turbot/mongodbatlas
steampipe plugin install mongodbatlas

Table: mongodbatlas_org_event - Query MongoDB Atlas Organization Events using SQL

MongoDB Atlas Organization Events is a feature that allows you to track and monitor various activities within your organization. It provides a comprehensive view of the actions performed by users and teams, and the responses to these actions. This feature plays a crucial role in maintaining the security and integrity of your organization's data in MongoDB Atlas.

Table Usage Guide

The mongodbatlas_org_event table provides insights into event activities within MongoDB Atlas. As an administrator or security professional, you can utilize this table to monitor user activities, track changes, and ensure compliance across your organization. It can be particularly useful for auditing purposes, allowing you to identify any unusual or suspicious actions.

Examples

Basic info

Explore which events are occurring within your MongoDB Atlas organization. This allows you to identify the associated project and target user, providing insights into user activity and project engagement.

select
id,
event_type_name,
project_id,
target_username
from
mongodbatlas_org_event;
select
id,
event_type_name,
project_id,
target_username
from
mongodbatlas_org_event;

List all events raised by a specific user

Explore which events have been triggered by a specific user within your organization. This is particularly useful for auditing user activity and understanding individual user behavior.

select
id,
event_type_name
from
mongodbatlas_org_event
where
target_username = 'billy@example.com';
select
id,
event_type_name
from
mongodbatlas_org_event
where
target_username = 'billy@example.com';

List all events where a user has joined a project in the last 24 hours

Determine the instances where a user has joined a project in the past day. This can be useful for tracking user activity and engagement within a specific time frame.

select
id,
event_type_name,
target_username
from
mongodbatlas_org_event
where
event_type_name = 'JOINED_GROUP'
and created > (now() - INTERVAL '24 hours');
select
id,
event_type_name,
target_username
from
mongodbatlas_org_event
where
event_type_name = 'JOINED_GROUP'
and created > datetime('now', '-24 hours');

Check if daily bill has exceeded set threshold

Explore how often your daily bill has surpassed a predetermined limit, offering a way to monitor your expenses and manage your budget effectively. This helps in keeping track of your spending and avoiding unexpected high costs.

select
count(id)
from
mongodbatlas_org_event
where
event_type_name = 'DAILY_BILL_OVER_THRESHOLD';
select
count(id)
from
mongodbatlas_org_event
where
event_type_name = 'DAILY_BILL_OVER_THRESHOLD';

Schema for mongodbatlas_org_event

NameTypeOperatorsDescription
_ctxjsonbSteampipe context in JSON form.
alert_config_idtextUnique identifier for the alert configuration associated to the alertId.
alert_idtext=Unique identifier for the alert associated with the event.
api_key_idtextUnique identifier for the API Key that triggered the event. If this field is present in the response, Atlas does not return the userId field.
collectiontextName of the collection on which the event occurred. This field can be present when the eventTypeName is either DATA_EXPLORER or DATA_EXPLORER_CRUD.
createdtimestamp with time zone>, >=, =, <, <=UTC date when the event occurred.
current_valuejsonbDescribes the value of the metricName at the time of the event.
databasetextName of the database on which the event occurred. This field can be present when the eventTypeName is either DATA_EXPLORER or DATA_EXPLORER_CRUD.
event_type_nametextHuman-readable label that indicates the type of event.
hostnametextThe hostname of the Atlas host machine associated to the event.
idtextUnique identifier for the event.
invoice_idtextThe unique identifier of the invoice associated to the event.
is_global_adminbooleanIndicates whether the user who triggered the event is a MongoDB employee.
linksjsonbOne or more uniform resource locators that link to sub-resources and/or related resources. The Web Linking Specification explains the relation-types between URLs.
metric_nametextThe name of the metric associated to the alertId.
op_typetextType of operation that occurred. This field is present when the eventTypeName is either DATA_EXPLORER or DATA_EXPLORER_CRUD.
org_idtext=The unique identifier for the organization in which the event occurred.
organization_idtext=, !=, ~~, ~~*, !~~, !~~*Unique identifier for the organization.
payment_idtextThe unique identifier of the invoice payment associated to the event.
portbigintThe port on which the mongod or mongos listens.
project_idtextThe unique identifier for the project in which the event occurred.
public_keytextPublic key associated with the API Key that triggered the event. If this field is present in the response, Atlas does not return the 'username' field.
remote_addresstextIP address of the userId Atlas user who triggered the event.
replica_set_nametextThe name of the replica set associated to the event.
shard_nametextThe name of the shard associated to the event.
sp_connection_nametext=, !=, ~~, ~~*, !~~, !~~*Steampipe connection name.
sp_ctxjsonbSteampipe context in JSON form.
target_public_keytextThe public key of the API Key targeted by the event.
target_usernametextThe username for the Atlas user targeted by the event.
team_idtextThe unique identifier for the Atlas team associated to the event.
titletextTitle of the resource.
user_idtextThe unique identifier for the Atlas user who triggered the event. If this field is present in the response, Atlas does not return the apiKeyId field.
usernametextThe username for the Atlas user who triggered the event. If this field is present in the response, Atlas does not return the publicKey field.
whitelist_entrytextThe white list entry of the API Key targeted by the event.

Export

This table is available as a standalone Exporter CLI. Steampipe exporters are stand-alone binaries that allow you to extract data using Steampipe plugins without a database.

You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_export_installer.sh script:

/bin/sh -c "$(curl -fsSL https://steampipe.io/install/export.sh)" -- mongodbatlas

You can pass the configuration to the command with the --config argument:

steampipe_export_mongodbatlas --config '<your_config>' mongodbatlas_org_event