Technology
22 columns
85 rows
8 formats

Secure Collaboration Access Audit Log

This dataset provides a comprehensive log of user access events within enterprise collaboration tools, capturing user identity, resource details, policy compliance, and anomaly detection signals. It is optimized for security teams to identify risk patterns, investigate incidents, and ensure regulatory compliance in remote and hybrid work environments.

last updated 23 Dec 2025
by GoMask

The brief that made it

Rapid investigation of suspicious or anomalous user activity

Sample rows

preview · 8 of 85 rows · all 22 columns

event_idstring	collaboration_toolstring	risk_scorefloat	policy_complianceboolean	policy_idstring	event_timestampdatetime	user_idstring	user_emailstring	user_rolestring	departmentstring	ip_addressstring	device_typestring	location_citystring	location_countrystring	resource_typestring	resource_idstring	resource_namestring	access_actionstring	policy_namestring	anomaly_detectedboolean	anomaly_typestring	event_descriptionstring
EVT10001	Slack	0.15	true	POL001	2024-05-01T08:15:42Z	U001	alice.smith@acme.com	admin	IT Security	192.168.1.101	desktop	New York	US	channel	CH1001	security-updates	edit	Data Access Policy	false	blank	Admin edited channel settings.
EVT10002	Teams	0.06	true	POL002	2024-05-01T09:03:11Z	U002	bob.jones@acme.com	member	Finance	10.0.0.12	desktop	Chicago	US	file	F1002	Q2-Report.xlsx	view	Confidential Files Policy	false	blank	User viewed confidential report.
EVT10003	Zoom	0.04	blank	blank	2024-05-01T09:14:25Z	U003	carol.lee@acme.com	member	Marketing	172.16.5.44	mobile	San Francisco	US	meeting	M1003	Campaign Kickoff	login	blank	false	blank	User logged in for scheduled meeting.
EVT10004	Teams	0.12	true	POL003	2024-05-01T10:02:37Z	U004	daniel.cho@acme.com	guest	External	203.0.113.5	tablet	Toronto	CA	channel	CH1004	Guest Announcements	view	Guest Access Policy	false	blank	Guest user accessed public channel.
EVT10005	Slack	0.18	true	POL004	2024-05-01T10:49:08Z	U005	eva.martin@acme.com	external	Partner Org	185.60.14.22	desktop	London	UK	message	MSG1005	Onboarding Message	share	Message Sharing Policy	false	blank	External user shared onboarding message.
EVT10006	Teams	0.82	false	POL002	2024-05-01T11:15:14Z	U006	frank.moore@acme.com	member	Operations	10.1.2.13	tablet	Dallas	US	file	F1006	OpsDoc.pdf	download	Confidential Files Policy	true	multiple failed logins	User downloaded file after multiple failed login attempts.
EVT10007	Zoom	0.03	blank	blank	2024-05-01T11:22:03Z	U002	bob.jones@acme.com	member	Finance	10.0.0.12	desktop	Chicago	US	meeting	M1007	Budget Review	logout	blank	false	blank	User logged out after meeting.
EVT10008	Slack	0.11	true	POL005	2024-05-01T11:33:51Z	U007	grace.liu@acme.com	admin	HR	192.168.1.103	desktop	Seattle	US	file	F1008	HR_Policy.pdf	edit	HR File Policy	false	blank	Admin edited HR policy file.
EVT10009	Teams	0.13	true	POL006	2024-05-01T12:07:42Z	U008	henry.nguyen@acme.com	member	Legal	172.16.2.93	mobile	Los Angeles	US	file	F1009	ContractDraft.docx	download	Legal Access Policy	false	blank	Legal team downloaded draft contract.
EVT10010	Zoom	0.91	blank	blank	2024-05-01T12:15:19Z	U009	irene.park@acme.com	external	Contractor	2001:0db8:85a3:0000:0000:8a2e:0370:7334	unknown	Seoul	KR	message	MSG1010	Welcome Message	view	blank	true	unusual location	External user accessed message from unusual location.
EVT10011	Slack	0.97	false	POL007	2024-05-01T12:22:47Z	U010	joshua.miller@acme.com	other	Compliance	203.0.113.8	desktop	Berlin	DE	channel	CH1011	Compliance-Alerts	share	Compliance Channel Policy	true	data exfiltration	User shared compliance alerts externally.
EVT10012	Teams	0.1	true	POL008	2024-05-01T12:42:19Z	U011	karen.patel@acme.com	member	Sales	10.10.10.21	mobile	San Diego	US	file	F1012	SalesPitch.pptx	edit	Sales Data Policy	false	blank	Sales team edited pitch file.
EVT10013	Slack	0.08	true	POL001	2024-05-01T12:55:32Z	U012	liam.brown@acme.com	member	IT Security	192.168.1.107	desktop	Austin	US	file	F1013	VulnerabilityList.csv	download	Data Access Policy	false	blank	User downloaded vulnerability list.
EVT10014	Teams	0.07	blank	blank	2024-05-01T13:21:04Z	U013	mia.garcia@acme.com	guest	External	198.51.100.32	tablet	Madrid	ES	meeting	M1014	Partner Sync	login	blank	false	blank	Guest joined meeting.
EVT10015	Slack	0.74	false	POL006	2024-05-01T13:28:45Z	U014	noah.kim@acme.com	member	Legal	172.16.2.98	desktop	San Jose	US	file	F1015	TermsOfUse.docx	edit	Legal Access Policy	true	multiple failed logins	User edited file after failed logins.
EVT10016	Zoom	0.21	blank	blank	2024-05-01T13:42:17Z	U015	olivia.wilson@acme.com	external	Consultant	203.0.113.2	unknown	Sydney	AU	message	MSG1016	Consulting Update	share	blank	false	blank	Consultant shared update message.
EVT10017	Slack	0.16	true	POL001	2024-05-01T14:01:29Z	U016	paul.rivera@acme.com	admin	IT Security	192.168.1.110	desktop	Boston	US	channel	CH1017	Incident-Response	edit	Data Access Policy	false	blank	Admin edited incident response channel.
EVT10018	Teams	0.14	true	POL007	2024-05-01T14:11:52Z	U017	quinn.murphy@acme.com	other	Compliance	203.0.113.15	desktop	Dublin	IE	channel	CH1018	Regulatory-Updates	edit	Compliance Channel Policy	false	blank	Compliance team edited channel.
EVT10019	Slack	0.05	blank	blank	2024-05-01T14:23:09Z	U018	rachel.adams@acme.com	member	Marketing	172.16.5.49	mobile	Vancouver	CA	file	F1019	BrandGuide.pdf	view	blank	false	blank	Marketing user viewed brand guide.
EVT10020	Teams	0.09	true	POL002	2024-05-01T14:35:41Z	U019	samuel.davis@acme.com	member	Finance	10.0.0.15	desktop	Atlanta	US	file	F1020	ExpenseReport.xlsx	edit	Confidential Files Policy	false	blank	Finance team edited expense report.

What the 85 rows show

from the 85-row sample

88%policy_compliance = true
0.12median risk_score
4device types
4resource types
5user roles
7access actions

collaboration_tool85 rows by value

risk_score85 rows, in bands of 0.1

Every row with risk_score under 0.7 has policy_compliance = true. None above it.

policy_id50 rows with a value · 35 left blank

p-3098
p-2047
POL0016
POL0075
p-1015
POL0064
POL0084
POL0023
POL0033
POL0053

22 columns by typefrom the column list below

string 18
float 1
datetime 1
boolean 2

Columns

22 columns in four groups

blueprint · 22 columns
column	type	description	example
Text 18 columns
`event_id`	string	Unique identifier for each access eventunique	EVT10001
`user_id`	string	Unique identifier for the user involved in the event	U001
`user_email`	string	Email address of the user	alice.smith@acme.com
`user_role`	string	Role of the user (e.g., admin, member, guest)admin · member · guest · external · other · optional	admin
`department`	string	Department or business unit of the useroptional	IT Security
`ip_address`	string	IP address from which the access event originatedoptional	192.168.1.101
`device_type`	string	Type of device used for access (e.g., desktop, mobile, tablet, unknown)desktop · mobile · tablet · unknown · optional	desktop
`location_city`	string	City where the access event originated (if available)optional	New York
`location_country`	string	Country where the access event originated (if available)optional	US
`collaboration_tool`	string	Name of the enterprise collaboration tool (e.g., Slack, Teams, Zoom)3 tools	Slack
`resource_type`	string	Type of resource accessed (e.g., file, channel, meeting, message)4 types	channel
`resource_id`	string	Unique identifier of the accessed resourceoptional	CH1001
`resource_name`	string	Human-readable name of the accessed resourceoptional	security-updates
`access_action`	string	Type of action performed (e.g., view, edit, download, share, delete, login)8 values	edit
`policy_id`	string	Identifier of the security or compliance policy relevant to this event11 policies · optional	POL001
`policy_name`	string	Human-readable name of the policy11 names · optional	Data Access Policy
`anomaly_type`	string	Type of anomaly detected (e.g., unusual location, multiple failed logins, data exfiltration)3 types · optional	multiple failed logins
`event_description`	string	Detailed description of the event for audit and investigation purposesoptional	Guest joined meeting.
Numbers 1 column
`risk_score`	float	Numerical risk score assigned to the event (0-1, with 1 being highest risk)0 to 1 · optional	0.15
Dates and times 1 column
`event_timestamp`	datetime	Date and time when the access event occurred	2024-05-01T08:15:42Z
True or false 2 columns
`policy_compliance`	boolean	Whether the event was compliant with the relevant policyoptional	true
`anomaly_detected`	boolean	Indicates if the event was flagged as anomalous	false

Use it for

A technology dashboard
The policy_compliance rate, risk_score by collaboration_tool and a breakdown of policy_id. Excel, Power BI or Tableau.
Why do 44 of 50 rows have policy_compliance = true?
A class exercise
Hand out the rows and one question. Everyone works from the same 85 rows.
Events85
EVT100010.15Slack
EVT100020.06Teams
EVT100060.82Teams
A software demo
Believable events with event_timestamp, user_id and user_email to fill a screen in front of a buyer.

This dataset85 rows22 columns

Yours1,000 rows22 columnsip_address: UK only

blueprint · secure-collaboration-access-audit-log

Behind this dataset

Same schema. As many rows as you need.

These 85 rows came out of a blueprint — 22 columns with generation rules behind each one. Open it in Data Factory to retune a column, add your own, wire in foreign keys, and run it at the size you actually need.

Rules it was built with

Each access event must include a timestamp, user ID, and tool accessed.
Flag abnormal access attempts outside standard business hours.
Log access type (view, edit, share) and location (IP or region).
Mark entries that violate set security policies for review.
Include audit trail reference for regulatory compliance checks.

Rows1,000 rows10,000 rows100,000 rows1,000,000 rows

Open the blueprint in Data Factory

1 credit per row. Preview 20 rows free. Buy rows for the full run.

Exports: CSV, JSON, JSONL, Parquet, SQL, Excel, TSV, XML
Licence: yours to use, including commercially
API slug: secure-collaboration-access-audit-log

What should your data show?

No signup. No card.

Sample rows

What the 85 rows show

Columns

Use it for

A technology dashboard

A class exercise

A software demo

Make it yours.

Same schema. As many rows as you need.

More in Technology

What should your data show?