Workday activity logging

Important

Lakewatch is in Private Preview. To request access, reach out to your Azure Databricks account team.

Lakewatch provides an API connector to ingest data from Workday Activity Logging. This article covers prerequisites, configuration instructions, connector schemas, and Lakewatch parser observables.

Prerequisites

The connector requires:

  1. Serverless Lakeflow Spark Declarative Pipelines turned on in your workspace.
  2. Unity Catalog, with privileges to create or use a Unity Catalog connection. See Connection permissions.
  3. Permission in Workday to edit tenant settings, create integration system users and security groups, update domain security policies, register API clients, and generate refresh tokens.

Known limitations

  • SCD type 2 is not supported, since the Workday activity logs are append-only.
  • Historical lookback can't exceed 30 days. See Choose how far back to ingest.

Configure Workday for ingestion

Configure Workday to enable authentication and user activity log access.

Enable activity logging and OAuth

  1. In Workday, search for and select Edit Tenant Setup - System.
  2. Ensure that Enable User Activity Logging is selected.
  3. Search for and select Edit Tenant Setup - Security.
  4. Ensure that OAuth 2.0 Clients Enabled is selected.

Create an integration system user

  1. In Workday, search for and select Create Integration System User.
  2. Enter a user name. For example, ISU_Databricks.
  3. Enter a new password.
  4. Set Session Timeout Minutes to 0.
  5. Select Don't Allow UI Sessions.
  6. Click OK.
  7. Record the user name. You use it when you generate the refresh token.

Configure security permissions

  1. In Workday, search for and select Create Security Group.
  2. For Type of Tenanted Security Group, select Integration System Security Group (Unconstrained), and enter a name for the group. For example, ISSG_Databricks_Monitoring.
  3. Click OK.
  4. In the next form, add the integration system user to Integration System Users.
  5. Click OK, then click Done.
  6. Search for and select View Domain.
  7. For Domain, select System Auditing.
  8. Click the three-dot menu next to the System Auditing domain name, then select Domain > Edit Security Policy Permissions.
  9. Add the security group to the Report/Task Permissions table and grant it View access.
  10. Add the security group to the Integration Permissions table and grant it Get access.
  11. Click OK, then click Done.
  12. Search for and select Activate Pending Security Policy Changes.
  13. Enter a description for the change.
  14. Click OK.

Register an API client

  1. In Workday, search for and select Register API Clients for Integrations.
  2. Enter a Client Name. For example, Databricks User Activity Monitor.
  3. Select Non-Expiring Refresh Tokens to avoid interruptions caused by refresh token expiration.
  4. For Scope (Functional Areas), select System.
  5. Click OK.
  6. Record the Client ID and Client Secret. You use these values when you create the Unity Catalog connection.

Retrieve the Workday values for Databricks authentication

  1. In Workday, search for and select View API Clients.
  2. Select the API Clients for Integrations tab.
  3. For the API client that you created, confirm that the following settings are enabled:
    • Client Grant Type: Authorization Code Grant
    • Access Token Type: Bearer
  4. Locate the Workday REST API Endpoint. Record the following values from the URL:
    • The instance domain, ending in .com and excluding the scheme and path. For example, wd2-impl-services1.workday.com.
    • The tenant name, which appears after /v1/ in the URL.
  5. Click the API client link. On the View API Client page, click the three-dot menu next to the client name.
  6. Select API Client > Manage Refresh Token for Integrations.
  7. For Workday Account, select the integration system user, then click OK.
  8. Select Generate New Refresh Token, then click OK.
  9. Record the refresh token. You use it when you create the Unity Catalog connection.

Tip

When creating a connection through the Lakewatch UI, you need the Instance URL, Tenant name, Client ID, Client Secret, and Refresh Token gathered above.

Next steps

After completing the configuration above, create a datasource with the Workday connector in the Lakewatch UI. See API connectors for instructions.

Connector and Lakewatch schemas

The connector ingests the following source table from the default source schema:

Source table Workday data Built-in Lakewatch parser
activity_logging User activity logging events workday_activity

The connector writes the source table to the datasource's raw destination. The built-in parser writes a separate parsed table named after the parser, unless you set a parsed destination when you configure the datasource.

Lakewatch-managed columns

The connector adds the following columns to each raw source row:

  • lw_id: A non-null string that Lakewatch uses as the primary key. The connector derives a stable, time-sortable ID from the Workday requestTime and the complete source record. The ID supports deduplication across incremental syncs.
  • time: A non-null timestamp copied from requestTime. The connector uses time as the cursor field for incremental ingestion.

For Lakewatch datasources, the raw table also contains these columns, and the parsed table carries all three Lakewatch-managed fields forward:

  • lw_meta: Standard Lakewatch processing metadata.
  • lw_observables: Values extracted from fields marked as security observables in the parser.

The parser also assigns the parsed time column.

For more information, see Parser reference.

Raw connector table schema

The following schema combines the standard Lakeflow Connect fields with Lakewatch-managed fields.

Schema
Column Data type
lw_id STRING
time TIMESTAMP
systemAccount STRING
activityAction STRING
requestTime TIMESTAMP
userAgent STRING
taskId STRING
deviceType STRING
ipAddress STRING
userActivityEntryCount LONG
sessionId STRING
target STRUCT<id: STRING, descriptor: STRING, href: STRING>
taskDisplayName STRING
lw_observables STRUCT<account_ids: ARRAY<STRING>, actor_ids: ARRAY<STRING>, cves: ARRAY<STRING>, device_ids: ARRAY<STRING>, emails: ARRAY<STRING>, hashes: ARRAY<STRING>, hostnames: ARRAY<STRING>, ip_addresses: ARRAY<STRING>, mac_addresses: ARRAY<STRING>, mitre_attack_technique_ids: ARRAY<STRING>, request_trace_ids: ARRAY<STRING>, resource_ids: ARRAY<STRING>, resource_tags: ARRAY<STRING>, serial_numbers: ARRAY<STRING>, usernames: ARRAY<STRING>>
lw_meta STRUCT<datasource_id: STRING, datasource_name: STRING, connection_name: STRING, parser_name: STRING, parser_version: STRING, ingestion_time: TIMESTAMP>

Parser observables

The workday_activity parser writes target as VARIANT and extracts the following fields into lw_observables.

Observables
Field Observable
systemAccount email
ipAddress ip
target.href url
  • Last updated on