> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oasm.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit log

> View and export workspace activity for compliance and incident investigation in OASM

The **Audit Log** (under **Settings → Audit**) records the activity that happens inside a workspace. Its subtitle summarizes the purpose: *"View and export workspace activity"*.

Every significant action — creating or revoking an API key, deleting a scan target, and other workspace operations — is captured as an event with the actor who performed it and the outcome. The audit log is the primary source of truth for compliance reporting and incident investigation.

## Key concepts

### Events

Each event describes a single action against a resource. Events are immutable: they are written when the action occurs and cannot be edited or deleted from the console.

### Actors

Events are attributed to an actor — a **user**, an **API key**, or an **agent** (such as a worker). This makes it possible to trace who or what changed the workspace.

## Browse the audit log

<Steps>
  <Step title="Open Settings → Audit">
    Navigate to the audit log of your workspace.
  </Step>

  <Step title="Apply filters">
    Narrow the events with the available filters (see below).
  </Step>

  <Step title="Inspect an event">
    Each row shows **When**, **Actor**, **Action**, **Resource**, and **Outcome**. Use the per-row **View event details** action to see the full event.
  </Step>
</Steps>

## Filters

<Table>
  | Filter     | Options                                               | Description                               |
  | ---------- | ----------------------------------------------------- | ----------------------------------------- |
  | Date range | All time, and other ranges                            | Restrict events to a time window          |
  | Action     | All actions                                           | Filter by the type of action performed    |
  | Outcome    | All outcomes: Success / Failure                       | Filter events by result                   |
  | Actor ID   | Text field (placeholder: "User, API key or agent ID") | Find events performed by a specific actor |
</Table>

Use the **Clear** button to reset all filters at once.

## Export the audit log

To export the current view, click **Export CSV**. The export includes the filtered events and can be imported into spreadsheets or SIEM tooling for further analysis and long-term retention.

## Example events

<Table>
  | Action              | Resource type | Typical outcome |
  | ------------------- | ------------- | --------------- |
  | Created API key     | API key       | Success         |
  | Revoked API key     | API key       | Success         |
  | Deleted scan target | Scan target   | Success         |
</Table>

<Accordion title="Which events are recorded?">
  The audit log captures workspace activity, including actions such as **Created API key**, **Revoked API key**, and **Deleted scan target**. Resources include scan targets, API keys, and other items the workspace manages. Events are also recorded when an action fails — failed attempts are valuable for incident investigation.
</Accordion>

## Best practices

* Review the audit log regularly as part of your security operations routine.
* Use the **Actor ID** filter to investigate a specific user, API key, or agent after an incident.
* Filter by **Outcome = Failure** to surface repeated failed attempts that may indicate misconfiguration or abuse.
* Export a CSV snapshot periodically for compliance and long-term retention.
* Combine the audit log with [API key](/api-keys) rotation and [member](/members) reviews to close access-related findings quickly.

## Related

<Card icon="key" title="API keys" horizontal href="/api-keys">
  Track creation and revocation of workspace API keys
</Card>

<Card icon="users" title="Members" horizontal href="/members">
  Understand the actors behind workspace activity
</Card>

<Card icon="layout-grid" title="Workspace" horizontal href="/workspace">
  See which tenant the audit events belong to
</Card>

<Card icon="cpu" title="Worker" horizontal href="/worker">
  Identify agent activity in the audit log
</Card>