# Event log Administrators see what happens in their Shonin org on the **Events** page: who signed in, who opened the console or took Access keys on which account, who changed people, groups, permission sets, assignments and delegations, and the calls made on AWS with the roles of your permission sets. The page reads new events every 10 seconds. ## Where the events are The events of a Shonin org with an AWS organization are kept in your AWS account, never by Shonin: - **In CloudWatch Logs of the management account**, in the region of the installation: log group `/shonin/events/`. The installation creates it and keeps events for 365 days. You can change the retention in CloudWatch: the Events page shows the current one. - **CloudTrail:** the installation copies from the trail of your AWS organization the calls made with the roles of your permission sets. If your AWS organization has no trail, the installation creates the stack `shonin-organization-trail` with one: see [Connect your AWS organization](connect-aws-organization.md#the-template). The Events page reads them from your browser, with read-only credentials that last one hour. Your installation encrypts them for the page, so Shonin forwards them without reading them. The page says in which account, log group and region the events are, so you can check them in CloudWatch. Each event says where it comes from: - **Installation:** recorded by your installation (console, Access keys, command line, second factor, roles). - **Shonin:** sent by Shonin's server (sign-ins to the portal, people, groups, permission sets, assignments, delegations, Org settings, messages to the Assistant). Your installation writes them in your account. - **CloudTrail:** calls recorded by AWS. With more than one AWS organization, the events of the Shonin org go to the installation that checks the second factor, and the events of each AWS organization stay in its own management account. The Events page shows them together. ## All CloudTrail By default the event log shows only the calls made through Shonin. A primary admin can show every call of an AWS organization: **Org settings** → **Event log** → **Show all CloudTrail of this AWS organization**, with a code from their authenticator app. Every primary admin gets an email. The events stay in your AWS account. ## Download and SIEM **Download** saves the events shown, as JSON Lines. The file is made in your browser. To send the events to your SIEM, connect it to CloudWatch Logs of your management account, from your AWS account: for example with a subscription filter on `/shonin/events/`, or with the CloudWatch Logs integration of your SIEM. Security events follow [OCSF](https://schema.ocsf.io) 1.4.0 (authentication, account changes, user access, API activity); every event also has `message`, one sentence for people, and the fields of Shonin under `unmapped`. ## Without an AWS organization A Shonin org without an AWS organization has no AWS account to keep its events in: Shonin keeps them for 14 days. A primary admin creates an API token for the SIEM in **Org settings** → **Event log**. Shonin shows it once and keeps only its hash. The SIEM calls: ```text GET https://.app.shonin.ai/api/events?from=&to= Authorization: Bearer ``` Events on accounts another Shonin org delegated to you are kept in the AWS account of that Shonin org, and the Events page shows them to you. ## The Assistant on events A primary admin can allow it: **Org settings** → **Event log** → **Allow the Assistant to analyze events**. Then the Events page has the Assistant next to the events, and each question sends to Shonin the events shown on the page. Without it, events never leave your AWS account.