Curated Packages Audit Events

Audit Events provides visibility into package management activities, focusing on security, compliance, and governance transparency. It enables users with curation permissions to view, filter, analyze, and export audit data, helping to track how packages are managed within the organization. Audit data is retained for 30 days and can be accessed manually through the UI or via APIs and webhooks.

Go to Application > Curation > Audit Events.

Audit Events supports two inspection modes:

• Downloads — Package download and policy inspection events (Blocked, Approved, Dry Run, Not Inspected).
• CVS — Compliant Version Selection (CVS) events that record when Curation inspected versions and, when possible, selected a compliant alternative. For background on CVS behavior, see Compliant Version Selection.

Use the Inspection: control on the filter bar to switch between Downloads and CVS.

Prerequisites for CVS Events

• The CVS audit feature must be available on your Xray version. When it is not entitled or enabled, the CVS option is not shown.
• If Compliant Version Selection is turned off, the CVS table shows an empty state. Administrators can open Curation Settings to enable it.

Search Bar

The Search Bar allows users to filter and search audit events using:

• Package Name: Enter a package name to locate relevant audit events.
• Package Version: Specify a version to narrow your search results further.
• Date Picker: Adjust the time frame by selecting specific dates or a range of hours.

Downloads Results Table

When Downloads is selected, the Results Table is organized into four tabs that display audit results based on package status:

Blocked

• Lists packages that have been blocked due to policy violations.
• Clicking a package name reveals detailed information, including:
  • Validated Policies: Policies that triggered the block.
  • Reason for Validation: Explanation for why the package was blocked.
    • Package was blocked due to policy violation.
    • Package Pending Catalog Event: A package has not yet been cataloged, typically because developers have pulled the latest versions of the package. This can lead to a temporary state where the package is not immediately available for use within the organization's catalog.
      SLA for packages pending cataloging is up to four hours. Typically, these events generate updates in the Catalog database within two to three hours.
      A package is blocked in this state only by policies that are set to block pending packages, and developers can request a waiver against those policies.
      To learn more about resolutions and recommended actions for this scenario, see How to Manage “Package Pending Catalog” Events in JFrog Curation.
  • Package Information: Metadata about the package.
  • Remediation Recommendations: Suggested actions for resolution, such as links to fixed versions if available.
  • Related CVS activity (when available): If Compliant Version Selection ran for the package version, the right pane can show a summary of the CVS outcome. Select Open Detailed View to switch to the CVS Events table, pre-filtered to that CVS event, package, and version.

Approved

• Displays packages that have been successfully inspected by Curation policies.
• Some packages may appear as "bypassed," indicating that although they violated a policy, they were allowed through under relaxed conditions.

Dry Run

• Simulates the effect of policies without enforcing them.
• Helps users:
  • Assess the potential impact of proposed policy changes.
  • Identify packages that would have been blocked without disrupting workflows.
• Dry Run entries are informational only and do not affect actual package availability.

Not Inspected

• Shows packages that went through curation without being inspected by any policies.
• It's important to monitor this tab, as unvalidated packages could pose risks if they contain unreviewed malicious or vulnerable components.

CVS Events Table

When CVS is selected under Inspection:, the page shows the CVS Events table. Each row is a CVS inspection event (one client resolve or metadata request that triggered Compliant Version Selection).

Inspection Results

Exporting Audit Data

Users can export visible audit data into a CSV file for further analysis or reporting:

• Click the Export to CSV button located at the top right of the screen.
• Only the currently visible, filtered data will be exported.

Exports are available for Downloads tabs (Blocked, Approved, Dry Run, and Not Inspected). Availability of export for the CVS Events table depends on your platform version.

API and Webhook Integration

For programmatic access and workflow automation for Downloads audit data:

• Use the Get Audit Packages REST API (GET /api/v1/curation/audit/packages) to export approved, blocked, and dry-run audit events. See also the Audit API overview.
• Configure Curation Webhooks to receive events such as Package was blocked by Curation, waiver request updates, and policy configuration changes.

CVS Events in the UI are served by Compliant Versions audit endpoints used by the Audit Events page. The published export API and package-blocked webhook cover Downloads audit activity; use the CVS table in Audit Events to review Compliant Version Selection inspections.