Audit Logs

Find out who changed what across your organization, filter events by actor, category, severity and date, and export them as CSV.

Audit Logs is one timeline of every user, agent and system action across all workspaces in your organization. Use it to answer “who did this, when, and from where” during a security review, an incident postmortem or a change investigation.

What is and isn’t recorded

• Recorded: changes people and agents make, such as connection updates, approval decisions, member changes, commands run through CloudThinker and their results, and security settings changes (MFA turned on or off, SSO connections and verified domains).
• Not recorded: sign-ins and sign-outs. Viewing pages and data generally isn’t recorded either.

Prerequisites

• An organization Owner or Admin role. Developers and Viewers don’t see the page. See Roles.
• A Scale, Scale Plus or Enterprise plan. On other plans the page shows an Unlock Audit Logs with the Scale plan prompt and an Upgrade Plan button instead of the timeline. See Subscription.

On self-hosted deployments without billing enabled, there’s no plan check: Owners and Admins always see the timeline. See Deployment.

Key terms

Term	Meaning
Event	One recorded action, such as a connection update or an approval decision. Shown as one row.
Actor	Who performed the action. User is a person in your organization, Agent is an AI agent acting in a workspace, System is the CloudThinker platform itself.
Category	The area of the product the event came from, such as Connection, Approval or Billing.
Severity	How significant the action is: Low, Medium, High or Critical. CloudThinker sets it when it records the event, and you can’t change it. For example, turning MFA on is Medium, turning it off is High, and a break-glass override of a denied Rule is Critical. Most routine actions are Low.
Outcome	Whether the action finished: Success, Failure or Pending. In the app it feeds the Success and Failures tiles. Per event, it’s in the CSV outcome column.

The timeline is read-only. Audit Logs has no edit or delete action, in the app or its API, for anyone including Owners. Events are removed only by the retention cleanup described under Retention.

Open the timeline

1. Go to Audit Logs

   Click your avatar to open the user menu, then Admin settings → Audit Logs.

   Success state: four summary tiles (Total Events, Success, Failures, Agent Actions) appear above a table of events, newest first.

2. Read the summary tiles

   The tiles count the events that match your current filters. Failures shows Needs attention when the count is above zero and All clear when it’s zero. Agent Actions counts events performed by agents.

The table shows 10 events per page. Use the page controls under the table to reach older events.

Each row shows these columns:

Column	Contents
Timestamp	Relative time, such as “5 minutes ago”. Hover it for the exact date and time (MM/dd/yyyy, HH:mm, 24-hour, in your browser’s time zone).
Actor	The user or agent name. Agent actions carry a bot badge with the agent’s name.
Category	The product area, such as Connection, Review or Optimize.
Event	The action taken, such as Connection Updated (raw action connection.updated). Raw actions follow a category.action pattern, such as security.mfa_disabled.
Severity	Low, Medium, High or Critical.
Summary	A one-line description of what happened.
Workspace	The workspace the action ran in, or - for organization-level events.

Find a specific event

Every filter narrows the table, the summary tiles and the CSV export at the same time. There’s no workspace or outcome filter. To review one workspace, read the Workspace column. To list failed events, export to CSV and filter the outcome column. Filters combine, so Actor Type: Agent plus Severity: High shows only high-severity agent actions.

1. Search

   Type into Search. It matches text in the event summary, the resource name and the actor name. Search runs as you type.

2. Filter by actor, category or severity

   Pick values in Actor Type, Category and Severity. Each filter accepts several values at once.

3. Set a date range

   Pick a preset (Last 7 days, Last 30 days or Last 90 days), or choose a start and end date. The end date includes the whole day, up to 23:59:59.

   Success state: the summary tiles and the table update to show only matching events.

Available categories: Agent, Agent Policy, Alert, Approval, Artifact, Assessment, Billing, Chat, Command, Connection, Cyber, Incident, Keepers, Knowledge, Notification, Optimize, Plan, Recommendation, Resource, Review, Security, Skill, Task, Topology, User Mgmt, Webhook and Workspace.

Common lookups

Question	Filters
What did agents change this week?	Actor Type: Agent, date range: Last 7 days
Who changed a connection?	Category: Connection, then search the connection name
Who approved or rejected an agent action?	Category: Approval
What failed recently?	Date range: Last 7 days, then check the Failures tile. To list the failed events, export to CSV and filter outcome to FAILURE.
What were the most significant actions?	Severity: High and Critical. Severity says how significant an action is, not whether it failed.
Who added or removed a member?	Category: User Mgmt

Inspect an event

Click any row to open its detail panel. It shows:

Field	Contents
Actor, Severity, Timestamp, Workspace, Summary	Same as the row, with the full date and time.
Resource Type, Resource Name, Resource ID	The object the action touched.
Incident ID	The related Resolve incident, when there is one.
IP Address	Where a user action came from.
Resource Changes	A Field / Before / After table listing only the fields that changed.
Metadata	Extra context for the event, as JSON. The keys depend on the event. A Command event, for example, includes conversation_id, exit_code and duration_ms.

Fields with no value are hidden, so a system event usually shows no IP address.

Export to CSV

1. Filter first

   Narrow the timeline to what the reviewer needs, for example Category: Connection over the Last 30 days. The export uses exactly the filters on screen. The CSV has no workspace column, so note the workspace from the table if the reviewer needs it.

2. Click Export CSV

   Click Export CSV next to the filters. The button reads Exporting… while the file builds.

   Success state: your browser downloads audit-trail.csv and an Audit trail exported successfully message appears. Every export has the same file name, so rename each file with its date range right after download.

The file has one row per event with these columns: timestamp, actor_type, actor_name, agent_name, action_category, action, severity, resource_type, resource_id, resource_name, summary, ip_address, changes, outcome, metadata. The changes and metadata columns hold JSON. timestamp is ISO 8601 with a time zone offset.

One export holds at most the 10,000 most recent matching events. For a longer period, export in smaller date ranges so nothing is cut off.

Retention

Events are kept for 90 days, then deleted automatically. The period is the same on every plan. Audit Logs has no built-in stream to a SIEM, so for a longer record, export to CSV on a regular schedule (monthly works well) and store the files in your own system.

On self-hosted deployments the retention period is the Audit Trail Retention Days setting, which defaults to 90. An installation administrator changes it from the user menu under Instance configuration. See Deployment.

Troubleshooting

I don't see Audit Logs in Admin Settings

Cause: your organization role is Developer or Viewer. Fix: ask an organization Owner to make you an Admin. See Roles.

The page shows an upgrade prompt instead of events

Cause: your organization is on a plan without Audit Logs. Fix: click Upgrade Plan and move to Scale, Scale Plus or Enterprise. See Subscription.

An event I expect is missing

Check: clear all filters and the date range, then search again. Search only matches the summary, resource name and actor name, not the event name or workspace. Check: the event may be older than 90 days and already deleted.

My CSV has fewer rows than the Total Events tile

Cause: an export stops at the 10,000 most recent matching events. Fix: split the export into shorter date ranges.

Failed to export audit trail

Fix: check your network connection and click Export CSV again. If it keeps failing, narrow the date range to make the file smaller.

Next steps

Roles

Control who is an Owner or Admin and can read the audit timeline.

Single sign-on

Sign users in through your identity provider.

Approvals

Decide which agent actions need a human yes before they run.

Security overview

See how CloudThinker protects access, data and agent actions.