Event Logging
Event logging controls which types of browser activity the Keep Aware extension sends to your tenant. Types you switch off are dropped in the browser before they are sent, rather than filtered after the fact.
Use it to reduce noise from activity you do not need to retain, or to turn on an event type that is off by default.
Where to find it
In the console, go to Settings → Capabilities and find the Event logging group. Each row is an event type, showing whether it is currently logged.
Event types
Most event types are logged by default and are not configurable — they are core to how policies and detections work.
| Event type | Default | Configurable |
|---|---|---|
| Prompt | Not logged | Yes |
| Page, Login, Input, Download, Upload | Logged | No |
| Copy, Paste | Logged for policy-labeled occurrences | No |
| Fetch, Request | Logged | No |
| Extension install, disable, uninstall | Logged | No |
| Session | Not logged | No |
Prompt is currently the only type you can change. It is off by default, so AI prompt activity is neither recorded nor governed until you enable it. See AI Prompt Governance for the full setup.
This list reflects the current defaults. The set of configurable types is served by the API rather than fixed in the console, so more types may become configurable in future releases without a console update.
Narrowing by policy outcome
For a type that is logged, you can optionally narrow logging to only those occurrences a policy acted on. Choose any combination of:
| Outcome | Meaning |
|---|---|
| Label | A policy matched and labeled the activity |
| Safeguard | A policy showed the user a safeguard |
| Threat | A policy flagged the activity as a threat |
Leaving the outcome list empty logs every occurrence of that type.
Because every threat is also safeguarded, and every safeguarded occurrence is also labeled, these narrow progressively rather than being independent filters.
Narrowing is only consulted when a type is enabled. It can never revive a type you have switched off — a disabled type sends nothing regardless of outcome.
Resetting
Reset to defaults returns every type to its shipped default and clears any outcome narrowing.
Configuring through the API
Event logging is stored on the tenant's advanced settings and can be set with PATCH /settings/advanced using the eventFilters field, keyed by event-type value:
{
"eventFilters": {
"prompt": { "enabled": true, "policy": [] }
}
}
Set policy to narrow by outcome, for example ["safeguard", "threat"]. An empty array logs every occurrence.
GET /settings/advanced returns your eventFilters alongside a read-only eventTypeDefaults registry describing every known event type, its shipped default, and whether it can be overridden.