Audit log

What it is#

The audit log is the record of what happened in this workspace: invitations, role changes, suspensions, removals, sign-ins, policy edits and every other action that changes something. Two tabs — Entries, the feed itself, and Streaming, where you point that feed at your own security tooling.

How to get there#

Security → Audit Log in the admin console. The feed is ADMIN-only: the trail names who suspended whom and from which address, which is material a member has no business reading about their colleagues.

• Export needs security.audit_export. A person without it gets a refusal from the route rather than a hidden button, because a missing control is indistinguishable from a missing feature.
• Streaming — adding, editing and pausing a destination — needs security.policy and the enterprise.audit_export entitlement. The export file itself is not entitlement-gated; the pipe is.

How to use it#

Read the feed#

1. The Entries tab lists the newest rows first: the action, the person or System, the target, the time and the address.
2. Filter by action matches an action namespace, so typing member. returns every member action and member.invite does not also return member.invite_cancel.
3. Load more pages backwards by cursor rather than page number, so rows written while you read cannot be repeated or skipped.

Export a range#

1. Press Export. The dialog opens seeded with whatever filter is on screen, so the file matches the list.
2. Pick a from and to date. from is inclusive at both ends, and a backwards range is refused here rather than returning an empty file that reads like a quiet period.
3. Choose a format: CSV (the default), JSON, NDJSON or CEF — the same three shapes the streaming destinations accept, plus CSV for whoever is opening it in a spreadsheet.
4. The file downloads and the dialog reports the row count. Zero rows is an answer, not a failure.
5. If the export hit the 50,000-row cap the dialog says so and offers the next range, rather than leaving you to work out an off-by-one.

Stream the log to a SIEM#

1. Open Streaming → Add destination.
2. Choose a kind: Generic HTTPS collector, Splunk HTTP Event Collector, Datadog Logs, or S3-compatible object storage.
3. Choose a format — JSON, NDJSON or CEF — and optionally a list of action prefixes so only part of the log is sent.
4. Save. Every kind except generic HTTPS needs a credential; the card says whether one is present.
5. Press Send test. On success it reports the size and HTTP status; on failure it shows the far side's own words, because a generic "delivery failed" would leave you guessing between a wrong token, a wrong index and a firewall.

Check that the feed is healthy#

Each destination carries one word: Healthy, Nothing sent, Failing with a count, No credential, Off, or Parked. Expand the card for the delivery history, which includes the EMPTY attempts — a history of only non-empty deliveries cannot tell a quiet Tuesday from a broken feed.

Restart a parked destination#

A destination that failed repeatedly stops itself and will not resume on its own. The card states why in a sentence rather than a badge. Fix the far side, then use the Streaming toggle to switch it back on.

What it affects#

• Nothing in the workspace. The feed is a record; reading, exporting or streaming it changes no data.
• What your security team sees. A destination that is off, parked or missing a credential is silence at the other end, and silence is a SIEM feed's characteristic failure — every dashboard stays green and the gap is discovered during the incident it was supposed to cover.
• Deleting a destination stops delivery from that moment. Rows already delivered stay where they went.

On mobile#

/admin/audit-log in the Expo app is the feed, read-only, with the action filter as a chip strip and the same cursor paging. /admin/audit-stream carries the health half: read a destination's state, send a test event, pause or resume. Composing a destination and exporting a file stay on the web.

Limits and gotchas#

• The resume point an export offers is the last row's timestamp, not the row after it, so consecutive ranges overlap by one instant on purpose. A duplicate row in an export is visible to whoever reads it; a missing one is not.
• Streaming needs the ENTERPRISE enterprise.audit_export entitlement. Without it the tab loads but no destination can be created.
• The Entries feed is ADMIN-only. A delegate holding security.view can reach Security but not this page.
• A destination's delivery history counts attempts, not events: an attempt that carried nothing is recorded as EMPTY rather than dropped.

Related#

• Security — the sign-in log, which is a different record from this one.
• Privacy — data-subject requests, retention and legal holds.
• Members — the screen most of these rows are about.
• Exports — the other ways data leaves Projectri.