Audit log

The Audit Log (under Settings → Audit) records the activity that happens inside a workspace. Its subtitle summarizes the purpose: “View and export workspace activity”. Every significant action — creating or revoking an API key, deleting a scan target, and other workspace operations — is captured as an event with the actor who performed it and the outcome. The audit log is the primary source of truth for compliance reporting and incident investigation.

​

Key concepts

​

Events

Each event describes a single action against a resource. Events are immutable: they are written when the action occurs and cannot be edited or deleted from the console.

​

Actors

Events are attributed to an actor — a user, an API key, or an agent (such as a worker). This makes it possible to trace who or what changed the workspace.

​

Browse the audit log

​

Filters

Use the Clear button to reset all filters at once.

​

Export the audit log

To export the current view, click Export CSV. The export includes the filtered events and can be imported into spreadsheets or SIEM tooling for further analysis and long-term retention.

​

Example events

Which events are recorded?

The audit log captures workspace activity, including actions such as Created API key, Revoked API key, and Deleted scan target. Resources include scan targets, API keys, and other items the workspace manages. Events are also recorded when an action fails — failed attempts are valuable for incident investigation.

​

Best practices

• Review the audit log regularly as part of your security operations routine.
• Use the Actor ID filter to investigate a specific user, API key, or agent after an incident.
• Filter by Outcome = Failure to surface repeated failed attempts that may indicate misconfiguration or abuse.
• Export a CSV snapshot periodically for compliance and long-term retention.
• Combine the audit log with API key rotation and member reviews to close access-related findings quickly.

​

Related