> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/system-management/audit-logs.md).

# Audit logs

When your organization follows a security and compliance program, you need to control and monitor the access of information inside the company. DoControl's audit log provides you with a centralized stream of all user activity within a team.

The audit log is a detailed, chronological record of who did what, when they did it, and from where, creating a complete and visible trail of administrative actions across your platform. An audit trail can be used to prevent suspicious activity when it starts, or play back account activity during an incident review.

Examples of team member actions recorded in audit logs include:

* Login and password reset
* Alert modifications and resolution
* Changes in identity watchlists
* Creation and deletion of workflows
* On-demand inventory actions, such as Change owner, Add or Remove collaborators

{% hint style="success" %}
Audit logs are displayed for all actions initiated in the last 12 months. Note that audit log data is available from the date of the feature release (23 July 2025) onward.
{% endhint %}

## Benefits of audit log tracking

When all DoControl operations are visible and searchable, your organization fortifies several fronts:

* **Hardened security posture** - View a detailed audit trail of all activity that happens within the account, and rapidly detect unauthorized access or suspicious behavior patterns. Audit logs can be embedded in existing SIEM solutions overseeing all security audit logs from all systems.
* **Strengthened regulatory compliance** - For compliance requirements like HIPAA or GDPR, get the detailed audit trail auditors need to verify proper data handling and access controls.
* **Security investigations** - Trust that your data interactions are monitored with detailed accountability for all activities within DoControl. Any questions about system activity can be quickly answered with concrete evidence rather than guesswork.
* **Operational troubleshooting** -  Quickly identify what was changed when facing an issue or reviewing an incident, reducing resolution time significantly.

## View audit logs

You can inspect audit logs for every action initiated by DoControl team members and the system, and easily search them for enhanced security, compliance, and operational visibility.

To view and investigate audit logs:

* Go to **Advanced > Audit log,** OR 
* Go to the [DoControl API](/docontrol-user-guide/system-management/api.md).

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FD5SJGmZ5Rvd7y4NgBI4m%2FAudit%20log.png?alt=media&amp;token=6e40960e-0381-45a3-814b-7fd362696770" alt=""><figcaption></figcaption></figure>

For each audit log entry, DoControl displays the following enriched data:

<table><thead><tr><th width="181.5390625">Audit log parameter</th><th>Description</th></tr></thead><tbody><tr><td>Timestamp</td><td>Date and time when the action occurred</td></tr><tr><td>Actor</td><td>Who initiated the action: DoControl team member or the DoControl system</td></tr><tr><td>Action</td><td>Type of activity initiated. See <a href="#action-types">action types</a>.</td></tr><tr><td>Target</td><td>Entity affected by the action</td></tr><tr><td>Product area</td><td><p>Module or functional area in DoControl where action was initiated:</p><ul><li>Access</li><li>Alerts</li><li>Events</li><li>Identities</li><li>Inventory</li><li>Posture</li><li>Settings</li><li>Shadow apps</li><li>Workflows</li></ul></td></tr><tr><td>IP</td><td>The IP source address where the action occurred</td></tr><tr><td>Device</td><td>Laptop of phone device where the action occurred</td></tr><tr><td>Browser</td><td>Web browser version where the action occurred</td></tr><tr><td>Location</td><td>City and country where the action occurred</td></tr></tbody></table>

## Filter audit logs

To quickly find the actions you're looking for, search audit logs with any of these filters:

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FVNFxTQC8hBT6Pr1LM9yN%2Faudit%20log%20filters.png?alt=media&amp;token=6bb4d508-68f5-47fc-8637-a051e98e47df" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
Audit logs are displayed for all actions initiated in the last 12 months. Note that audit log data is available from the date of the feature release (23 July 2025) onward.
{% endhint %}

<table><thead><tr><th width="166.59375">Audit log filter</th><th>Description</th></tr></thead><tbody><tr><td>Actor</td><td>Who initiated the action: a DoControl team member or the DoControl system</td></tr><tr><td>Action</td><td><ul><li>Type of activity initiated. See <a href="#action-types">action types</a>.</li><li>Start typing the action and select it from the dropdown list.</li></ul></td></tr><tr><td>Product area</td><td><p>Module or functional area in DoControl where the action was initiated:</p><ul><li>Access</li><li>Alerts</li><li>Events</li><li>Identities</li><li>Inventory</li><li>Posture</li><li>Settings</li><li>Shadow apps</li><li>Workflows</li></ul></td></tr><tr><td>Time range</td><td><p>When the action occurred:</p><ul><li>Last 24 hours</li><li>Last 7 days</li><li>Last 14 days</li><li>Last 30 days</li><li>Custom range within the last year</li></ul></td></tr><tr><td>Browser</td><td>Web browser where the action occurred</td></tr><tr><td>City</td><td>Name of city where the action occurred</td></tr><tr><td>Country</td><td>Name of country where the action occurred</td></tr><tr><td>Country code</td><td>A 2-letter identifier assigned to each country or dependent area by the ISO 3166-1 system. For example, US (United States) or JP (Japan).</td></tr><tr><td>Device</td><td>Laptop of phone device where the action occurred</td></tr><tr><td>IP</td><td>The IP address where the action occurred</td></tr><tr><td>Target</td><td>Entity affected by the action</td></tr></tbody></table>

## Action types

You can search for action types across a range of product areas when monitoring team member operations over the last year.

Simply start typing the action in the filter, and select it from the dropdown list.&#x20;

Examples of team member actions recorded in audit logs include:

* Login and password reset
* Alert modifications and resolution
* Changes in identity watchlists
* Creation and deletion of workflows
* On-demand inventory actions, such as Change owner, Add or Remove collaborators

{% hint style="info" %}
This list is not exhaustive. It shows examples of action types that are displayed in audit logs.
{% endhint %}

<table><thead><tr><th width="289.7109375">Product area</th><th>Examples of action types</th></tr></thead><tbody><tr><td>Access</td><td><ul><li>Login</li><li>Password reset</li></ul></td></tr><tr><td>Alerts</td><td><ul><li>Alert status changed</li><li>Alert archived/unarchived</li><li>Alert assigned/unassigned</li><li>Alert note added/deleted/edited</li><li>Jira ticket opened</li></ul></td></tr><tr><td>Events</td><td><ul><li>CSV report exported</li></ul></td></tr><tr><td>Identities</td><td><ul><li>Watchlist updated</li></ul></td></tr><tr><td>Inventory</td><td><ul><li>View added/ deleted/ edited</li><li>Custom group added/ deleted/ edited</li><li>Trusted domain added/ removed</li><li>Trusted IP range added/ updated/ removed</li></ul></td></tr><tr><td>Posture</td><td><ul><li>ROI report generated</li></ul></td></tr><tr><td>Shadow apps</td><td><ul><li>App classification changed</li><li>App removed</li><li>User removed from app</li></ul></td></tr><tr><td>Workflows</td><td><ul><li>Workflow created/edited/deleted</li><li>Workflow state changed</li><li>Workflow imported/exported</li></ul></td></tr><tr><td><strong>Settings</strong></td><td></td></tr><tr><td>Auto-archive alerts</td><td><ul><li>Auto-archive changed</li><li>Auto-archive suppressed/resolved changed</li></ul></td></tr><tr><td>Alert configuration</td><td><ul><li>Alert enabled/disabled</li><li>Alert severity changed</li><li>Alert auto-resolve changed</li><li>Exclude actors/targets changed</li></ul></td></tr><tr><td>Alert notifications</td><td><ul><li>Email notification changed</li><li>Slack notification changed</li></ul></td></tr><tr><td>API keys</td><td><ul><li>Key added/deleted</li><li>Key role changed</li></ul></td></tr><tr><td>Connectors</td><td><ul><li>Connector added/disabled </li><li>Connector info updated</li><li>Connector data type updated</li></ul></td></tr><tr><td>Legal consent for PII</td><td><ul><li>Consent granted</li></ul></td></tr><tr><td>Lexical lists</td><td><ul><li>Lexical list added/edited</li></ul></td></tr><tr><td>SSO</td><td><ul><li>SSO connection added/deleted</li><li>SSO connection enforced/unenforced</li></ul></td></tr><tr><td>Team management</td><td><ul><li>Member added/deleted</li><li>Access revoked/granted</li><li>Role changed</li><li>Invitation resent</li></ul></td></tr><tr><td>Webhooks</td><td><ul><li>Webhook added/deleted/edited</li></ul></td></tr><tr><td>Workflow templates</td><td><ul><li>Email template added/edited/deleted</li></ul></td></tr><tr><td>Workflow secrets</td><td><ul><li>Secret added/deleted</li></ul></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/system-management/audit-logs.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.