Skip to main content
Audit logs document a detailed record of actions taken in your workspace, letting you track who made a change, when it happened, and what was altered. This includes entity edits, integration configuration changes, API key activity, and updates to custom roles and their assigned permissions. Use audit logs to investigate changes, identify discrepancies, and get a holistic view of activity across your workspace. You can access them through the Cortex UI or the public API.

​
Viewing audit logs in the Cortex UI

Users with the View Audit Logs permission can view audit logs via the Cortex UI.
  1. From the main sidebar, click your avatar in the bottom-left corner.
  2. Click Settings.
  3. From the Settings menu, locate the Logging section, then click Audit logs.
     The audit logs page in the Cortex UI.
The audit logs page displays a list of user activities. Each log entry includes the following columns:
  • Actor - Who or what performed the action:
    • A user - The user who made the change in Cortex.
    • An API key - The change was made with an API key. The entry shows the name of the key.
    • Cortex - Cortex made the change automatically on your behalf, such as syncing data from an integration or applying an update through GitOps. See Cortex-initiated actions for details.
  • Action type - The action performed (created, deleted, or updated).
  • Object type - The type of object that changed. See the full list of object types below.
  • Object identifier - The unique identifier of the object.
  • Date - When the action occurred.
Note: Audit log entries only capture successful, applied changes. If an action fails, is denied by authorization, or doesn’t result in an actual change (before and after states match), no entry is created.
To view more information about a particular action, click its row: A highlighted action on the audit logs page. A side panel opens with details about the action, including diff changes and the date and time of the action: The side panel provides further information about the action.

​
Filtering audit logs

On the audit logs page, you can narrow your search by using the filter and date range options. The filter icons on the audit logs page. To narrow the scope of your search, click Filter. You can filter by:
  • API key identifier
  • Action type
  • Actor IP address
  • Actor email
  • Actor type
  • Anonymous request type
  • Entity
  • Object type
To change the date range, click Last 7 days. You can filter by:
  • Last 7 days
  • Last 14 days
  • Last 30 days
  • Custom date range

​
How filters work

You can apply multiple filters at once, and select one or more criteria within each filter. Within a single filter, multiple selections are combined with OR. Across different filters, selections are combined with AND. Example
  • Selecting CREATE for ‘action type’ and SCORECARD for ‘object type’ produces the query create AND scorecard.
  • Selecting both CREATE and DELETE for ‘action type’ and SCORECARD for ‘object type’ produces (create OR delete) AND scorecard, which returns all Scorecards created or deleted within the selected timeframe.

​
Audit log reference

​
Object types

The following object types are included in audit logs:

​
Actors

The following actor identifiers are included in audit logs:

​
Cortex-initiated actions

When Cortex makes a change automatically, the Actor column shows Cortex on the first line and the source of the change on the second line. Each source maps to something configured in your workspace, so you can tell why the change happened.
  • Integration sync - Cortex refreshed data from an integration you connected. This includes discovering cloud resources from Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP), discovering entities from Git and observability providers, and mapping identities from a connected user directory.
  • GitOps - Cortex applied an entity descriptor from your repository.
  • Workflow - A Workflow that Cortex ran on your behalf made the change.
  • Scaffolder - A Scaffolder template run created or changed the entity.
  • System - A change Cortex made that doesn’t fall under one of the categories above.
To see what kind of object changed (for example, a cloud resource or an incident), check the Object type column.
Last modified on September 28, 2026