Audit log

Settings, Audit & Logs shows the audit trail. Members with audit:read see their own actions; with audit:read:org they can see the whole organization. Export needs audit:export (or audit:export:org). The same data is available from the audit log API.

What is recorded

Area	Examples
Sign-in and identity	Successful and failed sign-ins, sign-outs, password changes and resets, multi-factor enrolment and challenges, passkeys, linked Google accounts.
Credentials	API key creation, update and revocation; vault credentials created, updated, accessed or deleted.
Organization	Invitations created or revoked, role and member changes, settings changes.
Testing	Sessions and scans started, completed, failed or cancelled; engagement scope changes; findings created, updated or verified; assets created, updated or deleted.
Data and privacy	Data exports and deletions, erasure requests, consent and privacy setting changes.
Security	Unauthorized access attempts, suspicious sign-ins, rate-limit hits and revoked sessions.
Sandboxes and networks	Sandbox creation, access and destruction; network connector enrolment, attestation and revocation.
Reports and automation	Reports generated and downloaded; schedules created, changed, run or deleted.

Each entry has a timestamp in UTC, the action, its severity and status, the actor, the target, the IP address and user agent, details, and compliance tags (SOC2, ISO27001, GDPR, HIPAA, PCI-DSS) where they apply.

Filtering and export

Filter by severity and by action type, and page through results. Exports take the same filters, so you can pull exactly the slice an auditor asks for. Exporting the audit trail is itself an audited action.