Skip to main content
The Audit log (under Settings → Audit log, /settings/audit) records the activity that happens inside a workspace. Its subtitle summarizes the purpose: “View and export workspace activity”. Every significant action — creating or revoking an API key, deleting a scan target, and other workspace operations — is captured as an event with the actor who performed it and the outcome. The audit log is the primary source of truth for compliance reporting and incident investigation.

​
Key concepts

​
Events

Each event describes a single action against a resource. Events are immutable: they are written when the action occurs and cannot be edited or deleted from the console.

​
Actors

Events are attributed to an actor — a user, an API key, the system, or an agent (such as a worker). This makes it possible to trace who or what changed the workspace. Events from a user whose account no longer exists show the actor as Deleted user.

​
Outcomes

Every event has one of three outcomes: Success, Failure, or Denied (the actor lacked permission). Only non-success outcomes get a badge in the event list, so failures and denials stand out.

​
Browse the audit log

1

Open Settings → Audit log

Open Settings and select Audit log in the Workspace group. You need the audit.read permission; without it the page shows an access-denied message.
2

Read the event list

Events appear newest first under Recent events, 50 per page. Each entry shows the actor’s avatar and name, the action key, the readable action label, the resource type and ID, the source IP, and a relative time (hover it for the exact timestamp).
3

Page through history

Use Older and Newer below the list to move between pages.
4

Inspect an event

Click an event (or focus it and press Enter) to open the detail panel.

​
Event details

The detail panel shows the action label, the exact time, the outcome badge, and: Click View raw JSON to see the complete event record.

​
Filters

The toolbar above the list has a Filter button, a Date range picker, and Export CSV. Each field can be used once, and conditions are combined with AND. The active filter is summarized next to the Filter button; click the × to clear it. On a phone, the filter builder opens as a bottom sheet.
Click an actor’s name or an action key in the list to filter by it instantly. This replaces any existing condition on that field.

​
Export the audit log

Click Export CSV to download the events that match the current filters and date range. The file is named audit-<workspace>-<date>.csv, and a notification confirms how many events were exported. Exports are capped at 10,000 rows — narrow the filters or date range if the export is rejected. The CSV can be imported into spreadsheets or SIEM tooling for further analysis and long-term retention.

​
Example events

The audit log captures workspace activity, including actions such as Created API key, Revoked API key, and Deleted scan target. Resources include scan targets, API keys, and other items the workspace manages. Events are also recorded when an action fails — failed attempts are valuable for incident investigation.

​
Best practices

  • Review the audit log regularly as part of your security operations routine.
  • Use the Actor filter to investigate a specific user, API key, or agent after an incident.
  • Filter by Outcome = Failure or Outcome = Denied to surface repeated failed or unauthorized attempts that may indicate misconfiguration or abuse.
  • Export a CSV snapshot periodically for compliance and long-term retention.
  • Combine the audit log with API key rotation and member reviews to close access-related findings quickly.

API keys

Track creation and revocation of workspace API keys

Members

Understand the actors behind workspace activity

Workspace

See which tenant the audit events belong to

Worker

Identify agent activity in the audit log