Comment 4 for bug 1822135

++ on CADF notifications, which have an "eventTime" field which would specify in this case the time the project was created and by which user.

There's even an example for project create:

https://docs.openstack.org/keystone/latest/admin/event_notifications.html#example-notification-project-create

I believe the default notification driver is rabbitmq and it's thrown into the "notifications.info" queue.