Posture Management
Event codes
Updated: June 19, 2025
The tables below detail all the types of events currently generated by the FireTail platform.
Each event code consists of:
- A prefix corresponding to the resource the event pertains to.
- A colon, used as a separator character.
- A suffix describing a change that has occurred on that resource.
AWS Gateway
Events prefixed with AWS_API_GATEWAY_V1 or AWS_API_GATEWAY_V2 relates to the API Gateway version 1 or version 2.
| Event | Description |
|---|---|
| API_GATEWAYS_RENAMED | Created when an API Gateway v1 or v2 is renamed in AWS. |
| NEW_DISCOVERED_ENDPOINTS_MISSING_ACCESS_LOGGING | Created when new endpoints are discovered on an API Gateway v1 or v2 which are missing access logging. |
| NEW_DISCOVERED_ENDPOINTS | Created when new endpoints are discovered on an API Gateway v1 or v2. |
| NEW_STAGES | Created when new stages are discovered on an API Gateway v1 or v2. |
| REMOVED_DISCOVERED_ENDPOINTS_MISSING_ACCESS_LOGGING | Created when endpoints missing access logging are removed from an API Gateway v1 or v2. |
| REMOVED_DISCOVERED_ENDPOINTS | Created when endpoints are removed from an API Gateway v1 or v2. |
| REMOVED_STAGES | Created when a stage is removed from an API Gateway v1 or v2. |
| STAGES_WAF_CHANGED | Created when there is a WAF setting change on an AWS API Gateway V1 stage. |
| STAGES_DEPLOYMENTS_DESCRIPTIONS_CHANGED | Created when the description of a stage is changed on an API Gateway v1 or v2. |
| STAGES_DEPLOYMENTS_STATUSES_CHANGED | Created when the status of a stage deployment changes on an API Gateway v1 or v2. |
| STAGES_EXPORT_VERSIONS_CHANGED | Created when the export version of a stage is changed on an API Gateway v1 or v2. |
| STAGES_NEW_DEPLOYMENTS | Created when a new stage is created on an API Gateway v1 or v2. |
| STAGES_REMOVED_DEPLOYMENTS | Created when a deployment is removed from a stage of an API Gateway v1 or v2. |
| TAGS_CHANGED | Created when the tags of an API Gateway v1 or v2 are changed. |
| IAM_POLICY_CHANGED | Created when a change is detected in the IAM policy attached to an AWS API Gateway. |
AWS Lambda
Events prefixed with AWS_LAMBDA relates to AWS Lambda items in the FireTail SaaS platform.
| Event | Description |
|---|---|
| NEW_DISCOVERED_URLS | Created when a new function URL is discovered on an AWS Lambda. |
| NEW_URLS_MISSING_CORS | Created when a new function URL missing a CORS configuration is discovered on an AWS Lambda. |
| NEW_URLS_MISSING_AUTH | Created when a new function URL with no Auth is discovered on an AWS Lambda. |
| REMOVED_DISCOVERED_URLS | Created when an AWS Lambda Function URL that was previously discovered has been deleted. |
| REMOVED_URLS_MISSING_CORS | Created when an AWS Lambda Function URL missing a CORS configuration that was previously discovered has been deleted. |
| REMOVED_URLS_MISSING_AUTH | Created when an AWS Lambda Function URL missing an Auth configuration that was previously discovered has been deleted. |
| RENAMED | Created when an AWS Lambda Function has been renamed since it was last scanned. |
| TAGS_CHANGED | Created when the tags on an AWS Lambda Function have changed since it was last scanned. |
AWS Lambda API
Events prefixed with AWS_LAMBDA_API relates to AWS Lambda API items in the FireTail SaaS platform.
| Event | Description |
|---|---|
| NEW_DISCOVERED_URLS | This event is generated when new URLs are discovered in an AWS Lambda function API. |
| NEW_URLS_MISSING_CORS | This event is generated when a function URL API missing a CORS configuration is discovered on an AWS Lambda |
| NEW_URLS_MISSING_AUTH | This event is generated when a function API URL with no Auth is discovered in AWS Lambda. |
Specifications
Events prefixed with SPECIFICATION relates to specification items in the FireTail SaaS platform.
| Event | Description |
|---|---|
| CREATED | This event is created when a new specification item is created in the FireTail SaaS platform. |
| DELETED | This event is created when a specification item is deleted in the FireTail SaaS platform. |
| LATEST_VERSION_CHANGED | This event is created when the latest version of a specification item in the FireTail SaaS platform is changed. |
| RENAMED | This event is created when a specification item is renamed in the FireTail SaaS platform. |
Specification version
Events prefixed with SPECIFICATION_VERSION relates to specification items in the FireTail SaaS platform.
| Event | Description |
|---|---|
| CREATED | This event is created when a new specification version item is created in the FireTail SaaS platform. |
| DELETED | This event is created when a specification version item is deleted in the FireTail SaaS platform. |
Log Analysis
Events prefixed with LOG_ANALYSIS relate to one or many of the logs belonging to an API.
| Event | Description |
|---|---|
| 5XX_STATUS_CODES_HIGH | This event is created when >=90% of all the logs over a given time period had a 5XX response status code. |
| NEW_DAILY_METRICS | Created on a daily basis when log analysis is run to create a new set of log metrics. |
AWS AppSync
Events prefixed with AWS_APPSYNC_API relates to AWS AppSync API items.
| Event | Description |
|---|---|
| AUTHENTICATION_TYPE_CHANGED | This event is created when a authentication type has changed. |
| LOG_CONFIG_CHANGED | This event is created when a log config has been changed. |
| NAME_CHANGED | This event is created when the named has been changed. |
| NEW_DISCOVERED_ENDPOINTS | This event is created when new endpoints have been discovered. |
| REMOVED_DISCOVERED_ENDPOINTS | This event is created when discovered endpoints have been removed. |
| SCHEMA_HASH_CHANGED | This event is created when the schema hash has been changed. |
| TAGS_CHANGED | This event is created when tags have been changed. |
| RESOLVER_COUNT_LIMIT_CHANGED | This event is created when the resolver count limit of an AWS AppSync API has been changed. |
| QUERY_DEPTH_LIMIT_CHANGED | This event is created when the query depth limit of an AWS AppSync API has been changed. |
| INTROSPECTION_CONFIG_CHANGED | This event is created when there is an introspection config change on the AWS AppSync API. |
| ADDITIONAL_AUTH_TYPES_CHANGED | This event is created when there is additional Auth setting changes on the AWS AppSync API. |
Events prefixed with INCIDENT relates to Incident items in the FireTail SaaS platform.
| Event | Description |
|---|---|
| CREATED | This event is created when an incident is created. |
| CLOSED | This event is created when an incident is closed. |
| REOPENED | This event is created when an incident is reopened. |
Incidents Policy
Events prefixed with INCIDENT_POLICY relates to Incident Policy items in the FireTail SaaS platform.
| Event | Description |
|---|---|
| CREATED | This event is created when an incident policy is created. |
| DELETED | This event is created when an incident policy is deleted. |
| RENAMED | This event is created when an incident policy is renamed. |
| MINIMUM_SEVERITIES_CHANGED | This event is created when the minimum severities of an incident policy is changed. |
| FREQUENCY_CHANGED | This event is created when the frequency of an incident policy is changed. |
| PERIOD_CHANGED | This event is created when the period of an incident policy is changed. |
API
Events prefixed with API relates to API items in the FireTail SaaS platform.
| Event | Description |
|---|---|
| CREATED | This event is created when a new API is created. |
| DELETED | This event is created when an API is deleted. |
| RENAMED | This event is created when an API is renamed. |
Integration
Events prefixed with INTEGRATION relates to integration items in the FireTail SaaS platform.
| Event | Description |
|---|---|
| CREATED | This event is created when a new Integration is created. |
| DELETED | This event is created when an Integration is deleted. |
Alert
Events prefixed with ALERT relates to Alert items in the FireTail SaaS platform.
| Event | Description |
|---|---|
| CREATED | This event is created when a new Alert is created. |
| DELETED | This event is created when an Alert is deleted. |
App
Events prefixed with APP relates to App items in the FireTail SaaS platform.
| Event | Description |
|---|---|
| CREATED | This event is created when a new App is created. |
| MODIFIED | This event is created when a new App is created. |
| DELETED | This event is created when an App is deleted. |
Org
Events prefixed with ORG relates to Organization items in the FireTail SaaS platform.
| Event | Description |
|---|---|
| CREATED | This event is created when a new Organization is created. |
| DELETED | This event is created when an Organization is deleted. |
AI event codes
| Event | Description |
|---|---|
| PAAS_LLM:DELETED | This event is generated when a platform-based AI model is deleted. |
| PAAS_LLM:DISCOVERED | This event is generated when a platform-based AI model is discovered. |
| PAAS_PROMPT:DELETED | This event is generated when an AI prompt is deleted from a platform-based environment. The prompt may include multiple individual message items. |
| PAAS_PROMPT:DISCOVERED | This event is generated when a platform-based AI prompt is discovered. The prompt may include multiple individual message items. |
| PAAS_PROMPT:MESSAGES_DISCOVERED | This event is generated when messages of a platform-based AI prompt are discovered. The prompt may include multiple individual message items. |
| PAAS_PROMPT:MESSAGES_REMOVED | This event is generated when the messages of a platform-based AI prompt are removed. The prompt may include multiple individual message items. |
| PAAS_PROMPT:OBSERVED_TAGS_CHANGED | This event is generated when the tags associated with a platform-based AI prompt are modified or updated. |
| PAAS_LLM:OBSERVED_TAGS_CHANGED | This event is triggered when the tags associated with a platform-based Large Language Model (LLM) are modified or updated. |
| SOFTWARE_LLM:DELETED | This event is generated when an AI model is deleted from a code repository. |
| SOFTWARE_LLM:DISCOVERED | This event is generated when an AI model is discovered in a code repository. |
| SOFTWARE_PROMPT:DELETED | This event is generated when an AI prompt is deleted from a code repository. The prompt may include multiple individual message items. |
| SOFTWARE_PROMPT:DISCOVERED | This event is generated when an AI prompt is discovered in a code repository. The prompt may include multiple individual message items. |
| SOFTWARE_PROMPT:MESSAGES_DISCOVERED | This event is generated when the child messages of an AI prompt are discovered in a code repository. The prompt may include multiple individual message items. |
| SOFTWARE_PROMPT:MESSAGES_REMOVED | This event is generated when the child messages of an AI prompt are removed from a code repository. |
Deprecated events
- AWS_API_GATEWAY_V1:CREATED
- AWS_API_GATEWAY_V1:DELETED
- AWS_API_GATEWAY_V2:CREATED
- AWS_API_GATEWAY_V2:DELETED
- AWS_LAMBDA_API:CREATED
- AWS_LAMBDA_API:DELETED
- AWS_APPSYNC_API:CREATED
- AWS_APPSYNC_API:DELETED