Audit Logs

The Activity page provides a comprehensive audit trail of all events in your Containment.AI organization for compliance and security monitoring.

What's Logged

Containment.AI logs:

User Activity

• AI platform interactions
• Policy triggers
• Extension connections/disconnections
• Login events

Admin Activity

• Configuration changes
• Policy modifications
• User management actions
• Exception grants

System Events

• Integration updates
• Scheduled tasks
• Error events
• Maintenance activities

Accessing Audit Logs

1. Navigate to Activity in the sidebar
2. View the event stream
3. Use filters to find specific events
4. Click events for details

Event Structure

Each log entry contains:

Field	Description
Timestamp	When the event occurred
Event Type	Category of event
Actor	Who performed the action
Action	What happened
Target	What was affected
Details	Additional context
IP Address	Origin of the action

Event Types

Alert Events

• alert.created - New alert generated
• alert.acknowledged - Admin acknowledged alert
• alert.resolved - Alert marked resolved
• alert.dismissed - Alert dismissed

Policy Events

• policy.enabled - Policy turned on
• policy.disabled - Policy turned off
• policy.modified - Policy settings changed
• policy.created - New policy created

User Events

• user.invited - Invitation sent
• user.activated - User completed setup
• user.deactivated - User removed
• user.login - User signed in

Admin Events

• admin.invited - Admin invitation sent
• admin.permissions_changed - Permissions modified
• admin.removed - Admin removed

Integration Events

• integration.connected - New integration
• integration.disconnected - Integration removed
• integration.sync - Data synchronized

Filtering Logs

Quick Filters

• All Events - Everything
• Alerts - Alert-related events
• Policies - Policy changes
• Users - User activity
• Admin - Administrative actions

Advanced Filters

Filter	Options
Date Range	Today, This Week, Custom
Event Type	Select specific types
Actor	Specific user or admin
Action	Specific action
Severity	Info, Warning, Critical

Search Syntax

actor:admin@company.com action:policy.modified

Event Details

Click any event to see full details:

Summary

• Event description
• Timestamp with timezone
• Actor information

Before/After

For changes, see:

• Previous state
• New state
• What changed

Context

• Related events
• Affected resources
• IP and device info

Raw Data

• Complete JSON payload
• Technical details
• API request/response

Compliance Features

Immutability

Audit logs cannot be modified or deleted:

• Write-once storage
• Cryptographic verification
• Tamper detection

Retention

Plan	Retention
Free	30 days
Professional	365 days
Enterprise	Custom (12+ months)

Export

Export logs for compliance:

1. Apply desired filters
2. Click Export
3. Choose format (CSV, JSON, PDF)
4. Download or schedule delivery

Compliance Reports

Enterprise

Generate compliance reports:

• SOC 2 activity reports
• HIPAA access logs
• GDPR data access records

Real-Time Monitoring

Live Feed

Watch events as they happen:

1. Click Live toggle
2. Events stream in real-time
3. Pause to investigate

Alerts

Set up notifications for events:

1. Go to Settings > Notifications
2. Configure event triggers
3. Choose delivery method

Integration with SIEM

Enterprise

Forward logs to your SIEM:

• Splunk
• Sumo Logic
• Datadog
• Custom webhook

See SIEM Integration for setup.

Best Practices

Regular Review

• Check logs daily for security
• Review admin actions weekly
• Audit access monthly

Investigation

• Use filters to narrow scope
• Correlate related events
• Document findings

Compliance

• Export regularly for archives
• Maintain chain of custody
• Test log completeness

Privacy

Audit logs:

• Do not contain message content
• Show metadata only
• Protect user privacy

Admin access to logs:

• Requires appropriate permissions
• Is itself logged
• Should follow least privilege

Related Topics

• Compliance Reports - Generate reports
• Understanding Alerts - Alert events
• SIEM Integration - Log forwarding