Audit Log

The enterprise audit log records security, governance, and administration events in one searchable timeline. Use it to answer who changed something, what resource changed, when it happened, and whether the action came from the UI, API, an agent, or the system.

Open Settings, Audit log. Your role needs permission to view the enterprise audit log.

Find events

Search by user, resource, detail, or event ID. You can combine filters for action, user, workspace, team, source, and time range. Sort by time or action to move between recent activity and related event types.

The action filter groups events by areas such as members, roles, workspaces, teams, tokens, rulesets, compliance, agents, connectors, workflows, integrations, billing, and enterprise administration.

Inspect an event

Select a row to open its details. Depending on the event, the panel shows the following information.

• The action key, timestamp, source, detail, and recorded reason
• The actor type, name, email, and user ID
• The resource type, label, ID, and workspace
• A changeset ID that connects related events
• Request context such as IP address, user agent, and request ID

System jobs and webhooks may not have browser request context. Deleted or renamed resources keep the label recorded when the event occurred when that label was available.

Export to a SIEM

For continuous ingestion outside the app, configure the enterprise SIEM export. The export uses the same audit event stream while providing cursor-based delivery and integration status for your security tooling.