2026-09-22T11:00:00Z",
  "windowEnd": "2026-09-22T12:00:00Z",
  "eventCount": 0,
  "files": []
}

The manifest arrives after the event files it lists. Treat an event file without its manifest as an incomplete window. For a completed window, the file event counts add up to the manifest's eventCount.

You can compare the compressed file sizes and SHA-256 digests with the manifest and count the decompressed NDJSON records. The digest detects corruption; it is not a cryptographic signature or a guarantee of tamper evidence.

The manifest counts exported records, not all source activity. Records that cannot be converted can be omitted while the rest of the window completes. The manifest has no omitted-record count.

This synthetic Entity Management record illustrates the exported JSON shape. Each decompressed NDJSON line contains one record; indentation is shown here for readability.

{
  "activity_id": 1,
  "activity_name": "Create",
  "actor": {
    "user": {
      "display_name": "Firstname Lastname",
      "email_addr": "actor@example.com",
      "uid": "usr-0001"
    }
  },
  "category_uid": 3,
  "class_name": "Entity Management",
  "class_uid": 3004,
  "entity": {
    "name": "example-import",
    "type": "import",
    "type_id": 99
  },
  "message": "A description of import.create.",
  "metadata": {
    "product": {
      "name": "Sanity",
      "url_string": "https://www.sanity.io",
      "vendor_name": "Sanity"
    },
    "tenant_uid": "org-0001",
    "uid": "ale-0001",
    "version": "1.9.0"
  },
  "severity": "Informational",
  "severity_id": 1,
  "status": "Success",
  "status_id": 1,
  "time": 1790074133883,
  "type_uid": 300401
}

For standard field definitions, required attributes, and allowed values, see the OCSF 1.9.0 schema browser. Sanity maps recorded actions to these event classes:

• Entity Management (3004): project and dataset administration, tokens, configuration, and other managed entities.
• User Management (3007): invitations, membership changes, and membership requests.
• Role Management (3008): role lifecycle and permission grant changes.

Sanity sets category_uid to 3 (Identity and Access Management) and severity to Informational (severity_id: 1).

The export derives status from the source action: the failed verb maps to Failure (status_id: 2); other supported verbs map to Success (status_id: 1). The status is not an independently measured execution outcome. message contains the source description when available.

The export maps selected source fields into OCSF. It does not copy the original Activity Log record in full, preserve arbitrary source metadata, or include an unmapped object. The original action string is not a separate exported field. Before-and-after values are not provided.

The metadata object has these fields:

actor.user identifies the person or service performing the action. The managed user identifies the person affected by a User Management event. Sanity includes available identifiers, names, and email addresses; unavailable identity fields are omitted. A Sanity service actor uses uid: "sanity-system" and type: "Service".

An entity has type_id: 99 (Other), a descriptive type, and a name, uid, or both. Some actions identify only a resource type, not a unique resource. An iam_role has a uid (role slug), a name (display name), or both.

Hourly windows group records by when Sanity received them. The OCSF time field preserves the original event timestamp in Unix milliseconds, so an older event can appear in a later delivery window. A missing original timestamp is represented as 0.

Consumers must tolerate duplicate and out-of-order records, including during recovery. Use metadata.uid to identify the same event across deliveries. Connecting a destination does not provide a self-service historical export.

To configure automated delivery, see Export activity to Google Cloud Storage.