Creator of a new, unknown dashboard

[davidvm02-giss]

Good afternoon,
We have noticed that new dashboards have been created in our environment, and instead of the name of the user who created them, an identifier appears.
We are trying to determine the origin of this creation using the audit log, in case it was generated by a token call to the API, an external source, or some other possibility.
Could you help me find this information via the audit log or another method?
Many thanks and best regards, David.

[MaximilianoML]

Hello @davidvm02-giss,

Yes, you should be able to investigate this through Dynatrace Audit Logs.
If a dashboard shows an identifier instead of a normal user name, it often means it was created by a non-interactive identity such as an API token, OAuth/service user, or automation rather than directly from the UI.

Maybe this query helps you to figure out:

fetch dt.system.events
| filter event.kind == "AUDIT_EVENT"
| filter contains(toString(resource), "dashboard") or contains(toString(content), "dashboard")
| sort timestamp desc

 I hope it help 😀