The audit log keeps a record of what happens in your organization: scans that were started, labels that were created, members that were invited, new findings that were detected on a target, and more. Use it to follow up on changes, answer the question "who changed this?", and keep a history for compliance. You can open the full audit log from the menu, and you also see a short version of it on your dashboard. ## Open the audit log 1. In the left-hand menu, under **Organization Management**, click **Audit log**. The log shows the most recent events first. Each entry shows: * An icon for the type of event. * **Who** did it. Events done by a person show their name. Events that happen automatically, such as a newly detected finding, have no name. These are called *system events*. * **What** happened, and on which target or port when that applies. * **When** it happened, for example *25m ago*. By default, the log shows the last month. ![](https://support.catcher24.com/rails/active_storage/blobs/redirect/eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBjUT09IiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--75fd659e05e893769c62457d585436785fe408f2/audit-log-overview.jpg) > You need the **View Audit Logs** permission to see the audit log. See [User roles and permissions](https://help.catcher24.com/hc/help-centre/articles/1790940694-user-roles-and-permissions). ## Similar events are grouped When the same kind of event happens many times in a row, the log groups them to keep the page readable. For example, a scan can connect several assets to a target in one go. * Click **Expand 9 similar items** to see all the items in the group. * Use the page buttons at the bottom of the group to move through longer lists. * Click the **minus** button at the top right of the group to collapse it again. ## Filter the audit log Use the filters at the top of the page to find specific events. The log updates as soon as you change a filter. ### Event type 1. Click **Event type**. 2. Type in the search box to find an event type, for example `scan`. 3. Tick one or more event types. The selected types appear in the filter field. Click the **x** next to a type to remove it, or the **x** at the end of the field to clear them all. ![](https://support.catcher24.com/rails/active_storage/blobs/redirect/eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBjdz09IiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--fee7fa84396c7d5b4b0f550415d307c837bf483e/audit-log-event-type-filter.jpg) ### Target Click **Target** and select one or more targets to only see events for those targets. ### Member Click **Member** and select one or more members to see what they did. Switch on **System events (no member)** at the bottom of the list to show events that happened automatically, without a person. ![](https://support.catcher24.com/rails/active_storage/blobs/redirect/eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBkQT09IiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--56765ee336e9b4c9009348c71fd4d1af6d08d63c/audit-log-member-filter.jpg) ### Date range 1. Click the date field. 2. Pick a start and end date in the calendar, or click a shortcut below the calendar: **Current month**, **Last month**, **Current quarter**, **Last quarter** or **This year**. 3. Click the **x** in the date field to clear the range. ![](https://support.catcher24.com/rails/active_storage/blobs/redirect/eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBkUT09IiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--47d90276880abb6ff21b54333fe26ebaf958f4c4/audit-log-date-range.jpg) ## Export the audit log Click the **Export CSV** button to download the audit log as a CSV file. Click the arrow next to the button to choose a format: * **Export as CSV** * **Export as JSON** ![](https://support.catcher24.com/rails/active_storage/blobs/redirect/eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBkZz09IiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--55ebf15653c5c8d6b9efcbfb72b06e36546d3e98/audit-log-export.jpg) ## Activity widget on the dashboard At the bottom right of your dashboard, the **Activity** widget shows the latest events in a compact list. It works the same way as the audit log: similar items are grouped and can be expanded, and you can scroll through the list. Use the widget for a quick look at what has just happened. Open the **Audit log** from the menu when you need to filter, search a longer period or export. ![](https://support.catcher24.com/rails/active_storage/blobs/redirect/eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBkdz09IiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--e1534391dbc5f7bc5f9ae867af9eb5235769a5b1/dashboard-activity-widget.jpg) ## Event types You can filter on these event types. | Area | Event types | | ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Targets and findings** | Asset connected to target, Asset unbound from target, Certificate connected to target, Certificate unbound from target, Detection connected to target, Detection unbound from target, Dns record connected to target | | **Scans** | Started scan for target, Started scan for label, Cancelled scan | | **Labels** | Created label, Assign label to target | | **Members, groups and access** | Created organization invitation, Deleted organization member, Created organization group, Assign organization group to label, Assign organization group to role, Assign target label to user, Removed target label from user | | **Subscription** | Prepare subscription update, Restart organization subscription | ## Tips * To check who started a scan, filter on the event types **Started scan for target** and **Started scan for label**. * To review access changes, filter on **Assign target label to user**, **Removed target label from user** and **Assign organization group to role**. * To see only automatic events, filter on **Member** and switch on **System events (no member)**