Audit log
Admin → Audit log
What it records
Section titled “What it records”Every change, every file download and every admin action: setting changes, rule changes (with the rule text), member removal, connector connection and use, approvals, budget alerts firing, SSO joins and more. The log cannot be edited.
Using it
Section titled “Using it”- Filter by time range, person, action (an exact action or a prefix such as
file.*) and target. - Export the result for your SIEM, your auditors or an investigation. Exports are generated as downloadable files.
- Via the API you can query the same data (see the developer docs).
org_admincan read and export.auditorcan read and export and nothing else. This is the role for compliance, internal audit and your DPO: they see the trail, and cannot change anything.
What it keeps
Section titled “What it keeps”Entries stay after a member is removed, as your record of what happened. Local-action detail depends on the
desktop audit setting: metadata records the device, folder, tool, decision and outcome;
detailed also records paths and commands.
Why it matters
Section titled “Why it matters”When a regulator, a client or your own board asks “who accessed this and when”, you answer from the log, not from memory. Connector and agent actions name the actor, so an unattended agent is distinguishable from a person.
Examples
Section titled “Examples”“Who sent that email?”
Section titled ““Who sent that email?””Situation: A client asks who authorised an invitation to their staff.
Setup: Filter by action connector.*, the day and the person.
Result: You see the approval, who approved it and when. For agents, you see the agent as the actor.
Monthly review
Section titled “Monthly review”Situation: Your policy requires a monthly review of admin actions.
Setup: Filter by org.* and agent.* for the month, and export it. Give the auditor role to the reviewer.
Result: One file per month for the file, produced in two minutes.
Evidence for a regulator
Section titled “Evidence for a regulator”Situation: A supervisor asks how you control access to the tool. Setup: Export the entries for member removal, rule changes and connector settings. Result: A dated record of every control change, including the exact text of every rule.