---
title: "Notion Notion Integration"
slug: "notion-notion"
updated: 2026-11-04T19:55:42Z
published: 2026-11-04T19:55:42Z
canonical: "docs.hunters.ai/notion-notion"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Notion Notion Integration

## TL;DR

| Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Notion Audit Logs |  | ✅ | ✅ | ✅ | `notion_audit_logs` | JSON | Webhook |

## Overview

Notion is a collaborative workspace platform combining notes, databases, wikis, and project management tools. Notion's Audit Log API (delivered here via webhook) emits structured event records that capture user and bot activity across a workspace, such as page views, edits, creations, deletions, permission changes, search queries, file uploads, and AI agent interactions. Each event documents the actor who performed the action, the affected page/block/database target, the workspace context, and the client platform and IP address used. These logs are valuable for security operations teams to monitor insider activity, detect unauthorized access or permission escalation, track data exfiltration (e.g., file downloads, searches, sharing changes), and investigate anomalous behavior tied to specific users, bots, or AI agents within the Notion workspace. By ingesting these events into Hunters, security teams gain centralized visibility and detection coverage over Notion workspace activity alongside their other data sources.

## Supported data types

### Notion Audit Logs

**Table name:** `notion_audit_logs`

This data type contains Notion workspace audit events, including actions performed by human users, bots, and AI agents, such as page views, content edits, page creation/deletion, permission and role changes, search queries, file uploads/deletions, logins/logouts, database schema edits, and automation/agent activity. Each event includes the actor identity, the affected object (page, block, or database), the workspace context, and client details such as platform and IP address, which can be used to detect unauthorized access, privilege escalation, and suspicious data movement within a Notion workspace.

**Expected format**

Logs are expected in JSON format.

`{"event":{"actor":{"id":"764f4c52-ffb5-4fdd-84d7-6f941932bc25","object":"user","person":{"email":"user-3a2289ee@example.com"},"type":"person"},"id":"77b2a61f-0192-4c0e-8d90-7a57eb7eb54a","ip_address":"fd00::d5a1:5d54","page.content_edited":{"blocks_updated":[{"block_id":"22baf59b-1fab-4f12-8954-5f6bf4885e0a","type":"block_id"}],"page_audience":"private","page_name":"1:1 Notes | person-name-9c7088b1","target":{"page_id":"8a267c10-c36a-47f9-8eed-ecf67fa54930","type":"page_id"}},"platform":"mac-desktop","timestamp":"2026-11-04T13:15:51.637Z","type":"page.content_edited","workspace_id":"e19d4c61-e806-43dd-8d5e-2f04157fc2fc","workspace_name":"organization-2903bac1"}}`

## Send data to Hunters

Hunters supports the collection of Notion logs using Webhook.

**To connect Notion logs:**

1. Connect the data source in the Hunters portal as described in [this section](https://docs.hunters.ai/docs/connect-a-data-source-using-apiwebhook).
2. Configure Notion to send its events to the Hunters webhook, following the vendor documentation:
  - In your Notion workspace, set up a custom SIEM integration under the workspace's Data & Compliance / Audit log settings to stream a continuous, real-time feed of audit log events directly to the Hunters webhook endpoint configured in step 1.
  - Reference Notion's [Database](https://developers.notion.com/reference/database) and [Property object](https://developers.notion.com/reference/property-object) API documentation to understand the structure of the databases and properties whose activity is captured in the audit events.
  - Review this [video walkthrough](https://www.youtube.com/watch?v=gVQ6fl3y7yY) for guidance on configuring Notion integrations.
  - Review Notion's blog post on [breaking schema changes](https://www.notion.com/blog/how-notion-catches-breaking-schema-changes) to stay informed of changes that may affect the structure of event data streamed to the webhook.