Export activity to Google Cloud Storage

Set up hourly Activity Feed Export delivery of organization management events to a Google Cloud Storage bucket, and verify that exports arrive.

Activity Feed Export delivers recorded management activity from your organization and its projects to a Google Cloud Storage (GCS) bucket you control. Sanity writes a new export every hour. Use the files to retain activity history and ingest it into your security or analysis tools.

The export contains selected fields mapped to Open Cybersecurity Schema Framework (OCSF) version 1.9.0. It is a different format from the CSV download in the Activity Feed.

• Activity Feed Export enabled for your organization. Contact Enterprise Support to confirm availability.
• Organization administrator access to configure the destination in Manage.
• A GCS bucket, access to inspect its objects, and permission to grant Sanity access to create objects. Your Google Cloud administrator can grant this access for you.

To connect a GCS bucket to Activity Feed Export:

• In Manage, open your organization and go to Settings > Activity feed export.
• Copy the service account shown on the page.
• In the Google Cloud console, open the destination bucket's Permissions tab and click Grant access.
• Enter the service account as the principal and assign Storage Object Creator (roles/storage.objectCreator). Save the grant.
• Return to Activity feed export in Manage and enter the bucket name or its gs:// URI.
• Optional: Enter a Folder path. Leave it empty to deliver at the bucket root.
• Click Save.

Storage Object Creator lets Sanity add objects, but does not permit reading, overwriting, or deleting existing objects. Use a dedicated bucket or folder to avoid filename conflicts.

For more details, see Google's instructions for managing bucket permissions.

Sanity starts generating an Activity Feed Export at five minutes past each hour, in UTC, for the previous complete hour. For example, the 10:05 run exports records received by Sanity from 09:00 inclusive to 10:00 exclusive.

The five-minute offset is the start of generation, not the arrival time in your bucket. An event received near the start of an hour can wait roughly an hour before export begins.

The original event timestamp is preserved in each record. Because windows group events by when Sanity received them, an older event can appear in a later export.

After the next scheduled Activity Feed Export starts, allow time for generation and delivery, then inspect your destination bucket:

• Under your configured folder, find event-logs/organization_id=YOUR_ORGANIZATION_ID/kind=activity-feed/. Replace YOUR_ORGANIZATION_ID with your organization's ID.
• Open the dated folder for the expected UTC window and find the file ending in -manifest.json.
• Check the manifest's organizationId, windowStart, and windowEnd. Confirm that every file named in files exists beside the manifest.

Event files contain gzip-compressed newline-delimited JSON (NDJSON). Sanity delivers the manifest after the event files it lists. A manifest with eventCount: 0 and files: [] confirms a completed export with no exported records; no event file is expected.

An event file without its manifest is an incomplete window. A manifest confirms the exported files, not that every source activity was included. Events that cannot be converted can be omitted, and the manifest has no omitted-record count.

For file paths, checksums, event fields, and mappings, see the Activity Feed Export data reference.

If neither the Activity Feed Export manifest nor event files arrive for the expected window, check the bucket name, folder path, and Storage Object Creator grant.

If delivery is still missing, contact Enterprise Support with your organization ID, destination bucket, folder path, affected UTC window, and most recent manifest, if any.

To change the Activity Feed Export destination, edit the bucket or Folder path in Settings > Activity feed export and click Save. The new destination replaces the old one. Verify the first delivery at the new location.

To stop delivery to the configured destination, click Remove destination. Delivered files remain in your bucket, and removing the destination does not delete retained Activity Log records.

Sanity emails organization administrators when a destination is added, replaced, or removed. These emails confirm configuration changes, not successful delivery.

Hiding a project's Activity Feed in Manage is a separate setting. Feed visibility does not determine whether automated export delivery is enabled.

• GCS is the supported destination. Native security information and event management (SIEM) connectors are not provided.
• The export covers recorded management events, not document or asset creation, editing, publishing, unpublishing, deletion, reads, or downloads. It does not include raw request or response bodies or historical query results.
• Records can arrive more than once or out of order. Deduplicate using metadata.uid, the stable Activity Log event ID.
• Connecting or replacing a destination does not provide a self-service historical export. Contact Enterprise Support to assess recovery of a specific organization and UTC range.

You control access, retention, and downstream analysis of the files in your bucket.