Skip to main content

Audit Trail

The Audit trail page offers account activity data tracking for account admins. You can view various actions in the table- including logging, saving a search, creating alerts, adding users, updating dashboards, and more.

Each action includes information about the user who performed it, such as user ID, name, server IP, geolocation, and the time and date in which the action took place.

Audit trail screen

To access the page, navigate to Settings > Audit trail.

Audit trail location

View and filter Audit trail

The Audit trail table lets you focus on specific actions or users in a certain timeframe.

The User Name dropdown menu includes all users connected to the account, and the Actions menu shows all of the actions done inside the account. These actions include:

Admin actionsUser actions
Login infoUser saved an object (visualization/dashboard/search)
Failed login infoUser deleted an object
Changed passwordUser installed an ELK app
Reset passwordUser created a token Customer Success made authorized changes in the accountUser updated a token
Added userUser deleted a token
Updated user roleUser created a token filter
Deleted userUser updated a token filter
Admin changed permissions for support accessUser deleted a token filter
Admin created a sub accountUser created an alert
Admin updated a sub accountUser updated an alert
Admin deleted a sub accountUser deleted an alert
User created an endpoint
User updated an endpoint
User deleted an endpoint
User created a bucket
User updated a bucket
User deleted a bucket
User created S3 archiving
User updated S3 archiving
User deleted S3 archiving
User created a sawmill configuration with Data Parsing
User updated a sawmill configuration with Data Parsing
User updated field mapping

Currently, you can only choose one user and/or one action when filtering.

In addition, you can change your view based on a particular time range to optimize your view. You can also edit the table by adding/removing different columns - click the Columns button and choose the relevant fields.

Audit trail location

To export the data, click on the CSV button. The file would include all available fields, including those filtered out in your current view.