diff --git a/pages/audit-trail/concepts.mdx b/pages/audit-trail/concepts.mdx
index fc7b16dd41..9ce6a76fa2 100644
--- a/pages/audit-trail/concepts.mdx
+++ b/pages/audit-trail/concepts.mdx
@@ -3,26 +3,34 @@ title: Audit Trail - Concepts
description: Learn fundamental concepts of Scaleway's Audit Trail.
tags: audit-trail log events access
dates:
- validation: 2025-11-10
+ validation: 2026-10-20
---
## Audit Trail
Audit Trail is a tool that holds a record of events and changes performed within a Scaleway Organization. Audit Trail allows you to keep track of all actions, whether successful, attempted, or failed, performed on your Scaleway resources.
-With Audit Trail you can view actions taken by any [principal](/iam/concepts/glossary/#principal) in any Project and on any of your Scaleway resources. You can also see the API methods used, the outcome of the action performed (status), and the IP address from which a principal performed an action.
+With Audit Trail, you can view actions taken by any [principal](/iam/concepts/glossary/#principal) in any Project and on any of your Scaleway resources. You can also see the API methods used, the outcome of the action performed (status), and the IP address from which a principal performed an action.
Audit Trail allows you to view the metadata of the API method used, allowing you to investigate incidents and troubleshoot issues.
+## Custom alert
+
+A custom alert is an automated notification triggered when one or more Audit Trail events match a rule you define. When you create the rule, you can specify:
+
+- the type of event to monitor
+- the number of occurrences required to trigger the alert
+- the timeframe in which these occurrences are counted
+
## Event
-An event is a record of any activity related to your Scaleway resources, encompassing actions by users, applications, or Scaleway.
+An event is a record of any activity related to your Scaleway resources, spanning actions by users, applications, or Scaleway.
## Export
Audit Trail exports allow you to upload your [event](#event) logs from the past 90 days to any [Object Storage](/object-storage/) bucket. By default, your event logs are exported to the `Standard` [storage class](/object-storage/concepts/#storage-class) or to the storage class you have selected upon bucket creation.
-This feature leverages Object Storage benefits which include:
+This feature leverages Object Storage benefits, which include:
- Fine-grained access management with [bucket policies](/object-storage/api-cli/bucket-policy/)
- Versioning of events for traceability and recovery
@@ -30,21 +38,23 @@ This feature leverages Object Storage benefits which include:
- Flexible backup options through integration with third-party tools
- Object lock to protect data from accidental deletion
-Once configured, your export runs automatically. Every day, the previous day’s Audit Trail events are exported to your chosen bucket. This provides a secure, durable, and centralized location for long-term retention, analysis, and compliance.
+Your export runs automatically after you configure it. Every day, the Audit Trail events of the previous day are exported to your chosen bucket. This provides a secure, durable, and centralized location for long-term retention, analysis, and compliance.
+
+An export includes all Audit Trail events by default, allowing only one active export configuration per region.
+
+## Method
-
- At this stage, an export includes all Audit Trail events by default, allowing only one active export configuration per region. Future updates will let you select specific events for export.
-
+In the context of Audit Trail, a method is the API call sent to the Audit Trail API whenever a principal takes an action (whether successful, attempted, or failed) on any Scaleway resource.
## Prefix
-A prefix is a string of characters at the beginning of the [object key name](/object-storage/concepts/#object). They are often used to organize your data similarly to directories.
+A prefix is a string of characters at the beginning of an [object key name](/object-storage/concepts/#object). Prefixes are often used to organize your data in a way similar to directories.
In the context of Scaleway Object Storage, prefixes are used to display folders in the Scaleway console for practical reasons. The `/` character in a prefix is used as a delimiter to allow you to organize your objects hierarchically.
-Your Audit Trail export's event logs are stored in your Object Storage according to the following structure: `prefix/YYYY/MM/DD/logs_xxxxxxxxx.json`.
+The event logs of your Audit Trail export are stored in your Object Storage according to the following structure: `prefix/YYYY/MM/DD/logs_xxxxxxxxx.json`.
-Below is an example of what your export might look like:
+Here is an example of what your export might look like:
- `audit-trail-export/2025/09/15/logs_xxxxxxxxx.json`
- `audit-trail-export/2025/10/20/logs_xxxxxxxxx.json`
@@ -54,20 +64,15 @@ Below is an example of what your export might look like:
In the context of Audit Trail, a Project refers to the place where the Scaleway resources being monitored are located. They can be located in different Scaleway Projects, of different Scaleway Organizations.
-## Method
-
-A method in the context of Audit Trail is the API call sent to the Audit Trail API whenever a principal takes an action (whether successful, attempted, or failed) on any Scaleway resource.
-
## Region
-A region is the geographical area in which your resources are located (Paris, Amsterdam, Warsaw).
+A region is the geographical area in which your resources are located (e.g., Paris, Amsterdam, Warsaw).
-Audit Trail allows you to select and filter your resources by region and Scaleway Project. This allows you to better sort through your resources.
+Audit Trail allows you to select and filter your resources by region and Scaleway Project, making it easier to quickly sort through and locate your resources.
## Status
-A status is the API response returned whenever an action was taken on a resource by a principal. There are two statuses:
+A status is the API response returned whenever an action was taken on a resource by a principal. The following statuses are available:
- `Successful`: the API request was executed.
-
- `Forbidden`: permission to access the API was denied.
diff --git a/pages/audit-trail/faq.mdx b/pages/audit-trail/faq.mdx
index 2e421ab6a3..baf3dd735b 100644
--- a/pages/audit-trail/faq.mdx
+++ b/pages/audit-trail/faq.mdx
@@ -1,15 +1,15 @@
---
title: Audit Trail FAQ
-description: Get answers on using Scaleway's Audit Trail to monitor events, enhance security, and track activities across your resources
+description: Get answers on using Scaleway Audit Trail to monitor events, enhance security, and track activities across your resources
productIcon: AuditTrailProductIcon
dates:
- validation: 2026-07-30
+ validation: 2026-10-20
---
## Overview
### What is Audit Trail?
-Audit Trail is a tool that holds a record of events and changes performed within a Scaleway Organization.
+Audit Trail is a tool that records the events and changes that occur within a Scaleway Organization. It lets you track every action performed on your Scaleway resources, whether it succeeded, failed, or was only attempted.
### Why do I need Audit Trail?
Audit Trail helps you ensure accountability and security by recording who did what and when within your Scaleway Organization. It tracks activity across all your resources (identity of the principal, date of activity, source IP address, API method used, and status of the request).
@@ -21,16 +21,19 @@ You can use Audit Trail for troubleshooting, compliance verification, and analys
### Where are my Audit Trail events stored?
Audit Trail events are stored in the same region where the activity occurred. This means that if an event takes place in a specific region, it will be saved and accessible in that same region.
-Events from global products which are not region-specific, such as [IAM](/iam/), are stored in the Paris region.
-Find out more about product availability in see [Product availability by region](https://www.scaleway.com/en/product-availability-by-region/).
+Events from global products which are not region-specific, such as [IAM](/iam/), are stored in the Paris region. See [Product availability by region](https://www.scaleway.com/en/product-availability-by-region/) to find out more about product availability.
## Pricing and billing
### How am I billed for using Audit Trail?
-Audit Trail is free of charge.
+Audit Trail is free of charge, with the exception of alerts.
+
+[Preconfigured alerts](/audit-trail/how-to/activate-adt-preconfigured-alerts) and [custom alerts](/audit-trail/how-to/configure-audit-trail-custom-alerts) are automated notifications that are triggered when one or more Audit Trail events satisfy a rule (predefined by Scaleway for preconfigured alerts, or by you for custom alerts).
+
+Preconfigured alerts are only billed when you activate them, whereas custom alerts are billed even when they are disabled. In order no to be billed for a custom alert, you have to [delete the alert](/audit-trail/how-to/configure-audit-trail-custom-alerts/#delete-a-custom-alert).
### How am I billed for Audit Trail exports to an Object Storage bucket?
-Audit Trail exports are free of charge, but using Object Storage may incur additional charges. Refer to the [Object Storage FAQ](/object-storage/faq/#how-am-i-billed-for-object-storage) for more information on pricing.
+Audit Trail exports are free of charge, but using Object Storage may incur charges. See the [Object Storage FAQ](/object-storage/faq/#how-am-i-billed-for-object-storage) for more information on pricing.
## Compatibility and integration
diff --git a/pages/audit-trail/how-to/activate-adt-preconfigured-alerts.mdx b/pages/audit-trail/how-to/activate-adt-preconfigured-alerts.mdx
index cc42ca9507..9eb90c49de 100644
--- a/pages/audit-trail/how-to/activate-adt-preconfigured-alerts.mdx
+++ b/pages/audit-trail/how-to/activate-adt-preconfigured-alerts.mdx
@@ -1,43 +1,42 @@
---
title: How to activate Audit Trail preconfigured alerts
description: Learn how to activate Audit Trail preconfigured alerts to monitor actions and get alerted about abnormal behavior
-tags: audit-trail alerts monitor
+tags: audit-trail preconfigured alerts monitor
dates:
- validation: 2026-06-12
+ validation: 2026-10-20
posted: 2026-04-07
---
import Requirements from '@macros/iam/requirements.mdx'
-Audit Trail Alerting Management allows you to proactively monitor the actions performed on your Scaleway resources. You can enable or disable a set of preconfigured alerts based on your security and monitoring needs, and Audit Trail will notify you of abnormal or sensitive behavior.
+Audit Trail Alerting Management allows you to proactively monitor the actions performed on your Scaleway resources. You can enable or disable a set of preconfigured alerts or [create custom alerts](/audit-trail/how-to/configure-audit-trail-custom-alerts/) based on your security and monitoring needs, and Audit Trail will notify you of abnormal or sensitive behavior. This page explains how to use preconfigured alerts.
- A Scaleway account logged in to the [console](https://console.scaleway.com)
- [Owner](/iam/concepts/glossary/#owner) status or [IAM permissions](/iam/concepts/glossary/#permission) allowing you to view and manage Audit Trail
-
- Global events (such as IAM, Account, or Edge Services activities) are considered FR-PAR (Paris) events.
-
-
+
+ Events related to global products which are not region-specific (such as IAM, Account, or Edge Services activities) are considered FR-PAR (Paris) events.
+
## Enable or disable preconfigured alerts
1. Click **Audit Trail** in the **Monitoring** section of the [Scaleway console](https://console.scaleway.com/) side menu.
-2. Click the **Region** drop-down and select a region for which you want to manage alerts.
+2. Click the **Region** dropdown and select a region for which you want to manage alerts.
3. Click the **Alerts** tab. A list of preconfigured alerts appears.
4. Toggle specific alerts to control which behaviors should trigger a notification.
1. Locate the alert you wish to enable/disable.
- **Alert name**: The technical identifier of the alert (e.g., ApiKeyCreated).
- **Rule description**: A brief explanation of what activity triggers the alert.
- 2. Check or uncheck the box in the **Active** column:
+ 2. In the **Active** column, check or uncheck the box:
- **Checked**: The alert is active and will trigger notifications.
- **Unchecked**: The alert is disabled.
-5. Click **Save changes** at the bottom of the page to apply your configuration. A pop-up window displays, confirming the action you are about to take. Click **Save changes** again.
+5. At the bottom of the page, click **Save changes** to apply your configuration. A confirmation dialog box appears. Click **Save changes** again.
### Understand preconfigured alerts
-The **Alerts** tab in the console displays a rule description for each alert, helping you to interpret the behavior of an alert. The table below provides a non-exhaustive list of a few examples.
+The **Alerts** tab > **Preconfigured** setting in the console displays a rule description for each alert, helping you to interpret the behavior of an alert. The following table provides a non-exhaustive list of a few examples.
| Alert | Description |
|---|---|
@@ -67,6 +66,7 @@ Email notifications contain:
- recommended actions to help you with investigation and mitigation steps
- a link to check the Audit Trail page in the console with filters helping you to see what happened around the affected timeframe
-## Related documents
+## Related documentation
-- Learn more about [how to view your Audit Trail events](/audit-trail/how-to/use-audit-trail/).
\ No newline at end of file
+- Learn more about [how to view your Audit Trail events](/audit-trail/how-to/use-audit-trail/).
+- Learn [how to configure custom alerts](configure-audit-trail-custom-alerts).
\ No newline at end of file
diff --git a/pages/audit-trail/how-to/assets/scaleway-audit-trail-configure-ustom-alert.webp b/pages/audit-trail/how-to/assets/scaleway-audit-trail-configure-ustom-alert.webp
new file mode 100644
index 0000000000..148c5ccb69
Binary files /dev/null and b/pages/audit-trail/how-to/assets/scaleway-audit-trail-configure-ustom-alert.webp differ
diff --git a/pages/audit-trail/how-to/configure-audit-trail-custom-alerts.mdx b/pages/audit-trail/how-to/configure-audit-trail-custom-alerts.mdx
new file mode 100644
index 0000000000..278c9fd29f
--- /dev/null
+++ b/pages/audit-trail/how-to/configure-audit-trail-custom-alerts.mdx
@@ -0,0 +1,148 @@
+---
+title: How to configure Audit Trail custom alerts
+description: Learn how to configure Audit Trail custom alerts to monitor actions and get alerted about abnormal behavior
+tags: audit-trail custom alerts monitor
+dates:
+ validation: 2026-10-28
+ posted: 2026-10-28
+---
+
+import Requirements from '@macros/iam/requirements.mdx'
+
+import image1 from './assets/scaleway-audit-trail-configure-ustom-alert.webp'
+
+Audit Trail Alerting Management lets you proactively monitor the actions performed on your Scaleway resources. You can [enable a set of preconfigured alerts](/audit-trail/how-to/activate-adt-preconfigured-alerts) or configure custom alerts based on your security and monitoring needs so Audit Trail notifies you of abnormal or sensitive behavior. This page explains how to set custom alerts.
+
+
+
+- A Scaleway account logged in to the [console](https://console.scaleway.com)
+- [Owner](/iam/concepts/glossary/#owner) status or [IAM permissions](/iam/concepts/glossary/#permission) allowing you to view and manage Audit Trail
+
+
+ Events related to global products which are not region-specific (such as IAM, Account, or Edge Services activities) are considered FR-PAR (Paris) events.
+
+## Configure a custom alert
+
+
+ After creating an alert, you can edit only the name and description of the alert.
+
+
+1. In the [Scaleway console](https://console.scaleway.com/) side menu, go to **Monitoring** > **Audit Trail**.
+2. Click the **Region** dropdown and select the region for which you want to create alerts.
+3. Click the **Alerts** tab, then select **Custom**.
+4. Click **Create alert**. The alert creation wizard opens.
+5. Add a name and description for the alert.
+6. Set a severity (e.g., **info**, **error**, **warning**).
+7. Define a rule for the alert, using the visual builder or the code editor. The steps here assume that you are using the visual builder (for details on the code editor, see [Use the code editor and CEL expressions](#use-the-code-editor-and-cel-expressions)):
+
+ 1. Select the type of event that you want to be alerted on (e.g., an event related to a product (**Product name**), an action (**Method name**), and so on).
+ 2. Select a function (**is** or **is not**).
+ 3. Select an event value from the dropdown (e.g., **Instance**, **CreateAPIKey**) or type a value in the freeform field.
+
+ For example, you can set up an alert that triggers when users are deleted.
+
+
+8. If your alert requires multiple rules, click **+ Add** to add another rule.
+9. Configure the condition that triggers the alert:
+ 1. **Occurrence** — Enter the number of times the condition must be met to trigger the alert. Example: Enter **5** to trigger an alert when 5 or more users are deleted.
+
+ 2. **Timeframe** — Enter the time window used to evaluate occurrences. Example: Enter **10** to evaluate user deletion events within a 10-minute window.
+10. Click **Test alert** to check if:
+ - the syntax of your alert configuration is valid
+ - there are currently any active events that match the alert rule you defined
+11. Once your configuration syntax is valid, click **Create custom alert**. The **Overview** page of your alert opens, showing the details of your new active alert.
+
+
+### Use the code editor and CEL expressions
+
+If you wish to define a custom alert by writing the alert expression yourself, use the code editor. The code editor uses the Common Expression Language (CEL), which lets you define the events that trigger an alert.
+
+
+ Changing from the code editor to the visual builder while creating a rule discards all details already defined for the rule.
+
+
+Example CEL expression for an alert that is triggered when delete operations are executed from a specific IP address:
+
+```bash
+(methodName.startsWith("Delete") && sourceIp == "192.0.2.1")
+```
+
+Your alert expression is made up of:
+- event types
+- operators and/or functions
+- event values
+
+| Event types | Operators / Functions |
+| -------- | ----------- |
+| The following event types are supported:
- `method_name`
- `principal_id`
- `product_name`
- `project_id`
- `resource_id`
- `service_name`
- `source_ip`
- `status` | Operators and functions can include the following:
- **Equality and inequality operators** (defined for all types): `==`, `!=`
Examples: `method_name == "GetKey"`, `status != 200`
- **Comparison operators** (only for integers): `<=`, `<`, `>`, `>=`
Example: `status > 400`
- **Logical `AND` operator**: `&&`
Example: `method_name == "GetKey" && status != 200`
- **String functions** (only for strings): `contains`, `matches`, `startsWith`, `endsWith`
Example: `method_name.contains("Delete"), source_ip.matches("127.0.*.1")` |
+
+
+## Enable or disable a custom alert
+
+You can enable or disable an existing custom alert in the following ways:
+- from the **Overview** page of the custom alert
+- from the **Alert** tab listing all your custom alerts (use this option to batch enable/disable multiple alerts at the same time)
+
+
+ Charges apply even when a custom alert is disabled. In order no to be billed for a custom alert, you have to [delete the alert](#delete-a-custom-alert).
+
+
+To enable or disable an existing alert from its **Overview** page, follow these steps:
+
+1. In the [Scaleway console](https://console.scaleway.com/) side menu, go to **Monitoring** > **Audit Trail**.
+2. Click the **Region** dropdown and select the region where the alert has been created.
+3. Click the **Alerts** tab, then click **Custom**.
+4. Click next to the alert that you want to enable/disable and select **More info**. The **Overview** page of the alert opens.
+5. Go to the **Manage alert** section and use the toggle to enable or disable your alert.
+
+To enable or disable one or more existing alerts, use the **Alert** tab listing all your custom alerts:
+
+1. In the [Scaleway console](https://console.scaleway.com/) side menu, go to **Monitoring** > **Audit Trail**.
+2. Click the **Region** dropdown and select the region where the alert has been created.
+3. Click the **Alerts** tab, then click **Custom**.
+4. Check or uncheck **Enabled** to enable or disable your alert(s).
+5. Click **Save changes** at the bottom of the page to apply your configuration. A dialog box appears, confirming the action you are about to take. Click **Save changes** again.
+
+## Duplicate a custom alert to another region
+
+1. In the [Scaleway console](https://console.scaleway.com/) side menu, go to **Monitoring** > **Audit Trail**.
+2. Click the **Region** dropdown and select the region where the alert has been created.
+3. Click the **Alerts** tab, then click **Custom**.
+4. Click next to the alert that you want to enable/disable and select **Duplicate to other region(s)**. A dialog box opens.
+5. Review the details of the alert, select the **Destination region**, and click **Duplicate**.
+
+## Delete a custom alert
+
+1. In the [Scaleway console](https://console.scaleway.com/) side menu, go to **Monitoring** > **Audit Trail**.
+2. Click the **Region** dropdown and select the region where the alert has been created.
+3. Click the **Alerts** tab, then click **Custom**.
+4. Click next to the alert that you want to delete and select **Delete**. A dialog box opens.
+5. Type `DELETE` and click **Delete alert** to confirm the deletion of your alert.
+
+
+ You can also delete an alert from the **Settings** tab of the alert.
+
+
+## Configure email address to receive notifications
+
+The Alerting Management feature is linked to the notification manager. The email address set in the notification manager is where you will receive notifications when alerts are triggered.
+
+For details on how to configure email addresses and notifications, see the related [notification manager documentation](/account/profile-preferences/manage-notifications/).
+
+
+ Because Audit Trail alerts are classified as Security notifications, ensure you set the email address(es) to subscribe to the Security notification type.
+
+
+Email notifications contain:
+- details of the alert, such as:
+ - name of the alert
+ - time when the alert was triggered
+ - behavior detected
+ - severity
+- recommended actions to help you with investigation and mitigation steps
+- a link to check the Audit Trail page in the console
+
+## Related documentation
+
+- Learn more about [how to view your Audit Trail events](/audit-trail/how-to/use-audit-trail/).
+- Learn [how to activate preconfigured alerts](/audit-trail/how-to/activate-adt-preconfigured-alerts).
\ No newline at end of file
diff --git a/pages/audit-trail/menu.ts b/pages/audit-trail/menu.ts
index 89fa94c9af..2a8e681016 100644
--- a/pages/audit-trail/menu.ts
+++ b/pages/audit-trail/menu.ts
@@ -34,6 +34,10 @@ export const auditTrailMenu = {
label: 'Activate Audit Trail preconfigured alerts',
slug: 'activate-adt-preconfigured-alerts',
},
+ {
+ label: 'Configure Audit Trail custom alerts',
+ slug: 'configure-audit-trail-custom-alerts',
+ },
],
label: 'How to',
slug: 'how-to',