> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit Logs

> Look up who did what across your organization — every user, agent, and system action in one filterable, exportable timeline

Audit Logs record user, agent, and system actions across your organization in a single timeline at **Admin Settings → Audit Logs**. Entries cannot be edited or deleted from the app, so the timeline stands as a reliable record for security and compliance reviews.

## Availability

| Access           | Detail                                                                                                 |
| ---------------- | ------------------------------------------------------------------------------------------------------ |
| **Who can view** | Organization **Owner** and **Admin** roles                                                             |
| **Plans**        | Scale, Scale+, and Enterprise. On other plans the page shows an upgrade prompt instead of the timeline |
| **Location**     | **Admin Settings → Audit Logs**                                                                        |
| **Scope**        | All workspaces in the organization                                                                     |

## What is logged

Actions across the platform land in the timeline as they happen — connection changes, approval decisions, credential updates, billing events, user management, and activity from the Optimize, Review, Cyber, and Resolve modules. Each entry carries a category matching the surface it came from, so you can isolate one area quickly.

## Event fields

The timeline shows one row per event; clicking a row opens a detail view with the full record.

| Field       | Contents                                                                            |
| ----------- | ----------------------------------------------------------------------------------- |
| Timestamp   | When the action happened                                                            |
| Actor       | The user, agent, or system component that acted                                     |
| Category    | The surface the event came from — Connection, Approval, Security, Billing, and more |
| Event       | The specific action taken                                                           |
| Severity    | Low, Medium, High, or Critical                                                      |
| Summary     | One-line description of what happened                                               |
| Workspace   | The workspace the action ran in                                                     |
| Resource    | Type, name, and ID of the object acted on *(detail view)*                           |
| Incident ID | Link to the related Resolve incident, when one exists *(detail view)*               |
| IP address  | Where a user action originated *(detail view)*                                      |

## Field values

| Field      | Values                                                                                                                      |
| ---------- | --------------------------------------------------------------------------------------------------------------------------- |
| Actor type | **User** — a person in your organization · **Agent** — an AI agent acting in a workspace · **System** — the platform itself |
| Severity   | **Low** · **Medium** · **High** · **Critical**                                                                              |
| Outcome    | **Success** · **Failure** · **Pending**                                                                                     |

## Filters and search

Every filter narrows the timeline, the summary tiles, and any export you run.

| Filter     | Options                       |
| ---------- | ----------------------------- |
| Search     | Free-text match across events |
| Actor type | User, Agent, System           |
| Category   | Any event category            |
| Severity   | Low, Medium, High, Critical   |
| Date range | Start and end dates           |

Above the table, summary tiles show **Total Events**, **Success**, **Failures**, and **Agent Actions** for the current filter set — a quick read on whether anything needs attention before you scroll.

## Export

Click **Export CSV** to download the timeline as `audit-trail.csv`. The export respects your current filters, so narrow the timeline first to produce a scoped report for a security or compliance review.

## Retention

Audit events are retained for 90 days by default; older entries are deleted automatically. Export to CSV before the window closes if you need a longer-lived record.

## Related

<CardGroup cols={2}>
  <Card title="Security & Authentication" icon="shield-halved" href="/guide/security/overview">
    Access control, SSO, and the role model that decides who reaches this page
  </Card>

  <Card title="Organizations" icon="building-columns" href="/guide/organization">
    Manage organization settings, member roles, and workspaces
  </Card>
</CardGroup>