Notification Types and Field Definitions
Updates (July 2026 to September 2026)
September 2026 — Updated the topic to add information about the bot-related notification events. For more information, see Notification types and attributes.
When a notification rule is triggered in Traceable, structured events are sent to external systems, including SIEMs (Splunk), log collectors (Syslog, S3), security platforms (CrowdStrike), and messaging channels (Slack, Teams, email). Each notification type follows a consistent schema, providing detailed fields and context to monitor API activity, detect security issues, and integrate seamlessly with your operational workflows.
What will you learn in this topic?
By the end of this topic, you will be able to:
Understand the different types of notifications in Traceable.
Identify the fields and data types included in each notification type.
Interpret sample JSON payloads to integrate events with external systems.
Notification types and attributes
The following sections provide a comprehensive list of all fields available in the notification type when integrated with external SIEM platforms, along with a sample JSON.
Base alert fields (Inherited by all notification types)
It provides core details, such as tenant, environment, triggering rule, and alert message, for consistent tracking and integration. The following table outlines the fields for this notification type, along with their data types and descriptions.
tenantId
String
Unique tenant identifier generating the event.
timestamp
Instant
UTC timestamp when the event is generated.
environment
String
Environment where the event occurs (for example, production, staging)
eventType
String
Event type identifier.
notificationRuleName
String
The notification rule that triggered the event.
linkToEvent
String
Direct URL to the event in Traceable.
eventCategory
String
Logical classification of the event.
linkToNotificationConfig
String
URL to the notification configuration.
alertMessage
String
Human-readable alert message.
The following is a sample JSON for all the events mentioned above:
{
"tenantId": "tenant_123",
"timestamp": "2026-02-18T12:00:00Z",
"environment": "prod",
"eventType": "Blocked Event",
"notificationRuleName": "High Severity Alert",
"linkToEvent": "https://app.traceable.ai/event/123",
"eventCategory": "THREAT",
"linkToNotificationConfig": "https://app.traceable.ai/config/456",
"alertMessage": "High severity event detected"
}Agent entity change notification type
It is triggered when an agent changes state (for example, upgrades or becomes inactive), providing visibility into agent status and operational changes within your environment. The following table outlines the fields included when an agent changes state (for example, becomes inactive or upgraded), along with their respective data types and descriptions.
agentName
String
Name of the agent.
version
String
Agent version.
agentType
String
Type of agent (for example, Kubernetes, VM).
previousStatus
String
Previous agent state (for example, ACTIVE)
currentStatus
String
Current agent state ( for example, INACTIVE)
Sample JSON
API and backend discovery notification type
It is triggered when Traceable discovers new API endpoints, services, or backend systems, providing visibility into your environment for inventory, monitoring, and operational tracking. The following table outlines the fields included when Traceable discovers new API endpoints or backend systems within your environment, along with their respective data types and descriptions.
eventType
String
Type of discovery event generated by the platform.
apiName
String
Name of the newly discovered API endpoint, including HTTP method and path.
serviceName
String
Name of the service associated with the discovered API.
backendName
String
Name of the newly discovered backend system or infrastructure component.
Configuration and environment-related notification type
The following table outlines the fields included in this, along with their respective data types and descriptions.
1. Configuration change
The following table outlines the fields included when a platform configuration is created, modified, or updated, along with their respective data types and descriptions.
eventType
String
Identifies the event as CONFIG_CHANGE.
description
String
Human-readable summary of the configuration change. Defaults to "A config has been changed" if not explicitly provided.
configType
String
Category or type of configuration that was modified (for example, notification rule, blocking rule, policy, integration).
changeInitiator
String
Username or email address of the user who performed the configuration change.
configRuleName
String
User-defined name of the configuration rule affected by the change.
2. Domain discovery notification type
The following table outlines the fields included when Traceable detects a new domain associated with API traffic, along with their respective data types and descriptions.
eventType
String
Identifies the event as DOMAIN_DISCOVERY.
domainName
String
Fully qualified domain name (FQDN) of the newly discovered domain observed in API traffic.
3. Environment entity change notification type
The following table outlines the fields included when the operational state of an environment changes, along with their respective data types and descriptions.
eventType
String
Identifies the event as ENVIRONMENT_ENTITY_CHANGE.
previousStatus
String
Previous operational status of the environment (for example, ACTIVE, INACTIVE).
currentStatus
String
Updated operational status of the environment after the change.
Sensitive Data Notification Type
1. Sensitive data discovery notification type
It is triggered when sensitive data is detected in API requests or responses, including data sent to third-party backends, providing visibility for monitoring and compliance. The following table outlines the fields included when sensitive data types are detected in API requests or response payloads, along with their respective data types and descriptions.
eventType
String
Identifies the event as SENSITIVE_DATA_DISCOVERY.
sensitiveData
Set
Collection of sensitive data types detected in the API traffic (for example, EMAIL, CREDIT_CARD, SSN, API_KEY).
apiName
String
Name of the API endpoint where the sensitive data was discovered, including HTTP method and path.
2. Sensitive data third-party API notification type
It is triggered when sensitive data is detected in API requests or responses, including data sent to third-party backends, providing visibility for monitoring and compliance. The following table outlines the fields included when sensitive data is observed being transmitted to or from a third-party backend system, along with their respective data types and descriptions.
eventType
String
Identifies the event as SENSITIVE_DATA_THIRD_PARTY_API.
sensitiveData
Set
Collection of sensitive data types detected in traffic involving the third-party backend.
backendName
String
Name of the third-party backend system associated with the detected sensitive data exposure.
Third-party discovery notification type
The following table outlines the fields included when Traceable detects a previously unknown third-party API endpoint communicating with your environment, along with their respective data types and descriptions.
1. Third-party API discovery notification type
eventType
String
Identifies the event as THIRD_PARTY_API_DISCOVERY.
thirdPartyApiName
String
Name of the discovered third-party API endpoint, including identifying details such as domain or API path if available.
2. Third-party discovery notification type
The following table outlines the fields included when a new third-party service or provider is identified based on API traffic patterns, along with their respective data types and descriptions.
eventType
String
Identifies the event as THIRD_PARTY_DISCOVERY.
thirdPartyName
String
Name of the external third-party service, vendor, or provider detected in traffic.
Blocked notification type
It provides enriched context, including client intelligence, API metadata, threat scoring, and data classification signals. The following table outlines the fields included when Traceable actively blocks an API request due to a policy violation, detected attack, threat actor enforcement, or risk-based protection rule, along with their respective data types and descriptions:
eventType
String
Identifies the event as BLOCKED_EVENT.
blockingRuleName
String
Name of the rule or policy responsible for blocking the request.
clientIp
String
Source IP address of the client that initiated the request.
clientIpAsn
String
Autonomous System Number (ASN) associated with the client IP.
clientIpOrganisation
String
Organization or ISP associated with the client's IP address.
clientIpReputation
Enum
Reputation level assigned to the client IP (for example, TRUSTED, SUSPICIOUS, MALICIOUS).
clientIpTypes
String
Classification of the IP type (for example, DATA_CENTER, RESIDENTIAL, PROXY, TOR).
clientIpConnectionType
String
Network connection type (for example, broadband, mobile, hosting provider).
blockedActorId
String
Identifier of the threat actor entity associated with the blocked request.
blockedEventType
Enum
Type of security or policy event that resulted in the block.
blockedEventId
String
Unique identifier of the underlying event that triggered the block action.
spanId
String
Distributed tracing span identifier for request correlation.
userAgent
String
User-Agent header string from the client request.
userDevice
String
Parsed device or client platform information.
serviceName
String
Name of the service handling the API request.
apiName
String
Name of the API endpoint (HTTP method and path).
uri
String
Complete request URI path.
statusCode
String
HTTP response status code returned after blocking (typically 403).
description
String
Human-readable description of why the request was blocked.
clientGeoLocation
String
Geographic location derived from the client IP address.
severity
Enum
Severity level assigned to the blocked event (LOW, MEDIUM, HIGH, CRITICAL).
impactLevel
Enum
Business or security impact level of the event.
confidenceLevel
Enum
Confidence level indicating detection certainty.
apiRiskScore
Double
Risk score assigned to the affected API.
apiRiskCategory
String
Risk classification category of the API (for example, HIGH_RISK, MEDIUM_RISK).
requestDatatypeNames
String
Sensitive data types detected in the request payload.
responseDatatypeNames
String
Sensitive data types detected in the response payload.
requestDatasetNames
String
Identified datasets present in the request payload.
responseDatasetNames
String
Identified datasets present in the response payload.
threatActorScore
Integer
Risk score assigned to the associated threat actor.
scanner
String
Identified scanner or automation tool (if applicable).
dataSuppressions
String
Data suppression policies applied to the event.
apiLabels
String
Labels or tags associated with the API.
apiIsExternal
Boolean
Indicates whether the API is externally exposed.
Sample JSON
Security notification type
It is triggered when Traceable detects suspicious or malicious activity, providing detailed context on the API, the client, and the associated risk to support monitoring, investigation, and response. The following table outlines the fields included when Traceable detects suspicious or malicious activity based on configured security rules, behavioral analytics, or threat intelligence signals, along with their respective data types and descriptions.
eventType
String
Identifies the event as SECURITY_EVENT.
ruleName
String
Name of the security rule that triggered the detection.
eventId
String
Unique identifier of the security event.
securityEventType
Enum
Classification of the security event (for example, ATTACK_DETECTED, POLICY_VIOLATION, ANOMALY).
severity
Enum
Severity level assigned to the event (LOW, MEDIUM, HIGH, CRITICAL).
uri
String
Complete request URI path associated with the event.
statusCode
Integer
HTTP response status code returned for the request.
userId
String
Authenticated user identifier associated with the request, if available.
userAgent
String
User-Agent header string from the client request.
clientIpAddress
String
Source IP address of the client request.
clientGeoLocation
String
Geographic location derived from the client IP address.
clientIpAsn
String
Autonomous System Number (ASN) associated with the client IP.
clientIpOrganisation
String
Organization or ISP associated with the client's IP address.
clientIpReputation
Enum
Reputation level assigned to the client IP (for example, TRUSTED, SUSPICIOUS, MALICIOUS).
clientIpTypes
String
Classification of IP type (for example, DATA_CENTER, RESIDENTIAL, PROXY, TOR).
clientIpConnectionType
String
Network connection type for the client's IP address
spanId
String
Distributed tracing span identifier used for correlating requests across services.
serviceName
String
Name of the service that handled the request.
apiName
String
Name of the API endpoint (HTTP method and path).
description
String
Human-readable explanation of the detected activity.
userDevice
String
Parsed client device or platform information.
sessionId
String
Session identifier associated with the user request, if available.
impactLevel
Enum
Business or security impact level of the event.
confidenceLevel
Enum
Confidence score indicating detection accuracy.
apiRiskScore
Double
Risk score assigned to the affected API.
apiRiskCategory
String
Risk classification category of the API (for example, HIGH_RISK).
requestDatatypeNames
String
Sensitive data types identified in the request payload.
responseDatatypeNames
String
Sensitive data types identified in the response payload.
requestDatasetNames
String
Identified datasets present in the request payload.
responseDatasetNames
String
Identified datasets present in the response payload.
threatActorScore
Integer
Risk score assigned to the associated threat actor.
scanner
String
Identified scanner or automation tool involved in the activity (if applicable).
dataSuppressions
String
Data suppression policies applied to the event.
apiLabels
String
Labels or tags associated with the API endpoint.
apiIsExternal
Boolean
Indicates whether the API endpoint is externally exposed.
Sample JSON
Vulnerability notification type
It provides visibility into newly identified API vulnerabilities and status changes for existing vulnerabilities within the Traceable platform. The following table outlines the fields included in this notification type, along with their respective data types and descriptions.
1. Vulnerability discovery
The following table outlines the fields included when a vulnerability is detected in an API endpoint during security analysis, along with their respective data types and descriptions.
eventType
String
Identifies the event as VULNERABILITY_DISCOVERY.
vulnerabilityCategory
String
Classification of the detected vulnerability (for example, SQL_INJECTION, BROKEN_AUTHENTICATION, DATA_EXPOSURE).
vulnerabilitySeverity
String
Severity level assigned to the vulnerability based on risk assessment (for example, LOW, MEDIUM, HIGH, CRITICAL).
apiName
String
Name of the affected API endpoint, including HTTP method and path.
2. Vulnerability status change
The following table outlines the fields included when the lifecycle state of a previously identified vulnerability changes, along with their respective data types and descriptions.
eventType
String
Identifies the event as VULNERABILITY_STATUS_CHANGE.
vulnerabilityCategory
String
Classification of the vulnerability whose status has changed.
vulnerabilitySeverity
String
Severity level associated with the vulnerability.
apiName
String
Name of the affected API endpoint.
oldStatus
String
Previous lifecycle state of the vulnerability (for example, OPEN, IN_PROGRESS, RESOLVED).
newStatus
String
Updated lifecycle state of the vulnerability after the change.
Threat actor change
These events provide visibility into changes in a threat actor’s severity classification or operational state within the Traceable platform. They help security teams track risk evolution and enforcement actions. The following table outlines the fields included in this notification type, along with their respective data types and descriptions.
1. Threat actor severity change
Triggered when the calculated severity level of a threat actor changes based on updated risk signals, behavior, or intelligence.
eventType
String
Identifies the event as THREAT_ACTOR_SEVERITY_CHANGE.
threatActorId
String
Unique identifier assigned to the threat actor within the platform.
threatActorIp
String
IP address associated with the threat actor.
threatActorOldSeverity
String
Previous severity classification (for example, LOW, MEDIUM, HIGH, CRITICAL).
threatActorNewSeverity
String
Updated severity classification after reassessment.
actorGeolocation
String
Geographic location associated with the threat actor’s IP address.
threatActorEntityId
String
Internal entity identifier linked to the threat actor.
threatActorOldIpReputationLevel
String
Previous IP reputation level (for example, TRUSTED, SUSPICIOUS, MALICIOUS).
threatActorNewIpReputationLevel
String
Updated IP reputation level based on latest intelligence.
Sample JSON
2. Threat actor state change
The following table outlines the fields included when the operational state of a threat actor changes, either automatically (for example, due to policy enforcement) or manually by a user, along with their respective data types and descriptions.
eventType
String
Identifies the event as THREAT_ACTOR_STATE_CHANGE.
threatActorId
String
Unique identifier assigned to the threat actor.
changeReason
String
Explanation for the state change (for example, policy enforcement, manual override).
threatActorIp
String
IP address associated with the threat actor.
threatActorOldState
String
Previous operational state (for example, MONITORED, BLOCKED, ALLOWED).
threatActorNewState
String
Updated operational state after the change.
changeInitiator
String
User or system component responsible for initiating the change.
actorGeoLocation
String
Geographic location associated with the actor’s IP.
threatActorGeoLocation
String
Geographic location recorded for the threat actor entity (if different from actorGeoLocation).
threatActorEntityId
String
Internal entity identifier associated with the threat actor.
Sample JSON
Bot detection notification type
This event is triggered when fraudulent bot activity is detected, providing the entity, severity, risk score, and type of bot attack for monitoring and investigation. The following table outlines the fields for this notification type, along with their data types and descriptions.
entityName
String
Entity identifier
entityType
String
Type of entity
severity
String
Bot severity
riskScore
Integer
Bot risk score
The following is a sample JSON for all the events mentioned above:
Bot actor notification type
It is triggered when Traceable detects bot activity attributable to a specific actor, such as an IP address, based on a configured bot policy. The following table outlines the fields included in this notification type, along with their respective data types and descriptions.
Field
Type
Description
eventType
String
Identifies the event as BOT_ACTOR_EVENT.
identity
String
Identifier of the actor associated with the event (for example, an IP address).
identityType
String
Type of identity represented.
identityKind
String
Identifies the entity as an actor. Always ACTOR for this event type.
threatType
String
Bot policy classification associated with the detected activity.
target
String
API endpoint targeted by the actor.
sourcePolicyId
String
Unique identifier of the policy that triggered the event.
sourcePolicyName
String
Name of the policy that triggered the event.
riskScore
Integer
Risk score assigned to the actor.
Sample JSON
Bot account notification type
It is triggered when Traceable detects bot activity attributable to a specific account, based on a configured bot policy. The following table outlines the fields included in this notification type, along with their respective data types and descriptions.
Field
Type
Description
eventType
String
Identifies the event as BOT_ACCOUNT_EVENT.
identity
String
Identifier of the account associated with the event.
identityType
String
Type of identity represented (for example, USER_DETAILS).
identityKind
String
Identifies the entity as an account. Always ACCOUNT for this event type.
threatType
String
Bot policy classification associated with the detected activity.
target
String
API endpoint targeted by the account.
sourcePolicyId
String
Unique identifier of the policy that triggered the event.
sourcePolicyName
String
Name of the policy that triggered the event.
riskScore
Integer
Risk score assigned to the account.
Sample JSON
Bot activity notification type
It is triggered when Traceable aggregates bot-related events into an incident, providing a consolidated view of the policy and target associated with the activity. Unlike the bot actor and bot account notification types, this event does not include identity or risk score fields, and its linkToEvent field opens the incident detail sheet rather than an actor or account detail sheet. The following table outlines the fields included in this notification type, along with their respective data types and descriptions.
Field
Type
Description
eventType
String
Identifies the event as BOT_ACTIVITY_EVENT.
incidentId
String
Unique identifier of the aggregated incident.
threatType
String
Bot policy classification associated with the incident.
sourcePolicyId
String
Unique identifier of the policy that triggered the event.
sourcePolicyName
String
Name of the policy that triggered the event.
target
String
API endpoint associated with the incident.
Sample JSON
Risk score change notification type
This event is triggered when an API’s risk score changes, providing visibility into updated risk levels and categories for monitoring and response. The following table outlines the fields included in this notification type, along with their respective data types and descriptions.
apiName
String
Contains the affected API.
oldScore
Integer
Contains the previous risk score.
newScore
Integer
Includes the updated risk score.
riskCategory
String
Consists of the updated category.
Sample JSON
Team activity notification type
This event tracks user actions for auditing, compliance, and operational monitoring. The following table outlines the fields included when a user acts within the Traceable platform, such as creating, modifying, or deleting a configuration, along with their respective data types and descriptions.
eventType
String
Identifies the event as TEAM_ACTIVITY.
tenantId
String
Unique identifier of the tenant. For this event type, the field is explicitly included in the payload, even if it is ignored in other base alert contexts.
userName
String
Full name of the user who acted.
userEmail
String
Email address of the user who initiated the activity.
summary
String
High-level summary of the activity performed.
action
String
Type of action executed (for example, CREATE, UPDATE, DELETE).
details
String
Additional contextual information describing the activity in detail.
Service discovery notification type
This event helps organizations maintain an accurate inventory of services participating in API communication within their environment. The following table outlines the fields included when Traceable detects a previously unknown service based on observed API traffic, along with their respective data types and descriptions.
eventType
String
Identifies the event as SERVICE_DISCOVERY.
serviceName
String
Name of the newly discovered service observed in API traffic.
Last updated
Was this helpful?