The audit log keeps a record of what happens in your organization: scans that were started, labels that were created, members that were invited, new findings that were detected on a target, and more. Use it to follow up on changes, answer the question "who changed this?", and keep a history for compliance.
You can open the full audit log from the menu, and you also see a short version of it on your dashboard.
Open the audit log
- In the left-hand menu, under Organization Management, click Audit log.
The log shows the most recent events first. Each entry shows:
-
An icon for the type of event.
-
Who did it. Events done by a person show their name. Events that happen automatically, such as a newly detected finding, have no name. These are called system events.
-
What happened, and on which target or port when that applies.
-
When it happened, for example 25m ago.
By default, the log shows the last month.
You need the View Audit Logs permission to see the audit log. See User roles and permissions.
Similar events are grouped
When the same kind of event happens many times in a row, the log groups them to keep the page readable. For example, a scan can connect several assets to a target in one go.
-
Click Expand 9 similar items to see all the items in the group.
-
Use the page buttons at the bottom of the group to move through longer lists.
-
Click the minus button at the top right of the group to collapse it again.
Filter the audit log
Use the filters at the top of the page to find specific events. The log updates as soon as you change a filter.
Event type
-
Click Event type.
-
Type in the search box to find an event type, for example
scan. -
Tick one or more event types.
The selected types appear in the filter field. Click the x next to a type to remove it, or the x at the end of the field to clear them all.
Target
Click Target and select one or more targets to only see events for those targets.
Member
Click Member and select one or more members to see what they did. Switch on System events (no member) at the bottom of the list to show events that happened automatically, without a person.
Date range
-
Click the date field.
-
Pick a start and end date in the calendar, or click a shortcut below the calendar: Current month, Last month, Current quarter, Last quarter or This year.
-
Click the x in the date field to clear the range.
Export the audit log
Click the Export CSV button to download the audit log as a CSV file. Click the arrow next to the button to choose a format:
-
Export as CSV
-
Export as JSON
Activity widget on the dashboard
At the bottom right of your dashboard, the Activity widget shows the latest events in a compact list. It works the same way as the audit log: similar items are grouped and can be expanded, and you can scroll through the list.
Use the widget for a quick look at what has just happened. Open the Audit log from the menu when you need to filter, search a longer period or export.
Event types
You can filter on these event types.
| Area | Event types |
|---|---|
| Targets and findings | Asset connected to target, Asset unbound from target, Certificate connected to target, Certificate unbound from target, Detection connected to target, Detection unbound from target, Dns record connected to target |
| Scans | Started scan for target, Started scan for label, Cancelled scan |
| Labels | Created label, Assign label to target |
| Members, groups and access | Created organization invitation, Deleted organization member, Created organization group, Assign organization group to label, Assign organization group to role, Assign target label to user, Removed target label from user |
| Subscription | Prepare subscription update, Restart organization subscription |
Tips
-
To check who started a scan, filter on the event types Started scan for target and Started scan for label.
-
To review access changes, filter on Assign target label to user, Removed target label from user and Assign organization group to role.
-
To see only automatic events, filter on Member and switch on System events (no member)