Documentation
Audit log
Search, filter, follow live and export the record of every privileged and administrative action in your organisation.
Overview
The audit log is the record of privileged and administrative actions across DeviceQuest: sign-ins, role and user changes, API key events, scans, asset changes, exceptions, compliance decisions and more. Records are immutable, and every time on the page is in UTC. Use it to answer “who did what, and when”, to follow activity as it happens, and to export evidence for an auditor.
You need audit:read or admin:manage to open Admin → Audit log. People without either permission see an Access restricted page. Searching archived records needs admin:manage; see Include archived logs.
Screen tour
- Date range: limit the log to the Last hour, Last 24h, Last 7d, Last 30d or Last 90d, or show All time.
- Domain: the area of the product each event belongs to, such as
auth,assetorscan_schedule, with the number of matching events. Click a domain to filter by it. - Include archived logs: also search events that have been moved to the encrypted archive. Shown to administrators only.
- Activity summary: the number of events, the number of domains they span and how many sign-in failures were recorded. Click a highlighted part of the sentence to filter by it.
- Events by domain / day: one bar per day, stacked by domain. Hover a bar for that day’s totals, or click it to filter the log to that day.
- Search events…: free-text search across the action, the actor and the event details.
- Live tail: adds new events to the top of the table as they are recorded.
- Save filter: saves the current search and filters under a name, so you can apply them again with one click.
- Export CSV: downloads the events that match the current filters as a CSV file.
- Event row: click any row to open the event’s details.
Find events
Every filter you set is added to the page address, so you can bookmark a filtered view or send the link to a colleague.
- Open Admin → Audit log. The newest events are at the top.
- Narrow the list with any combination of:
- Search events…: type a word from the action, an actor ID or a value in the event details, for example
api_keyor an IP address. Press / to jump to the search box, and click the × in the box to clear it. - Date range: click a preset. You can also click a day in Events by domain / day to see only that day.
- Domain, Action, Resource type and Actor in the Filters sidebar: click a value to add it, and click it again to remove it. You can select several values in each section; events that match any of them are shown.
- Search events…: type a word from the action, an actor ID or a value in the event details, for example
- Check the Active filters bar under the toolbar. It lists each filter as a chip. Click the × on a chip to remove that filter, or click Clear all to start again. In the sidebar, Reset all does the same.
The sidebar shows the most frequent values first: up to 8 domains, 20 actions and 15 actors. Click Show all N to see the rest, and Show less to collapse the list again. Click a section title to collapse or expand that section. When filters are active, the Filters title shows how many.
The table shows 50 events at a time. The footer shows how many are loaded, for example 50 of 3,601 events. Click Load more to fetch the next 50.
When there is nothing to show, the page says No audit events yet, or, when your filters match nothing, No events match these filters with a Clear all filters button.
Domains
The domain is the first part of an event’s action name. For example, api_key.created and api_key.revoked both belong to the api_key domain. Each domain has its own colour in the chart and on the action chips. Common domains are:
| Domain | Records |
|---|---|
auth | Sign-ins, sign-in failures and sign-outs |
user, invitation, session | User accounts, invitations and sessions |
role | Roles and their permissions |
mfa, sso | Multi-factor authentication and single sign-on |
api_key | API keys being created, rotated and revoked |
asset | Assets being created, changed and deleted |
scan_target, scan_schedule, scan_job, scan_profile | Scanning targets, schedules, profiles and runs |
exception, remediation | Risk exceptions and remediation tasks |
compliance, compliance_control | Compliance reports, scopes and control decisions |
vuln, vulnerability, feed | Vulnerability findings and CVE feeds |
agent_credential, connector, webhook | Host agent enrollment, cloud connectors and webhooks |
curation, custom_field, cleanup_rule, license | Software curation, custom fields, cleanup rules and licenses |
flow, dashboard, helpdesk, report | Flows, dashboards, helpdesk tickets and reports |
audit | Changes to audit retention and archive runs |
The Domain section of the sidebar lists the domains of the events that match your current filters, with their counts.
Include archived logs
Events older than the online retention window are moved to an encrypted archive by the audit retention service. See Audit retention.
- Switch on Include archived logs at the top right. While the archive is searched, the switch shows Searching archived files.
- Filter and search as usual. Archived events appear in the table together with online events.
Archived search reads the most recent matching archive batches. If the page shows Archived search is limited to the most recent matching archive batches. Narrow the date range to search older archives., pick a narrower date range to reach older archives.
Since your last visit
When more events have been recorded since you last opened the unfiltered log, a line such as 12 new events since you last visited. appears above the toolbar. Click × to dismiss it.
Follow events live
- Click Live tail, or press l. The button changes to Live tailing and its dot turns green.
- The page checks for new events every 10 seconds and adds them to the top of the table. Your search and filters still apply.
- Click Live tailing again, or press l, to stop.
Click Refresh, or press r, to reload the whole page with the latest events and counts.
Save a filter
Saved filters store a search and filter combination under a name. They appear as chips next to the search box.
- Set the search, date range and filters you want to keep.
- Click Save filter.
- Enter a Name, for example
Admin writes this week. Names can be up to 60 characters. - Choose who the filter is for:
- Just me: the filter is saved for you, in this browser.
- Team default: the filter is stored for your whole organisation and every member of your team sees it. Saving a team default needs admin:manage.
- Click Save filter.
To apply a saved filter, click its chip. It replaces the current search and filters, and the chip is highlighted while it is active. To delete it, click the × on the chip.
You can keep up to 10 personal saved filters. When you save an eleventh, the oldest one is removed.
Export events to CSV
The export contains every event that matches your current search and filters, up to 100,000 rows.
- Columns, Advanced and Preview: the three tabs of the dialog.
- Column checkboxes: tick the columns to include. Each column shows its label and the column name used in the file.
- Reset to defaults: selects all nine columns again.
- Download CSV: builds and downloads the file.
- Filter the log to the events you need.
- Click Export CSV, or press e.
- On the Columns tab, choose the columns. At least one column stays selected. DeviceQuest remembers your choice for the next export.
- Open Advanced to check which filters will be applied to the export.
- Open Preview to see the selected columns in the order they appear in the file.
- Click Download CSV. The button shows Exporting… while the file is built, and the dialog closes when the download starts.
The file is UTF-8 encoded and named with the export date and time, for example audit-log-20261013-093000.csv. Values that a spreadsheet could treat as a formula are escaped, so the file is safe to open in Excel or Google Sheets.
If your session has expired, the dialog shows Session expired — please reload or sign in again. Sign in again and repeat the export.
Export columns
| Column | Name in file | Contents |
|---|---|---|
| Event ID | id | The event’s unique number. |
| Timestamp | created_at | When the event was recorded, in UTC. |
| Actor ID | actor_id | The ID of the user who performed the action. Empty for system events. |
| Action | action | The action name, for example role.created. |
| Resource Type | resource_type | The kind of object acted on, for example user or api_key. |
| Resource ID | resource_id | The ID of the object acted on. |
| IP Address | ip_address | The IP address the request came from. |
| User Agent | user_agent | The browser or client that made the request. |
| Details JSON | details | The event’s full payload, as JSON. |
View an event
Click a row to open the event in a side panel. The panel keeps your place in the list; press Esc or click × to close it. Click Full page to open the event on its own page at /admin/audit-log/<event ID>, which you can bookmark or share.
- Back to Audit Log: returns to the list. Shown on the full page.
- Action chip: the action name, coloured by domain, with how long ago it happened.
- ID: the event ID. Click it to copy the ID.
- Overview, Payload and Related: the three tabs of the event.
- Quick links: shortcuts to the actor and to the object the event is about.
The top of the event also shows the actor’s name and email address.
Overview tab
| Field | Shows |
|---|---|
| Timestamp | How long ago the event happened, followed by the exact date and time in UTC. |
| Action | The action chip, followed by the domain in brackets. |
| Actor | The name and email address of the user who performed the action, or system for automatic actions. |
| Resource | The resource type and the object’s name. A deleted object shows [deleted] and a deleted badge. |
| IP Address | The IP address the request came from. |
| User Agent | The browser or client that made the request. Hover to see the full value. |
| Quick links | View actor, plus a link to the object when it has a page of its own: Open asset, Open API key, Open user, Open flow, Open SSO config, Open exception or Open remediation. |
Payload tab
The payload holds the details recorded with the event, such as the changed fields, the role name or the sign-in method.
- Search payload…: finds keys and values inside the payload.
- Copy JSON: copies the whole payload to the clipboard. The button shows ✓ Copied when it is done.
- Before: the values before the change.
- After: the values after the change.
Events that record a change show the Before and After values side by side. Other events show the payload as a JSON tree. Click the arrow next to an object or a list to collapse or expand it; collapsed entries show how many fields or items they hold. When an event has no payload, the tab shows No payload recorded for this event.
Related tab
The Related tab puts the event in context:
- Cross-surface links: View actor in Users and a link to the object the event is about.
- Other events on this resource: up to 20 other events on the same object, for example every change to one role.
- Same actor ±60 minutes: other events by the same person within an hour before or after this one.
Click a related event to open it.
Fields
| Field | Description | Rules |
|---|---|---|
| Search events… | Free-text search across the action, actor ID and event details. | Not case-sensitive. Matches part of a word. |
| Date range | Preset time window. | One preset at a time. All time removes the date filter. |
| Domain, Action, Resource type, Actor | Facet filters. | Several values per section; events matching any value are shown. Sections combine with each other. |
| Include archived logs | Adds archived events to the results. | Needs admin:manage. |
| Name (Save filter) | The saved filter’s label. | Required. Up to 60 characters. |
| Just me / Team default (Save filter) | Who sees the saved filter. | Team default needs admin:manage. |
| Columns (Export CSV) | Columns written to the file. | At least one. Remembered for your next export. |
Keyboard shortcuts
Press ? on the audit log to see this list in the app. Shortcuts don’t fire while you are typing in a text box, except Esc.
| Key | Action |
|---|---|
| / | Focus the search box. |
| r | Refresh the log. |
| l | Turn live tail on or off. |
| e | Open Export CSV. |
| g then k | Go to API keys. |
| g then u | Go to Users. |
| g then r | Go to Roles and permissions. |
| Esc | Close the open panel or dialog. |
| ? | Show the keyboard shortcuts. |