Monitoring account activity with audit logs

Activity across your corp and sites over the last 30 days is tracked and available to review in the audit logs. There are two different audit logs available: the Corp Audit Log for corp-level activity and the Site Audit Log for site-level activity. These logs can also be filtered by type of activity to more easily identify specific events.

Email notifications and integrations with third-party applications can be set up to automatically notify you of activity within your corp and sites. For additional information, see Integrations.

Corp Audit Log

The Corp Audit Log tracks activity related to your corp itself, such as the creation of new users and sites.

You can view the Corp Audit Log by going to the Corp Manage menu and selecting Corp Audit Log.

Activity types

The corp activity types that are logged include:

Activity typeDescription
User invitedA new user was invited to the corp
User re-invitedThe invitation email was re-sent to an invited user
User updatedA user was edited, including changes to user role
User password updatedA user updated their password
User added to siteA user was added to one or more sites
User removed from siteA user was removed from one or more sites
User email marked undeliverableA user's email address bounced
User removed from corpA user was deleted
User SSO exemption changedA user's ability to bypass Single Sign-On (SSO) was changed
Corp integration createdA new corp-level integration was created
Corp integration updatedA corp-level integration was updated
Corp integration removedA corp-level integration was removed
Corp integration testedA corp-level integration was tested
Two-factor authentication enabledA user enabled two-factor authentication (2FA)
Two-factor authentication updatedA user updated their two-factor authentication (2FA) secret
Two-factor authentication disabledA user disabled two-factor authentication (2FA)
SSO enabledSingle Sign-On (SSO) was enabled for the corp
SSO disabledSingle Sign-On (SSO) was disabled for the corp
Site createdA new site was created
Site deletedA site was deleted
User authentication setting updatedA user authentication setting was changed, including the account timeout setting, API access token creation permission and expiration settings, and restrictions of which IP addresses can access the console
API access token createdAn API Access Token was created
API access token deletedAn API Access Token was deleted
SAML request certificate createdA new SAML request certificate was created
CloudWAF corp SSL certificate uploadedAn SSL certificate for CloudWAF was uploaded to the corp
CloudWAF corp SSL certificate deletedAn SSL certificate for CloudWAF was deleted from the corp
CloudWAF instance createdA new CloudWAF instance was created
CloudWAF instance updatedA CloudWAF instance was updated
CloudWAF instance deletedA CloudWAF instance was deleted
CloudWAF certificate about to expireA CloudWAF certificate is about to expire. Includes certificate ID and expiration date

Site Audit Log

The Site Audit Log tracks activity related to your individual sites. This includes activity such as flagged IPs, the creation of new rules, and site configuration changes.

You can view the Site Audit Log by going to the Manage menu and selecting Site Audit Log.

Activity types

The site activity types that are logged include:

Activity typeDescription
Site display name changedThe display name of a site was changed
Site short name changedThe short name of a site was changed
Agent mode changedThe agent mode ("Blocking", "Not Blocking", "Off") was changed
Agent IP anonymization mode changedThe agent IP anonymization mode was changed
Client IP Header changedA header used to determine the client IP address was changed
IP flaggedAn IP address was flagged
IP flag expiredAn IP address flag was manually expired
New agent onlineA new agent was detected
Site integration createdA new site-level integration was created
Site integration updatedA site-level integration was updated
Site integration removedA site-level integration was removed
Site integration testedA site-level integration was tested
Agent key createdA new agent key was created
Agent key deletedAn agent key was deleted
Primary agent key changedThe primary agent key was changed
Custom redaction createdA custom redaction was created
Custom redaction updatedA custom redaction was updated
Custom redaction removedA custom redaction was removed
Header link createdA header link was created
Header link updatedA header link was updated
Header link removedA header link was removed
Rule createdA rule was created
Rule updatedA rule was updated
Rule deletedA rule was deleted
Templated rule createdA templated rule was created
Templated rule updatedA templated rule was updated
Templated rule removedA templated rule was removed
List createdA list was created
List updatedA list was updated
List deletedA list was removed
Custom signal createdA custom signal was created
Custom signal updatedA custom signal was updated
Custom signal removedA custom signal was removed
Custom alert createdA custom alert was created
Custom alert updatedA custom alert was updated
Custom alert removedA custom alert was removed
Rate limited IP expiredA rate limited IP was manually expired
Rate limited IPs bulk expiredAll rate limited IPs were manually expired
Custom dashboard createdA custom dashboard was created
Custom dashboard updatedA custom dashboard was updated
Custom dashboard resetA custom dashboard was reset
Custom dashboard deletedA custom dashboard was removed
Custom dashboard card createdA custom dashboard card was created
Custom dashboard card updatedA custom dashboard card was updated
Custom dashboard card deletedA custom dashboard card was removed
Default dashboard updatedThe default dashboard was changed
Agent alertAn agent alert was triggered
Weekly digest sentThe weekly digest was sent
Monitor URL enabledThe monitor view URL for a dashboard was enabled
Monitor URL disabledThe monitor view URL for a dashboard was disabled
Monitor URL createdThe monitor view URL for a dashboard was updated
Monitor URL invalidatedThe previous monitor view URL for a dashboard was disabled
CloudWAF SSL certificate uploadedAn SSL certificate for CloudWAF was uploaded to the site
CloudWAF SSL certificate deletedAn SSL certificate for CloudWAF was deleted from the site
CloudWAF config updatedThe CloudWAF configuration was updated
Was this guide helpful?

Do not use this form to send sensitive information. If you need assistance, contact support. This form is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.