TA-airtable-auditlogs

TA-airtable-auditlogs collects enterprise audit log events from Airtable's Web API and indexes them into Splunk, filling a gap where no official or community add-on previously existed for Airtable audit data. The add-on runs as a Python 3 modular input on a Splunk Heavy Forwarder. It authenticates to Airtable using a Personal Access Token (PAT) stored securely in Splunk's encrypted credential store (storage/passwords), and polls the Airtable Enterprise Audit Log API on a configurable interval. Collected events cover administrative, security, and collaboration activity across your Airtable enterprise account, including base and workspace collaboration, user and group management, role changes, sharing and permission changes, OAuth and personal access token activity, enterprise settings and license changes, workflow and automation activity, and managed app / AI feature usage. High-volume, low-security-value event types (such as routine view and login events) are excluded server-side by default before they reach your index, helping control license usage without losing audit-relevant activity. Event category filtering and exclusions are fully configurable per input. Events are indexed with sourcetype airtable:auditlog and mapped toward Splunk CIM-friendly fields, making the data easier to correlate with other audit and identity sources already in your environment. The add-on supports pagination and configurable page size / max-pages-per-run to control API load and indexing volume per polling cycle. This add-on is intended for Splunk admins and security teams who use Airtable as part of their enterprise workflow and need visibility into administrative and security-relevant activity for compliance, insider-risk monitoring, or general operational audit purposes.