Enterprise / Activity record
Audit Logs
A searchable record of actions taken in your organization: who did what, to which resource, and when.
Reference
What an audit entry contains
Entries answer the four questions an investigation always starts with: who, what, which resource, and when.
- Actor
- The user, API key, or the platform itself when a scheduled job made the change.
- Action
- What was attempted, including actions that were denied — a refused attempt is often the interesting one.
- Resource
- The type and identifier of what was affected.
- Time and origin
- When it happened, with request context such as the client address.
- Category and severity
- Used for filtering and for routing entries to a security platform.
actor user 4821 (or an API key prefix, or "system") action security_settings.updated resource organization / 118 category security severity warning occurred 2026-08-01T14:20:11Z
Practice
Using the trail in practice
- Append-only for members
- Entries are not editable or deletable through the product, which is what makes the record worth keeping.
- Retention is configurable
- Choose how long entries are kept, and enforcement removes older entries in the background.
- Filter before exporting
- Narrow by category, actor, or period first — exporting everything is rarely what an auditor wants.
- Forward it if you have a SIEM
- Keep the dashboard for ad-hoc review and forward a copy to your security platform for retention and correlation.
Was this page helpful?