Searchable audit log
Review administrative changes and their recorded actors.
The Audit log records attributable administrative and operational changes, newest first. It belongs to the active organization and covers configuration and lifecycle changes—check results follow their own retention policy and are not logged here.
Search and filter
Filter the log with:
- an action search;
- an inclusive UTC date range (24h / 7d / 30d / 90d / All, or a custom range);
- facet chips for Category, Action, Actor, and Impact.
Impact is derived from the action: deletions and revocations are destructive, disables and pauses are disruptive, creations and resolutions are constructive, everything else is informational. Facet counts are computed over the date range and text search, so a filter can always be widened again.
Columns sort by time, action, or actor. Filtered views are shareable URLs, and you can export the current page or selection as CSV or JSON.
Inspect an event
Opening a row shows:
- the action and category, with timestamps in local, UTC, ISO 8601, and epoch formats;
- the actor's identity, role, and tenure, or System for automated actions;
- how often the action has been recorded and by how many people;
- everything the organization recorded within five minutes either side of the event;
- the stored record as JSON.
Use Older/Newer to walk the log without closing the panel. Audit events are append-only; the log cannot edit or remove them.