Cursor Logs (Beta)

Connecting Cursor logs to your Panther Console

Overview

Cursor Audit log ingestion is in open beta starting with Panther version 1.126, and is available to all customers. Please share any bug reports and feature requests with your Panther support team.

Panther supports ingesting Cursor logs by configuring a Cursor webhook to post events to an HTTP endpoint in Panther.

How to onboard Cursor logs to Panther

Prerequisites

An active Cursor Enterprise subscription with administrative access

Step 1: Create a new Cursor source in Panther

In the left-side navigation bar of your Panther Console, click Log Sources.
Click Create New.
Search for “Cursor” then click its tile.
In the upper-right corner, click Start Setup.
Follow Panther's instructions for configuring an HTTP Source, beginning at Step 5.
- When setting the Auth method, you will be required to use Bearer.
- Payloads sent to this source are subject to the payload requirements for all HTTP sources.
- Do not proceed to the next step until the creation of your HTTP endpoint has completed.

Step 2: Enable Streaming Audit Logs in Cursor

Once your Panther HTTP endpoint is ready, contact the Cursor support team at hi@cursor.com from an administrative email address and request activation of streaming audit logs for your account.

Include the following information in your request:

Your Enterprise team information (team name or admin contact)
Your Panther HTTP webhook URL (from Step 1)
Your Bearer token value used in Panther configuration (you can use whichever secure method your team prefers, for example, a password manager share link or an encrypted file).

Once Cursor support confirms that streaming has been enabled, return to your Panther Console and verify that audit log events are being received successfully.

Supported log types

Cursor.Audit

Audit logs provide a record of security events and administrative actions that can help you meet compliance requirements and investigate security incidents.

For more information, see the Cursor Compliance and Monitoring page.

schema: Cursor.Audit
description: Audit logs provide a record of security events and administrative actions which help you meet compliance requirements and investigate security incidents.
referenceURL: https://cursor.com/docs/enterprise/compliance-and-monitoring
fields:
  - name: add_user
    description: Details about a user being added to the team
    type: object
    fields:
      - name: source
        description: How the user was added (e.g. autoEnroll, sso)
        type: string
      - name: team_id
        description: Team ID the user was added to
        type: string
      - name: user_email
        description: Email of the user being added
        type: string
        indicators:
          - email
      - name: invited_by_user_id
        description: User ID of the person who invited
        type: string
      - name: role
        description: Role assigned to the new user
        type: string
  - name: api_key
    description: Details about a service account API key action
    type: object
    fields:
      - name: action
        description: Action performed on the API key (e.g. create)
        type: string
      - name: api_key_id
        description: Unique identifier of the API key
        type: string
      - name: repo_scope_enabled
        description: Whether repository scope is enabled for the key
        type: boolean
      - name: service_account_id
        description: ID of the service account the key belongs to
        type: string
      - name: service_account_name
        description: Name of the service account the key belongs to
        type: string
  - name: bugbot_team_settings
    description: Bugbot team settings changes
    type: object
    fields:
      - name: new_value
        description: New Bugbot team settings value
        type: string
      - name: setting_name
        description: Setting name
        type: string
  - name: invite_email_sent
    description: Details about an invite email being sent
    type: object
    fields:
      - name: invite_id
        description: Unique identifier of the invite
        type: string
      - name: personal_message
        description: Whether a personal message was included
        type: string
      - name: recipient_email
        description: Email address of the invite recipient
        type: string
        indicators:
          - email
      - name: role
        description: Role granted by the invite
        type: string
      - name: sender_email
        description: Email address of the invite sender
        type: string
        indicators:
          - email
      - name: sender_user_id
        description: User ID of the invite sender
        type: string
  - name: invite_link
    description: Details about an invite link action
    type: object
    fields:
      - name: action
        description: Action performed on the invite link (e.g. create)
        type: string
      - name: creator_email
        description: Email of the invite link creator
        type: string
        indicators:
          - email
      - name: creator_user_id
        description: User ID of the invite link creator
        type: string
      - name: expires_in_seconds
        description: Expiry duration of the invite link in seconds
        type: bigint
      - name: invite_id
        description: Unique identifier for the invite link
        type: string
      - name: role
        description: Role granted by the invite link
        type: string
  - name: ip_address
    description: IP address of the actor
    type: string
    indicators:
      - ip
  - name: login
    description: Details about a login event
    type: object
    fields:
      - name: login_type
        description: Type of login (e.g. LOGIN_TYPE_WEB)
        type: string
      - name: success
        description: Whether the login was successful
        type: boolean
  - name: mcp_server_config
    description: Details about an MCP server configuration change
    type: object
    fields:
      - name: action
        description: Action performed on the MCP server (e.g. create, delete)
        type: string
      - name: scope
        description: Scope of the MCP server config (e.g. user, team)
        type: string
      - name: server_name
        description: Name of the MCP server
        type: string
      - name: server_type
        description: Type of MCP server (e.g. HTTP)
        type: string
  - name: metadata
    description: Request and context metadata
    type: object
    fields:
      - name: id
        description: Unique event ID
        type: string
        indicators:
          - trace_id
      - name: timestamp
        required: true
        description: Timestamp of the event
        type: timestamp
        timeFormats:
          - rfc3339
        isEventTime: true
      - name: context
        description: Request context
        type: object
        fields:
          - name: auth_id
            description: Authenticated user ID
            type: string
            indicators:
              - actor_id
          - name: ghost_mode
            description: Whether ghost mode was active
            type: boolean
          - name: privacy_mode
            description: Privacy mode setting
            type: string
          - name: request_id
            description: Unique request ID
            type: string
            indicators:
              - trace_id
  - name: remove_user
    description: Details about a user being removed from the team
    type: object
    fields:
      - name: user_email
        description: Email of the user being removed
        type: string
        indicators:
          - email
  - name: service_account
    description: Details about a service account action
    type: object
    fields:
      - name: action
        description: Action performed on the service account (e.g. create, archive)
        type: string
      - name: service_account_id
        description: Unique identifier of the service account
        type: string
      - name: service_account_name
        description: Name of the service account
        type: string
  - name: team_api_key
    description: Details about a team API key action
    type: object
    fields:
      - name: action
        description: Action performed on the API key (e.g. revoke)
        type: string
  - name: team_command
    description: Details about a team command action
    type: object
    fields:
      - name: action
        description: Action performed on the command (e.g. create, delete)
        type: string
      - name: command_id
        description: Unique identifier of the command
        type: string
      - name: command_name
        description: Name of the command
        type: string
      - name: is_active
        description: Whether the command is active
        type: boolean
  - name: team_hook
    description: Details about a team hook action
    type: object
    fields:
      - name: action
        description: Action performed on the hook (e.g. create, delete)
        type: string
      - name: hook_id
        description: Unique identifier of the hook
        type: string
      - name: hook_step
        description: Step at which the hook executes (e.g. beforeShellExecution)
        type: string
      - name: hook_type
        description: Type of hook (e.g. command)
        type: string
      - name: is_active
        description: Whether the hook is active
        type: boolean
      - name: operating_systems
        description: Operating systems the hook applies to
        type: array
        element:
          type: string
      - name: script_content
        description: Content of the hook script
        type: string
      - name: script_name
        description: Name of the hook script
        type: string
  - name: team_id
    description: Unique identifier of the team
    type: string
  - name: team_marketplace
    description: Details about a team marketplace action
    type: object
    fields:
      - name: action
        description: Action performed on the marketplace (e.g. create)
        type: string
      - name: marketplace_id
        description: Unique identifier of the marketplace
        type: string
      - name: marketplace_name
        description: Internal name of the marketplace
        type: string
      - name: marketplace_display_name
        description: Display name of the marketplace
        type: string
      - name: new_auto_reindex
        description: New auto-reindex setting
        type: boolean
      - name: old_auto_reindex
        description: Previous auto-reindex setting
        type: boolean
      - name: plugin_id
        description: ID of the plugin involved
        type: string
      - name: plugins_created
        description: Number of plugins created
        type: int
      - name: plugins_deprecated
        description: Number of plugins deprecated
        type: int
      - name: plugins_indexed
        description: Number of plugins indexed
        type: int
      - name: plugins_updated
        description: Number of plugins updated
        type: int
      - name: team_id
        description: Team ID associated with the marketplace
        type: string
  - name: team_rule
    description: Details about a team rule action
    type: object
    fields:
      - name: action
        description: Action performed on the rule (e.g. create, delete)
        type: string
      - name: is_active
        description: Whether the rule is active
        type: boolean
      - name: is_required
        description: Whether the rule is required
        type: boolean
      - name: rule_id
        description: Unique identifier of the rule
        type: string
      - name: rule_name
        description: Name of the rule
        type: string
  - name: team_settings
    description: Details about a team settings change
    type: object
    fields:
      - name: setting_name
        description: Name of the setting changed
        type: string
      - name: old_value
        description: Previous value of the setting
        type: string
      - name: new_value
        description: New value of the setting
        type: string
  - name: update_user_role
    description: Details about a user role update
    type: object
    fields:
      - name: user_email
        description: Email of the user whose role was updated
        type: string
        indicators:
          - email
      - name: old_role
        description: Previous role of the user
        type: string
      - name: new_role
        description: New role assigned to the user
        type: string
  - name: user_api_key
    description: Details about a user-level API key action
    type: object
    fields:
      - name: action
        description: Action performed on the user API key (e.g. create, revoke)
        type: string
  - name: user_email
    description: Email of the user performing the action
    type: string
    indicators:
      - email
  - name: user_spend_limit
    description: Details about a user spend limit change
    type: object
    fields:
      - name: new_limit_cents
        description: New spend limit in cents
        type: bigint
      - name: old_limit_cents
        description: Previous spend limit in cents
        type: bigint
      - name: target_user_email
        description: Email of the user whose spend limit was changed
        type: string
        indicators:
          - email

PreviousCrowdStrike Event Streams NextDatabricks Audit Logs

Last updated 5 days ago

Was this helpful?

schema: Cursor.Audit description: Audit logs provide a record of security events and administrative actions which help you meet compliance requirements and investigate security incidents. referenceURL: https://cursor.com/docs/enterprise/compliance-and-monitoring fields: - name: add_user description: Details about a user being added to the team type: object fields: - name: source description: How the user was added (e.g. autoEnroll, sso) type: string - name: team_id description: Team ID the user was added to type: string - name: user_email description: Email of the user being added type: string indicators: - email - name: invited_by_user_id description: User ID of the person who invited type: string - name: role description: Role assigned to the new user type: string - name: api_key description: Details about a service account API key action type: object fields: - name: action description: Action performed on the API key (e.g. create) type: string - name: api_key_id description: Unique identifier of the API key type: string - name: repo_scope_enabled description: Whether repository scope is enabled for the key type: boolean - name: service_account_id description: ID of the service account the key belongs to type: string - name: service_account_name description: Name of the service account the key belongs to type: string - name: bugbot_team_settings description: Bugbot team settings changes type: object fields: - name: new_value description: New Bugbot team settings value type: string - name: setting_name description: Setting name type: string - name: invite_email_sent description: Details about an invite email being sent type: object fields: - name: invite_id description: Unique identifier of the invite type: string - name: personal_message description: Whether a personal message was included type: string - name: recipient_email description: Email address of the invite recipient type: string indicators: - email - name: role description: Role granted by the invite type: string - name: sender_email description: Email address of the invite sender type: string indicators: - email - name: sender_user_id description: User ID of the invite sender type: string - name: invite_link description: Details about an invite link action type: object fields: - name: action description: Action performed on the invite link (e.g. create) type: string - name: creator_email description: Email of the invite link creator type: string indicators: - email - name: creator_user_id description: User ID of the invite link creator type: string - name: expires_in_seconds description: Expiry duration of the invite link in seconds type: bigint - name: invite_id description: Unique identifier for the invite link type: string - name: role description: Role granted by the invite link type: string - name: ip_address description: IP address of the actor type: string indicators: - ip - name: login description: Details about a login event type: object fields: - name: login_type description: Type of login (e.g. LOGIN_TYPE_WEB) type: string - name: success description: Whether the login was successful type: boolean - name: mcp_server_config description: Details about an MCP server configuration change type: object fields: - name: action description: Action performed on the MCP server (e.g. create, delete) type: string - name: scope description: Scope of the MCP server config (e.g. user, team) type: string - name: server_name description: Name of the MCP server type: string - name: server_type description: Type of MCP server (e.g. HTTP) type: string - name: metadata description: Request and context metadata type: object fields: - name: id description: Unique event ID type: string indicators: - trace_id - name: timestamp required: true description: Timestamp of the event type: timestamp timeFormats: - rfc3339 isEventTime: true - name: context description: Request context type: object fields: - name: auth_id description: Authenticated user ID type: string indicators: - actor_id - name: ghost_mode description: Whether ghost mode was active type: boolean - name: privacy_mode description: Privacy mode setting type: string - name: request_id description: Unique request ID type: string indicators: - trace_id - name: remove_user description: Details about a user being removed from the team type: object fields: - name: user_email description: Email of the user being removed type: string indicators: - email - name: service_account description: Details about a service account action type: object fields: - name: action description: Action performed on the service account (e.g. create, archive) type: string - name: service_account_id description: Unique identifier of the service account type: string - name: service_account_name description: Name of the service account type: string - name: team_api_key description: Details about a team API key action type: object fields: - name: action description: Action performed on the API key (e.g. revoke) type: string - name: team_command description: Details about a team command action type: object fields: - name: action description: Action performed on the command (e.g. create, delete) type: string - name: command_id description: Unique identifier of the command type: string - name: command_name description: Name of the command type: string - name: is_active description: Whether the command is active type: boolean - name: team_hook description: Details about a team hook action type: object fields: - name: action description: Action performed on the hook (e.g. create, delete) type: string - name: hook_id description: Unique identifier of the hook type: string - name: hook_step description: Step at which the hook executes (e.g. beforeShellExecution) type: string - name: hook_type description: Type of hook (e.g. command) type: string - name: is_active description: Whether the hook is active type: boolean - name: operating_systems description: Operating systems the hook applies to type: array element: type: string - name: script_content description: Content of the hook script type: string - name: script_name description: Name of the hook script type: string - name: team_id description: Unique identifier of the team type: string - name: team_marketplace description: Details about a team marketplace action type: object fields: - name: action description: Action performed on the marketplace (e.g. create) type: string - name: marketplace_id description: Unique identifier of the marketplace type: string - name: marketplace_name description: Internal name of the marketplace type: string - name: marketplace_display_name description: Display name of the marketplace type: string - name: new_auto_reindex description: New auto-reindex setting type: boolean - name: old_auto_reindex description: Previous auto-reindex setting type: boolean - name: plugin_id description: ID of the plugin involved type: string - name: plugins_created description: Number of plugins created type: int - name: plugins_deprecated description: Number of plugins deprecated type: int - name: plugins_indexed description: Number of plugins indexed type: int - name: plugins_updated description: Number of plugins updated type: int - name: team_id description: Team ID associated with the marketplace type: string - name: team_rule description: Details about a team rule action type: object fields: - name: action description: Action performed on the rule (e.g. create, delete) type: string - name: is_active description: Whether the rule is active type: boolean - name: is_required description: Whether the rule is required type: boolean - name: rule_id description: Unique identifier of the rule type: string - name: rule_name description: Name of the rule type: string - name: team_settings description: Details about a team settings change type: object fields: - name: setting_name description: Name of the setting changed type: string - name: old_value description: Previous value of the setting type: string - name: new_value description: New value of the setting type: string - name: update_user_role description: Details about a user role update type: object fields: - name: user_email description: Email of the user whose role was updated type: string indicators: - email - name: old_role description: Previous role of the user type: string - name: new_role description: New role assigned to the user type: string - name: user_api_key description: Details about a user-level API key action type: object fields: - name: action description: Action performed on the user API key (e.g. create, revoke) type: string - name: user_email description: Email of the user performing the action type: string indicators: - email - name: user_spend_limit description: Details about a user spend limit change type: object fields: - name: new_limit_cents description: New spend limit in cents type: bigint - name: old_limit_cents description: Previous spend limit in cents type: bigint - name: target_user_email description: Email of the user whose spend limit was changed type: string indicators: - email