Audit trail
Who changed what, recorded as it happens.
What is recorded #
Every change to a protected resource is recorded with the actor, the permission that allowed it, the resource and the outcome. Reads are not recorded.
- Actor — the member or automation responsible.
- Permission — what it was allowed to do.
- Resource — what it changed.
- Outcome — whether the change was made.
- Time — when.
What is covered #
- Organisation settings and member management.
- Role and permission changes.
- API key and application key changes.
- Monitor, dashboard and log configuration changes.
- Retention and archive configuration.
Filtering #
Narrow the trail by actor, by permission and by time to answer a specific question.
Retained separately #
Audit records are stored apart from the operational data and have their own retention, so they remain available even when an organisation's data is removed.
The audit trail is append-only
Entries are written as changes happen and are not edited afterwards. That is what makes it usable as evidence.
Start an investigation from the audit trail. Finding who changed a setting at a particular time is often faster than reconstructing it from memory.
Onward #
The changes recorded here come from the places that make them: Identity and roles for access, Scoped API keys for credentials, Detection rules and Suppressions for what is being watched, and Client address attribution for network settings.