Audit Logs

Overview

Audit logs provide a record of user actions and system events. They are the primary tool for answering:

• Who changed something?
• What changed?
• When did it happen?
• Where did it originate (IP/device)?

What audit logs typically include

• timestamp
• user and role
• action (create/update/delete/execute/configure)
• entity (project, endpoint, test, system setting)
• status (success/failure)
• source IP or origin

Filtering and investigation workflow

1. Filter by time range first.
2. Narrow by user/role.
3. Filter by entity and action.
4. Export results for compliance or incident response.

Best practices

• Review audit logs regularly (weekly/monthly depending on your security posture).
• Keep admin access limited and monitored.
• Pair audit logs with Debug logging for troubleshooting (enable debug temporarily).

Related articles

• Role permissions
• User policies