Audit log

Overview

Govern → Records → Audit log (/compliance/audit-log) is the organisation’s record of what people, API keys and Shield360 itself did. It holds three kinds of record:

Kind	Tab	Recorded when
Change	Changes	Someone creates, changes or deletes something: a setting, a policy, a role, a key, a case
Access	Data access	Someone reads or exports sensitive data: a person’s or computer’s activity, a request’s prompt and response, guard events, sensitive-data findings, the audit log itself
Sign-in	Sign-ins	Someone signs in, fails to sign in, signs out, or is refused

The log is append-only. The database refuses to change or delete an audit record, and records are kept for as long as the organisation exists. They are removed only when the organisation itself is deleted.

Note

Data access answers the question reviewers ask most often: who looked at this person’s data, and when? A refused request is recorded too, with the outcome denied.

Who can see it

Permission	Allows	Held by
compliance.audit.view (Read the audit log)	Open the audit log	Owners, administrators, compliance officers, the Security role and Auditors
compliance.audit.export (Export the audit log)	Download it as CSV	Owners, administrators, compliance officers and Auditors

An Auditor sees only the records about the one environment they were invited to, and only until their access ends. Everyone else with the permission sees the whole organisation’s log.

Reading the audit log and exporting it are recorded in the audit log too, with the filters used.

Find a record

Choose a time range

Use the time filter at the top right of the page. Every count and list on the page covers that range.

Choose the kind of record

Select Everything, Changes, Data access or Sign-ins.

Search or narrow

Type in Search actions, paths, people to match the action name, the request path or the target. Select a name in the Who column to show only that person’s records (By …), or a target in the About column to show only records about it (About …). Select a chip to remove it.

Open a record

Select a row to see the request (method, path and HTTP status), the actor type, the record ID and the record’s details.

The tiles at the top count Records, Changes, Data access, Sign-ins, Failed sign-ins and Denied (refused for lack of access) in the range. Most active lists the ten people with the most records.

What a record shows

Column	Meaning
When	When it happened
Who	The person’s email; API key "<name>" for a request made with an API key; System for Shield360’s own jobs
What	The action, in plain words where Shield360 has a label for it, for example Changed a member’s role
About	What it acted on, such as a person, a computer, a role or a key
Outcome	success; denied when the request was refused (401 or 403); failed for any other error
From	The client’s IP address, as seen by Shield360’s trusted proxy

When a managed-service provider’s staff member acts under a grant, the record also says which provider they acted for.

The details never hold secrets. Fields named like a password, token, secret, API key, authorization header, cookie, credential or private key are dropped before the record is written. Text values are cut to 256 characters, and at most 20 fields are kept.

The list shows the latest 300 records. The export has every record that matches.

Export the audit log

Select Export (CSV) to download the records that match the current time range and filters as a CSV file named shield360-audit-log_<from>_<to>.csv, oldest first, up to 100,000 records per file. Its columns are Event ID, Time (UTC), Category, Action, Outcome, Actor type, Actor, Target type, Target, Method, Path, Status, IP address and Details (as JSON).

To keep the log in your own tools as it is written, stream it to a SIEM. See SIEM & security tools. Audit-log counts are also part of the evidence package.

What is recorded

Every change made through Shield360’s API is recorded. A change with no label of its own is named from its path and verb, for example api-key.create or fleet-hub.config.create. The main actions, grouped:

Area	Examples of actions
Sign-in	auth.sign-in (success or failed, with the reason, such as an unverified email or SSO being required), auth.sign-out, agent_oauth.authorize, agent_oauth.token
Members, roles and identity	members.remove, members.role_change, organisation.member.add, organisation.member.api_keys.revoke, organisation.project_role.update, auditor.invite, organisation.sso.update, organisation.sso.domain.verify, organisation.scim.token.create, scim.user.create
Keys and secrets	api-key.create, api-key.delete, vault.secrets.read (secrets read with an API key), vault.external.read
Policies and change control	Enforcement-policy saves and reverts (compliance.enforcement_policy.*), approving and rejecting policy changes, change-control.settings.update, change-control.freeze.start and .end, transports (transport.create, transport.approve, transport.release, transport.rollback)
Collection and data	collector.policy.update, collector.ai_endpoints.update, data_retention.update, data_classification.update, organisation.export.request, organisation.export.download, person-data.erase, person-data.export.request
Reading sensitive data	telemetry.span.read, visibility.person.read, visibility.computer.read, visibility.drilldown.read, compliance.data-protection.read, compliance.data-protection.event.read, compliance.data-protection.export, sensitive-data.findings.read, coding-agents.session.read, ai-accounts.identifier.reveal
Compliance records	compliance.audit-log.read, compliance.audit-log.export, risk.create, risk.update, findings.*, impact_assessments.*, intake.*, controls.soa.update, compliance.ediscovery.search, compliance.ediscovery.export
Agents	agent_authorization.profile.update, agent_authorization.grant.save, agent_authorization.kill, agent_authorization.elevation.approve, agent_authorization.mandate.create, data_gateway.authorization.create
Alerts, AI analyst and spend	alerting.rules.create, alerting.rules.update, analyst.settings.update, budgets.create, finance.export, pricing.catalog.refresh
Licensing and modules	organisation.modules.update, license.issue, license.revoke, managed.grant.create, managed.grant.revoke, managed.provider.access

Note

Actions taken in the public demo organisation are not written to its audit log, because every visitor shares it.

Related

Policy changes

Four-eyes approval of policy and detection-rule changes

Evidence package and auditor access

Give an external auditor read-only access to one environment

SIEM & security tools

Stream audit and sign-in events to your SIEM

API keys

Requests made with a key are recorded under the key’s name