Atlas Activity Feed
Parent: MongoDB Atlas IAM and RBAC · Published reference · snapshot 2026-10-23 · skill mongodb-cohort-59597c811d2a
↓ Facts as markdownall context files
Source-anchored research for Atlas Activity Feed. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
How it works
- The Activity Feed complements database audit logs and MongoDB process logs. MongoDB recommends combining the three for a full audit; feed visibility alone does not establish complete database-operation coverage. (high confidence) [source]
Problems, failure modes and limitations
- Native export delivers at least once, normally flushing batches about once per minute. Consumers should deduplicate with mongodb.event.id. Undelivered events expire after seven days; the initial release provides no automatic replay, historical backfill, or failure alerts. (low confidence) (verified as of 2026-10-23) [source]
- OneUptime’s March 31, 2026 article illustrates polling /orgs/{ORG_ID}/events for SIEM forwarding. Its sample returns only one results page and advances its watermark to the current time after processing; copying it without pagination and overlap can omit events. This limitation is an analysis of the published example, not a reported Atlas defect. (low confidence) (verified as of 2026-03-31) [source]
Comparisons and alternatives
- A Nimbly engineer’s July 1, 2026 incident write-up correlated Project Activity Feed records with GCP logs and process metrics. Its timeline includes maintenance, elections, auto-healing and MongoDB employee log-download or host-access events. This is a concrete use of feed attribution and timestamps during investigation, rather than independent proof of the author’s root-cause conclusions. (low confidence) [source]
- Organization and project feeds expose selected management events, including access and configuration changes; they complement database audit logs rather than providing a complete record of database queries. (medium confidence) [source]
Facts and statements
- Atlas separates organization and project Activity Feeds. The organization feed includes selected billing and access events; the project feed gives more granular operational context. These records help reviewers investigate Atlas access and configuration changes. (high confidence) [source]
- Viewing the organization feed requires at least Organization Member; viewing the project feed requires at least Project Read Only. A September 2023 practitioner thread reported that assigning project read-only access also exposed organization-feed metadata through Organization Member membership. Treat organization-feed visibility as an IAM review consideration. (medium confidence) (verified as of 2026-10-14) [source]
- The updated Data Explorer records user connections and one listIndexStats entry per collection access, with the Atlas username; individual CRUD operations and regular index builds no longer generate feed entries. MongoDB directs additional user tracking to database auditing with Data Explorer role filters. (low confidence) (verified as of 2026-10-23) [source]
- The Atlas CLI exposes atlas events organizations list and atlas events projects list. The Atlas Administration API also provides organization and project event-list resources, enabling programmatic collection of feed records. (high confidence) [source]
- The SDK labels the /groups/{groupId}/activityFeed and /orgs/{orgId}/activityFeed operations as returning pre-filtered links. These link operations serve a different purpose from retrieving event records through the event-list resources. (medium confidence) (verified as of 2026-10-21) [source]
- MongoDB documents native event export to external destinations with logTypes including EVENTS. Project event export supports the log-export destinations; organization export initially supports OTel only and uses preview API endpoints. Event export does not require an M10+ cluster. (low confidence) (verified as of 2026-10-23) [source]
- Independent incident discussions use Activity Feed changes as investigative leads, not sufficient causal proof. A Meteor user correlated server-address/version changes with latency; a Nimbly write-up combined feed events with cloud logs and metrics to reconstruct its incident timeline. (medium confidence) [source]
- A May 2021 community report initially saw no relevant Project Activity Feed entries during connectivity trouble, then saw cluster-update records after revisiting the feed. This historical anecdote supports rechecking and correlating evidence; it does not establish a current delivery-delay guarantee. (low confidence) [source]
- The UI supports filtering by event, severity, initiator, and time; project feeds additionally support cluster filtering. (low confidence) (verified as of 2026-10-23) [source]
- Native project event export supports S3, Azure Blob Storage, Google Cloud Storage, Datadog, Splunk, and OpenTelemetry; organization export initially supports only OpenTelemetry. Configuration requires Project Owner or Organization Owner respectively, and event export supports all cluster tiers. (low confidence) (verified as of 2026-10-23) [source]
- Event-export API integrations include EVENTS in logTypes. Organization endpoints are preview and require Accept: application/vnd.atlas.preview+json. (low confidence) (verified as of 2026-10-23) [source]
- Elastic supplies separate organization and project event data streams alongside database audit streams, offering a collector-based path for centralized Atlas monitoring. (low confidence) (verified as of 2026-10-23) [source]
Children
- No children recorded.