Skip to main content

Audit Logs

The Activity page provides an audit trail of governance events in your Containment.AI organization for compliance and security monitoring.

Accessing Audit Logs​

  1. Navigate to Activity in the sidebar.
  2. Review the event timeline.
  3. Use the tabs, date range, and search to narrow the list.
  4. Click an event to see its details.

Event Structure​

Each audit event is described by two core fields:

FieldDescription
event_timestampWhen the event occurred
actionWhat happened (see the action list below)
resource_typeWhat kind of resource was affected (for example, policy, alert, integration)
resource_idThe affected resource
admin_idWho performed the action (rendered as the actor's name or email)
detailsEvent-specific metadata (JSON)
ip_address, user_agentRequest origin

Events are identified by a flat action value plus a resource type — not a dotted resource.action event-name taxonomy. If you are building parsing or filtering downstream, match on action and resource_type, and note the timestamp field is event_timestamp.

Actions​

The action field is one of:

create, update, delete, enable, disable, assign, resolve, mute, trigger, block, redact, login_failed, cancel, reactivate, accept, invite.

Resource Types​

resource_type describes the affected resource — for example policy (policy changes), alert (alert lifecycle), and integration (integration changes). Policy-enforcement events on user traffic surface as the trigger / block / redact actions.

Filtering​

Tabs​

The Activity page groups events into tabs, each with a count:

  • All activity — every event
  • Policy changes — policy configuration changes
  • Alert actions — alert lifecycle events, including status changes
  • Violations — enforcement events (trigger / block / redact)
  • Devices — device events

Date Range​

Use the date-range selector to limit events to a time window — including Last hour and Last 72 hours, which are specific to this page.

The search box (Search actors, actions, objects) matches event text across actor name and email, action, summary, resource type, and resource ID. There is no key:value search syntax — it is a plain-text substring match.

You can also deep-link with ?actor=<name> to pre-fill the search, or ?event=<id> to jump to and highlight a single event.

Sorting​

Click a sortable column header to sort; click again to reverse. Columns are Timestamp, Actor, Action, Object, and Result.

Privacy​

Audit events contain metadata only:

  • The audit-event record has no prompt or message-content field.
  • Events record what happened and to which resource, not the underlying data.
note

An event's details are shown verbatim in the event drawer under "Additional details". The guarantee is that audit events carry no prompt column — not that content is stripped at render time. Alert records are a different surface with a different guarantee: they retain a redacted prompt excerpt (see Understanding Alerts).

Admin access to logs requires the audit-viewer permission and should follow least privilege.

Retention​

Audit history is visible for the retention window associated with your plan:

PlanRetention
Free30 days
Professional365 days
Enterprise365 days (longer terms scoped per engagement)

This is the retention figure shown on the Activity page. See the plans overview for plan details.

Export​

On Enterprise plans, the Activity page offers:

  • Export selected — the rows you have selected, as JSON Lines
  • Export to SIEM — an on-demand download of audit events as JSON Lines or CSV

Both are capped per request and cover audit events only. On other plans the controls appear with an upgrade prompt.

Continuous Forwarding and Reporting (Roadmap)​

  • Scheduled SIEM forwarding — continuous streaming into your SIEM (as opposed to the on-demand export above) is a roadmap capability delivered as a custom engagement. See SIEM Integration.
  • Compliance reports — packaged report generation is not yet a self-serve feature. See Compliance Reports.