Chronicle events

Posit Package Manager emits telemetry events to Posit Chronicle when significant actions occur. Chronicle exports these events as OpenTelemetry log records, which you can query from the curated data sets.

Each event has an event.name attribute that identifies the event type. The sections below document each event and its attributes.

ppm.user.login

Emitted when a user successfully authenticates via SSO.

Attribute	Type	Description
user.guid	string	Identity of the authenticated user, taken from the OpenID Connect UsernameClaim (or UniqueIdClaim when that claim is empty).

ppm.package.download

Emitted when a client downloads a package from a repository.

Attribute	Type	Description
package.name	string	Name of the downloaded package
package.version	string	Version of the downloaded package
package.language	string	Language ecosystem: r, python, vscode, or plugins
package.type	string	Package format: source or binary
repository.name	string	Name of the repository serving the package
repository.type	string	Source type of the repository (e.g., cran, pypi, bioconductor, curated-cran, local)
client.ip	string	IP address of the client
client.user_agent	string	Raw User-Agent header from the request
http.status_code	int	HTTP status code of the response
response.bytes	int	Number of bytes in the response body
binary.distribution	string	(Optional) Binary distribution tag (e.g., 4.3-jammy). Present only for binary packages.
client.os	string	(Optional) Operating system parsed from the User-Agent
client.language_version	string	(Optional) R version of the client (e.g., R 4.3.1). Present only for R clients.
user.guid	string	(Optional) Identity of the authenticated user (see ppm.user.login for details). Present only for authenticated requests.

ppm.package.publish

Emitted when a user publishes a package to a local source.

Attribute	Type	Description
package.name	string	Name of the published package
package.version	string	Version of the published package
package.language	string	Language ecosystem: r, python, vscode, or plugins
source.name	string	Name of the local source receiving the package
is_update	bool	true if updating an existing package version, false if publishing a new version
publisher.user_id	string	(Optional) OpenID Connect (OIDC) subject of the publishing user, if authenticated

ppm.package.delete

Emitted when a user deletes a package from a local source.

Attribute	Type	Description
package.name	string	Name of the deleted package
package.version	string	Version that was deleted, or * if all versions were deleted
source.name	string	Name of the local source the package was deleted from
deleted_by.user_id	string	(Optional) User ID of who performed the deletion
reason	string	(Optional) Reason for the deletion

ppm.vulnerability.blocked

Emitted when Package Manager blocks a package download due to a vulnerability-based blocklist rule.

Attribute	Type	Description
package.name	string	Name of the blocked package
package.version	string	Version of the blocked package
package.language	string	Language ecosystem: r, python, or vscode
vulnerability.id	string	CVE or advisory ID (e.g., CVE-2021-44228, GHSA-xxxx-yyyy-zzzz)
vulnerability.severity	string	Severity level: critical, high, medium, low, or unscored
vulnerability.title	string	Brief description of the vulnerability
repository.name	string	Name of the repository serving the package
action	string	Action taken (always blocked)
policy.name	string	Description of the blocklist rule that triggered the block
vulnerability.cvss_score	float	(Optional) CVSS base score. Omitted for unscored vulnerabilities.
client.ip	string	(Optional) IP address of the client
user.guid	string	(Optional) Identity of the authenticated user (see ppm.user.login for details). Present only for authenticated requests.