The Audit module is the searchable record of everything that happened in an environment: "Summaries, searchable events, and type breakdowns for this environment."
Audit uses the time range picker in the top bar — the selected window is reflected in the URL as &rt=24h, so a filtered view is a shareable link. Two controls sit in the top-right of every tab: Saved filters and Filters.
Overview
?tab=overview — the summary tab.
Activity counters, each with a percentage change against the previous window:
| Counter | Meaning |
|---|---|
| Total Events | All events recorded in the window. |
| Actors | Distinct users and services that caused events. |
| Signals | Security detections raised in the window (see Lidar). |
| Event Types | How many distinct types fired. |
Below that, an Activity timeline charts Events and Signals across the window. Quiet environments read "No audit activity in current time range."
Events Explore
?tab=events — "Browse events for the selected time range." The event table, with a count badge showing how many matched.
Use Filters to narrow by event type, actor, category, or outcome, and Saved filters to keep an investigation you run often. Rows are selectable and the table pages at 25 rows by default.
This is the tab the Dashboard's "View all activity" link lands on, carrying the same time range across.
Event Types
?tab=types — "Explore event types, inspect recent samples, and infer their schema from observed payloads."
Header counters show how many types and categories exist and how many usage events were recorded. Types are grouped by category — the current catalogue has 22 types across four categories:
| Category | Covers |
|---|---|
| Administration | Impersonation and Elevate lifecycle: USER_IMPERSONATION_STARTED, USER_IMPERSONATION_GRANT_CREATED, USER_IMPERSONATION_GRANT_REVOKED, and ELEVATE_ACCESS_REQUESTED / APPROVED / DENIED / CANCELLED / ACTIVATED / REVOKED / EXPIRED. |
| Authn | Sign-in, sign-up, and session lifecycle. |
| Security | Threat detections. |
| Team Management | Console team and invite changes. |
Each type row shows its recent activity and event count. Selecting one opens the Schema explorer on the right, which has two views:
- Schema — an inferred prototype merged from up to 20 observed payload samples.
- Payload — a recent sample.
Before any events arrive the explorer explains that the schema is inferred once events exist, and shows an example payload so you know the webhook body shape you will receive.
Forwarding events
Audit events do not have to live only in the console. Configure a channel under Notifications > Channels to forward them to a webhook, Slack, Datadog, Sysdig, Splunk HEC, or Sumo Logic. Delivery is retried durably, so a brief outage at the destination does not lose events.
Related
| Read | To learn how to |
|---|---|
| Dashboard | See the live event log feeding this history |
| Lidar | Investigate the security signals counted here |
| Notifications | Stream events to a SIEM or webhook |
| Users | Trace an event back to the user who caused it |
| Audit logs | Query audit events over the API |
| Events & webhooks | Consume events in your own systems |