Audit logs

Audit logs document a detailed record of actions taken in your workspace, letting you track who made a change, when it happened, and what was altered. This includes entity edits, integration configuration changes, API key activity, and updates to custom roles and their assigned permissions.

Use audit logs to investigate changes, identify discrepancies, and get a holistic view of activity across your workspace. You can access them through the Cortex UI or the public API.

Viewing audit logs in the Cortex UI

Users with the View Audit Logs permission can view audit logs via the Cortex UI.

1. From the main sidebar, click your avatar in the bottom-left corner.

2. Click Settings.

3. From the Settings menu, locate the Logging section, then click Audit logs.

   

The audit logs page displays a list of user activities. Each log entry includes the following columns:

• Actor - The user or API key that performed the action. N/A indicates the change is attributed to GitOps or the auto-import of entities.

• Action type - The action performed (created, deleted, or updated).

• Object type - The type of object that changed. See the full list of object types below.

• Object identifier - The unique identifier of the object.

• Date - When the action occurred.

Note: Audit log entries only capture successful, applied changes. If an action fails, is denied by authorization, or doesn't result in an actual change (before and after states match), no entry is created.

To view more information about a particular action, click its row:

A side panel opens with details about the action, including diff changes and the date and time of the action:

Filtering audit logs

On the audit logs page, you can narrow your search by using the filter and date range options.

To narrow the scope of your search, click Filter. You can filter by:

• API key identifier

• Action type

• Actor IP address

• Actor email

• Actor type

• Anonymous request type

• Entity

• Object type

To change the date range, click Last 7 days. You can filter by:

• Last 7 days

• Last 14 days

• Last 30 days

• Custom date range

How filters work

You can apply multiple filters at once, and select one or more criteria within each filter.

Within a single filter, multiple selections are combined with OR. Across different filters, selections are combined with AND.

Example

• Selecting CREATE for 'action type' and SCORECARD for 'object type' produces the query create AND scorecard.

• Selecting both CREATE and DELETE for 'action type' and SCORECARD for 'object type' produces (create OR delete) AND scorecard, which returns all Scorecards created or deleted within the selected timeframe.

Audit log reference

Object types

The following object types are included in audit logs:

Object type	Notes
ACCOUNT_FLAG
ALLOW_LIST_ENTRY
API_KEY
CATALOG
CATALOG_FILTER
CORTEX_USER
CUSTOM_ROLE	Covers changes to the role itself (name, description)
CUSTOM_ROLE_PERMISSIONS	Covers changes to the permissions granted by that role Re-saving a custom role with no effective permission change does not produce a CUSTOM_ROLE_PERMISSIONS entry
DOMAIN
ENTITY_TYPE_DEFINITION
INITIATIVE
OAUTH_CONFIGURATION
OPENAPI_DEFINITION
PERSONAL_API_KEY
RESOURCE
SCORECARD
SECRET
SECRET_GROUP
SERVICE
TEAM
WORKFLOW
Integrations	Configuration, e.g. OKTA_CONFIGURATION OAuth configuration, e.g. BITBUCKET_OAUTH_CONFIGURATION OAuth registration, e.g. JIRA_OAUTH_REGISTRATION On-prem configuration, e.g. JIRA_ONPREM_CONFIGURATION On-prem webhook secret, e.g. BITBUCKET_ONPREM_WEBHOOK_SECRET Personal configuration, e.g. BITBUCKET_PERSONAL_CONFIGURATION SAST configuration, e.g. MEND_SAST_CONFIGURATION Unique GitHub types: GITHUB_APP_CONFIGURATION GITHUB_APP_INSTALLATION GITHUB_PERSONAL_TOKEN GITHUB_WEBHOOK_SECRET

Actors

The following actor identifiers are included in audit logs:

Identifier	Notes
Actor Types	ANONYMOUS API_KEY BACKSTAGE OAUTH2 PERSONAL_API_KEY
API Key Identifiers	When filtering by this field, enter API key names or the last 4 characters of an API key.
Emails	When filtering by this field, the email address must be an exact match to the user's email.
IP Addresses
Anonymous Request Types	API_KEY_ENTITY BRAIN_AI CUSTOM_INTEGRATION SCORECARD_BADGES SLACK_COMMAND Integration webhooks, e.g. ATLASSION_WEBHOOK