Audit log

The audit log records who did what; admins read it in the app and export it to CSV.

What administrators can access and how audit records are stored: Administrator access and audit.

Read the audit log

Open Settings > Admin > Audit log. Filter it by person, event and date (the default period is Last 30 days).

Workspace admins see their own workspace; organization admins see everything.
Each agent also has its own action log.

The Audit log page has a search box, filters for workspace (All workspaces), event (All events), actor (All actors) and date (for example Last 30 days), and an Export this view button. Each row shows the time (UTC), the outcome (for example Granted, Allowed, Changed, Revoked) and the event, such as who granted a role on which workspace to whom, or who allowed an agent to use a connector tool on someone’s behalf.

Export

Export the current view to CSV with Export this view, up to 1,000 rows per export. If the view holds more, the export has the most recent 1,000 events.

Your organization exports the audit log whenever it wants, and decides who reviews it and how often.

Where audit events are kept

Audit events are kept in your own database, which your eDiscovery tools can reach directly.

Send audit events to a SIEM

Planned: an audit API for your SIEM. It is not available yet; until then, use CSV export.

An audit API on your install. Your SIEM calls it on its own schedule to collect the audit events.
Events come in OpenTelemetry, the industry-standard telemetry format, so any SIEM that reads OpenTelemetry ingests them without a custom parser.
The API only reads the audit log; it cannot change it.
Once the API is available, your SIEM pulls the events directly.

Step	Where	How
Audit log	In your database	Source of the events
Audit API	On your install	Read only, OpenTelemetry
SIEM	Your security monitoring	Pulls on its own schedule

flowchart LR
  L["Audit log (in your database)"] --> A["Audit API (read only, OpenTelemetry)"] --> S["SIEM (pulls on its own schedule)"]