Skip to main content
Version: 0.18

Investigate audit history

Overview​

Audit provides visibility into important security-relevant actions and alert delivery outcomes. Use it to investigate who did what and when, and to prove compliance.

  • Event types: authentication, token create / update / delete, workspace membership changes, CLM certificate and executor events, auto-sync runs, alert delivery results (success/failure), weekly digest sends, WhatsApp tests, settings updates, integrations, and imports.
  • Retention: depends on your deployment policy and log storage configuration.
  • Export: audit logs can be exported as CSV or JSON for offline review, compliance reporting, or integration with external systems. Exports include all event metadata and can be filtered by date range and event type.

Workspace scope​

View events tied to the currently selected workspace. Managers and admins can filter by date and event type to focus on relevant activity.

  • Token changes, member invites/removals, settings updates.
  • Alert delivery outcomes for tokens in this workspace.

Organization scope​

Admins can aggregate events across all admin-owned workspaces to spot trends and investigate cross-workspace issues.

Investigate an incident​

  1. Choose the affected workspace and the narrowest useful date range.
  2. Filter by event type. For a missing invitation, compare MEMBER_INVITED_OR_UPDATED with INVITE_EMAIL_SENT; membership creation and SMTP handoff are separate results.
  3. For a failed notification, compare the asset's delivery history with ALERT_QUEUED, ALERT_SEND_FAILED, and retry events.
  4. Inspect metadata when the target is a CertOps UUID. Machine actions can have a null user actor; their agent or executor identity appears in metadata.

Export and retention​

Apply the incident filters before exporting CSV or JSON. Preserve the export's date range and workspace context with your investigation. Exports may include infrastructure and recipient details, so share only the fields needed for the incident.

Retention follows your deployment's storage policy. An empty result can mean the wrong scope or date range, or that older records were removed; it does not prove no action occurred. Confirm the retention policy with the system administrator.

AD CS issuer and enrollment actions, diagnostic-agent bootstrap, agent alert settings, and execution-log rejection include readable metadata in the feed and exports. Legacy dotted action names are recognized under their canonical uppercase names.

Event catalog​

Previous section links

Authentication​

Continue in Authentication.

Workspace & RBAC​

Continue in Workspace & RBAC.

Tokens​

Continue in Tokens.

Contacts & WhatsApp​

Continue in Contacts & WhatsApp.

Alert delivery​

Continue in Alert delivery.

System operations​

Continue in System operations.

User settings & integrations​

Continue in User settings & integrations.

Auto-Sync​

Continue in Auto-Sync.

CertOps​

Continue in CertOps.

Agents and the execution plane​

Continue in Agents and the execution plane.

Trust anchors​

Continue in Trust anchors.

Renewal automation​

Continue in Renewal automation.

Approval gates​

Continue in Approval gates.

Kill switch​

Continue in Kill switch.

Kubernetes controller​

Continue in Kubernetes controller.

Signing-key rotation​

Continue in Signing-key rotation.

Endpoint Monitoring​

Continue in Endpoint Monitoring.

Domain Checker​

Continue in Domain Checker.

Exact action names, metadata, machine actors, and CertOps identifiers are in the event reference.