Administration — Audit Logs

Searchable, exportable enterprise audit trail for authentication, deployments, drift, governance, RBAC, and administration.

i Open Administration → Audit Logs • Personal recent sign-ins are available under My Profile → Activity & insights

Permissions

Action	Permission
View audit logs, dashboard, analytics, export	audit:read
Edit retention & archive policy	org:update

Page actions

• Refresh — reload dashboard, analytics, and the filtered event list
• Export — dialog to download CSV or JSON for a chosen date range
• Retention & archive — hot retention days, optional cold archive, manual retention run, browse archived events
• Saved filters — shown but disabled (coming soon)

Dashboard KPIs

Six clickable cards filter the event log and scroll to the table:

▣

Total eventsAll time (clears KPI filters)

□

Events todayCustom date range: today only

!

Failed operationsStatus = FAILURE

◇

Security eventsSecurity KPI preset

♙

AuthenticationAuthentication KPI preset

⚙

Configuration changesConfiguration KPI preset

Click a KPI card to apply its filter. Click it again to toggle off the filter (except Total events).

Analytics (Last 30 days)

Analytics summarize audit activity over the selected period.

Audit event volume

Daily timeline: Total events and Failed events.

Event status

Distribution of Success vs Failure (not separate Warning/Info status buckets).

Top categories

Most active audit categories (Authentication, Authorization, Stacks, Deployments, Policies, RBAC, etc.).

Top actions

Most frequent actions (Create, Update, Delete, Login, …).

Audit event log

Default filters shown: Search, Category, Date range (Last 30 days).

More filters toggles optional filters: Action, Status, Severity, Resource type, Resource name, Source module, Repository.

Filter visibility is persisted in browser storage. Use Clear all when filters are active.

Filter	Values
Search	Events, users, resources, correlation IDs
Category	Dynamic list from available categories (Authentication, Stacks, Deployments, RBAC, …)
Date range	7 / 30 / 60 / 90 / 180 / 365 days, current month, previous month, custom from/to
Action	CREATE, UPDATE, DELETE, LOGIN, LOGOUT, ACCESS, INVITE, REVOKE, SECURITY_VIOLATION
Status	SUCCESS, FAILURE
Severity	CRITICAL, HIGH, MEDIUM, LOW, INFO
Resource type / name	Free text
Source module	Free text (audit source field)
Repository	Free text (Git-related events)

Table columns

Sortable, configurable via column settings (persisted in browser storage). Defaults:

• Timestamp, User, Resource Type, Resource Name, Action, Category, Status, Severity, Source Module, IP Address

Optional columns: Organization, Correlation ID.

Click a row to open Audit Event Details with:

• General — event ID, timestamp, user, resource, action, status, severity, source; repository/branch/commit when present
• Technical — API endpoint, HTTP method, client IP, correlation ID, user agent
• Changes — JSON diff when recorded

Server-side pagination with adjustable page size. Default sort: newest events first.

Retention & archive

From Retention & archive:

• Configure hot retention (30–3650 days; presets 30 / 60 / 90 / 180 / 365 or custom)
• Enable cold archive and optional archive retention limit
• Run retention manually (archives and/or deletes from hot storage per policy)
• Browse archived audit records with search and pagination

Editing retention requires org:update (typically organization Owner).