# System Events

All internal Veza operations are logged on the **Administration** cog icon (at the bottom of the navigation sidebar) > **Events** page, with a brief description and timestamp. You can filter by category and severity, select columns to display, and export your current filter view:

![Columns can be hidden, rearranged, and resized](/files/i0EKfM03tIIbY7Hsh5M8)

For comprehensive descriptions of all event types, including what triggers each event and common scenarios, see the [Events API documentation](/4yItIzMvkpAvMVFAamTf/developers/api/events-api.md#event-types).

**NOTE:** Veza does not store events longer than 30 days.

To get more information for an event, click "Show Details" or on the status name under *Severity*.

### Event Subscriptions

You can configure **Event Subscriptions** to get automated alerts for specific platform activity, without manually monitoring the Events page. Supported notification channels include email, Slack, Microsoft Teams, ServiceNow, and custom webhooks.

![Subscriptions page](/files/oudthoLdBAvl4aEC4NAV)

For example, you can help ensure that Veza graph data remains fresh and represents the latest authorization state by configuring alerts whenever an integration data source encounters errors, such as loss of connectivity or expired credentials.

Event subscriptions deliver notifications through [Veza Actions](/4yItIzMvkpAvMVFAamTf/administration/administration/notifications.md) destinations. The following destination types are supported:

| Destination         | Description                                       |
| ------------------- | ------------------------------------------------- |
| **Email**           | Sends an email summary of matching events.        |
| **Slack**           | Posts to a Slack channel via webhook.             |
| **Microsoft Teams** | Posts to a Teams channel via webhook.             |
| **ServiceNow**      | Creates a ServiceNow incident with event details. |
| **Custom Webhooks** | Posts to any HTTP endpoint.                       |

{% hint style="info" %}
Jira, Slack App, and Microsoft Teams App destinations are not available for event subscriptions. Use [Rules and Alerts](/4yItIzMvkpAvMVFAamTf/features/insights/rules-and-alerts.md) to trigger those notification types based on query result changes.

You can also use the [Events API](/4yItIzMvkpAvMVFAamTf/developers/api/events-api.md) and [Audit Logs API](/4yItIzMvkpAvMVFAamTf/developers/api/audit-logs.md) to programmatically retrieve and monitor events for integration with external monitoring or SIEM platforms.
{% endhint %}

#### Notification content

Each notification includes a summary of the matching events: subscription name and description, event count, severities, categories, event types, and trigger timestamp.

**Slack and Microsoft Teams**

A formatted message with the subscription name, event count, severities, categories, event types, evaluation period, trigger timestamp, and a direct link to the subscription dashboard in Veza.

**ServiceNow**

Creates an incident with the following fields:

| Field                        | Value                                                                                                  |
| ---------------------------- | ------------------------------------------------------------------------------------------------------ |
| Short description            | `Event Subscription Alert: {subscription name}`                                                        |
| Description                  | Subscription name and description, event count, trigger timestamp, severities, and subscription filter |
| Urgency                      | Configured in the Veza Action                                                                          |
| Category / Subcategory       | Configured in the Veza Action                                                                          |
| Assignment group             | Configured in the Veza Action (optional)                                                               |
| Configuration item (CMDB CI) | Configured in the Veza Action (optional)                                                               |

**Custom webhooks**

Posts a JSON object to the configured URL:

```json
{
  "subscription_id": "string",
  "subscription_name": "string",
  "subscription_description": "string",
  "number_of_events": 3,
  "severities": ["High", "Critical"],
  "categories": ["Integrations", "Rule"],
  "event_types": ["string"],
  "triggered_at": 1709475845,
  "evaluated_at": 1709475900,
  "evaluation_period": 15,
  "host": "https://your-veza-instance.veza.com",
  "dashboard_url": "https://your-veza-instance.veza.com/app/event-subscriptions?tab=alert_details&subscription_id=..."
}
```

#### How Event Subscriptions Work

Administrators can configure periodic alerts on the **Administration** > **Event Subscriptions** page. For each configured subscription, Veza will send a summary of new events based on the subscription's frequency and filter criteria.

![Example email alert](/files/p5beEjWxL3HT3gE0YoVV)

1. **Subscription Criteria** You can create a subscription by specifying the following parameters:
   * **Event Category**: Filter events by their high-level category (e.g., Integrations, Rule, Export).
   * **Event Severity**: Choose the severity level (e.g., Info, Warning, Error).
   * **Event Type**: Specify the type of event you want to track.
2. **Evaluation Period** Subscriptions are evaluated at regular intervals of **15 minutes** (e.g., at 15, 30, 45, and 60-minute marks). During each evaluation, all events matching your subscription criteria are reviewed.
3. **Alerts** If any events match your subscription during an evaluation period, you will receive a notification. For email notifications, the message includes:
   * Details of your subscription criteria.
   * The total number of events that occurred since the last evaluation.

#### Enabling Event Subscriptions

Use the **Subscriptions** tab to review, edit, and delete saved subscriptions. To create a subscription:

1. In Veza, open **Administration** > **Event Subscriptions**.
2. Click **Create Subscription**.
3. On the **Details** tab, enter a name and description for the subscription, and choose the evaluation time interval.
4. On the **Conditions** tab, choose from event types, severity levels, and categories to define the filter.
5. On the **Actions > Send Alert** tab, select a configured Veza Action, or click "Create Veza Action" to add a new destination.
6. Click **Create** to save the subscription.

#### Alert Details

Use the **Event Subscriptions** > **Alert Details** tab to get a summary of subscription activity, including the trigger time and number of events included in each alert. By default, this view shows all activity during the chosen time range.

To review all activity for a specific subscription:

1. Hover over the subscription on the **Subscriptions** tab.
2. Click the **View Alerts** icon to see its specific alerts.

![Alerts for selected subscription](/files/yH2VPOvV0rFjrID50Thu)


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.veza.com/4yItIzMvkpAvMVFAamTf/administration/administration/events.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.