Audit Logs

​

Overview

​

What Are Audit Logs?

• Application changes: Install, update, delete
• Agent modifications: Create, update, delete, visibility changes
• MCP Server changes: Configuration updates
• Context changes: Create, update, delete operations
• User management: Role changes, access grants/revokes
• Security updates: Credential changes, permission modifications
• Settings changes: Configuration updates

​

Accessing Audit Logs

​

Audit Log Interface

​

Log List View

• Exact date and time of the event
• Formatted for your timezone
• Sortable for chronological analysis

• Who performed the action
• User email or identifier
• Links to user details

• Create: New resource created
• Update: Existing resource modified
• Delete: Resource removed

• Application: API integrations
• Agent: AI agents
• MCP Server: MCP configurations
• Context: Context items
• User: User account changes
• Settings: System configuration

• Unique identifier of affected resource
• Quick reference for tracking
• Links to resource (if still exists)

​

Search and Filter

​

Quick Search

• Search by user ID
• Search by resource type
• Search by resource ID
• Search by action type
• Real-time results as you type

​

Advanced Filters

Options:
- All Resource Types
- Application
- Agent  
- MCP Server
- Context

Options:
- All Actions
- Create
- Update
- Delete

• From Date: Start of audit period
• To Date: End of audit period
• Defaults to last 30 days

• Filter by specific user ID
• See activities by individual users
• Audit specific user actions

• Track changes to specific resource
• View complete history of an item
• Useful for troubleshooting

​

Applying and Clearing Filters

1. Configure filter criteria
2. Click Apply button
3. Results update immediately
4. Page resets to page 1

1. Click Clear button
2. All filters reset to default
3. Shows all audit logs again
4. Preserves date range selection

​

Audit Log Details

​

Event Summary

• Action type badge (Create/Update/Delete)
• Color-coded for quick identification:
  • Green: Create
  • Blue: Update
  • Red: Delete

• Resource type badge
• Resource ID with copy function
• Link to resource (if available)

• User ID who performed action
• User role at time of action
• User email address

• Full timestamp with timezone
• ISO format timestamp
• Time since event occurred

​

Change Details

• Previous configuration
• Old settings
• Original state

• New configuration
• Updated settings
• Modified state

• List of modified fields only
• Highlights what actually changed
• Easy comparison view

​

Metadata

• Source IP address (if available)
• User agent / client information
• Session ID
• API version used

• System version at time of event
• Processing time
• Related events (if applicable)

• Copy full log data as JSON
• Download specific log entry
• Share log URL (if permitted)

​

Understanding Audit Events

​

Application Events

{
  "action": "create",
  "resource_type": "application",
  "resource_id": "github",
  "changes": {
    "api_name": "github",
    "api_title": "GitHub",
    "domain_url": "https://api.github.com"
  }
}

{
  "action": "update",
  "resource_type": "application",
  "resource_id": "github",
  "changes": {
    "security_info_configured": {
      "old": false,
      "new": true
    }
  }
}

{
  "action": "delete",
  "resource_type": "application",
  "resource_id": "slack",
  "metadata": {
    "operations_count": 47,
    "mcp_tools_removed": 47
  }
}

​

Agent Events

{
  "action": "create",
  "resource_type": "agent",
  "resource_id": "support-bot-001",
  "changes": {
    "name": "Customer Support Bot",
    "visibility": "private"
  }
}

{
  "action": "update",
  "resource_type": "agent",
  "resource_id": "support-bot-001",
  "changes": {
    "visibility": {
      "old": "private",
      "new": "public"
    }
  }
}

{
  "action": "update",
  "resource_type": "agent",
  "resource_id": "support-bot-001",
  "changes": {
    "instructions": {
      "old": "...",
      "new": "..."
    }
  }
}

​

Context Events

{
  "action": "create",
  "resource_type": "context",
  "resource_id": "company-info",
  "changes": {
    "name": "company-info",
    "type": "documentation"
  }
}

{
  "action": "update",
  "resource_type": "context",
  "resource_id": "company-info",
  "changes": {
    "content": {
      "old": "...",
      "new": "..."
    }
  }
}

​

MCP Server Events

{
  "action": "update",
  "resource_type": "mcp_server",
  "resource_id": "custom-tools",
  "changes": {
    "enabled": {
      "old": false,
      "new": true
    }
  }
}

​

Pagination and Navigation

​

Viewing Large Result Sets

• Items per page: Select 10, 20, 50, or 100
• Previous button: Go to previous page
• Next button: Go to next page
• Page indicator: Shows “Page X of Y”

• Start with more items per page for overview
• Reduce items for detailed review
• Use filters to narrow results first
• Export for offline analysis if needed

​

Refresh

• Load latest audit logs
• Update current page
• Check for new activity
• Verify recent changes

​

Use Cases

​

Security Auditing

1. Filter by resource type: “Application”
2. Filter by action: “Update”
3. Review security configuration changes
4. Verify authorized changes only

1. Filter by specific user
2. Review all their activities
3. Identify unusual patterns
4. Ensure proper access usage

1. Set date range for audit period
2. Export filtered results
3. Generate compliance reports
4. Document all changes

​

Troubleshooting

1. Identify when issue started
2. Filter audit logs by timeframe
3. Review all changes in that period
4. Correlate changes with issues

1. Filter by resource ID
2. View all changes to resource
3. Identify who made changes
4. Contact for more information

1. View audit log details
2. Compare before/after values
3. Understand exact changes
4. Determine impact

​

Change Management

1. Filter by date of deployment
2. Review all changes made
3. Verify deployment checklist
4. Document deployment activities

1. Filter by team member
2. Monitor configuration changes
3. Ensure best practices followed
4. Provide feedback as needed

1. Export current configuration
2. Compare with baseline
3. Identify unexpected changes
4. Restore or document as needed

​

Best Practices

​

Regular Review

• Review last 24 hours
• Check for unexpected changes
• Verify critical resources unchanged
• Monitor for security events

• Review all changes for the week
• Analyze change patterns
• Verify compliance
• Document significant changes

• Comprehensive review of all logs
• Generate compliance reports
• Identify optimization opportunities
• Update documentation

​

Security Monitoring

• Changes outside business hours
• Bulk delete operations
• Unauthorized access attempts
• Unusual modification patterns
• Security configuration changes

• Critical application changes
• Agent visibility changes to public
• User permission escalations
• Multiple failed operations
• Rapid configuration changes

​

Documentation

• Intentional configuration changes
• Deployment activities
• Security incidents
• User access changes
• System updates

• Reason for major changes
• Business justification
• Approval process followed
• Expected impact
• Rollback plan if needed

​

Integration with Compliance

​

Regulatory Requirements

• Track data access changes
• Document user consent management
• Monitor data export activities
• Verify deletion requests processed

• Access control changes
• Security configuration audit
• Change management documentation
• Incident tracking

• PHI access logging
• Security configuration tracking
• User access management
• Audit trail maintenance

​

Audit Trail Export

1. Filter relevant time period
2. Apply necessary filters
3. Export audit logs
4. Store securely with compliance data
5. Retain per policy requirements

​

Troubleshooting

​

No Logs Appearing

• No changes have been made
• Filters too restrictive
• Date range excludes all activity
• Insufficient permissions

1. Verify changes were made
2. Clear all filters
3. Expand date range
4. Check user permissions
5. Refresh the page

​

Can’t See Change Details

• Log data pruned
• Insufficient permissions
• Network issue

1. Check data retention policy
2. Verify user role permissions
3. Refresh connection
4. Contact administrator

​

Export Not Working

• Too much data selected
• Export format not supported
• Browser blocking download
• Network timeout

1. Reduce date range
2. Apply filters first
3. Check browser settings
4. Retry with smaller dataset
5. Contact support if persists

​

Privacy and Data Retention

​

What’s Logged

• Configuration changes
• Resource modifications
• User actions
• Timestamps and users
• Change details

• API call payloads
• Sensitive credentials
• User conversation content
• Personal identifiable information (beyond user ID)

​

Retention Period

• Logs retained based on your plan
• Typical retention: 90 days to 1 year
• Export before retention expires
• Automatic cleanup of old logs
• Can request extended retention

​

Access Control

• Role-based access to audit logs
• Admin-only access (typically)
• Organization-level visibility
• Secure storage and encryption
• Compliance with data regulations

​

Next Steps

• Monitor actions for API call details
• Review settings for current configurations
• Check dashboard for usage trends
• Configure applications with proper security