Read audit logs

The audit log is your organization’s compliance trail: a durable record of who did what, to which record, when, and from where. Use it for security investigations, change forensics, and auditor evidence.

What is recorded

Each entry captures the actor (or “system” for automated jobs), the action, the affected record, a timestamp, the IP address, and the browser. Recorded events include, among others:

• Sign-ins, including failed login and failed 2FA attempts
• Member invitations, role changes, and removals. The full invitation lifecycle is covered: sending one (individually, in bulk, or to a whole team), resending it, revoking it, and the recipient accepting it, at both organization and project level
• Organization deletion, including whether it came from the empty workspace cleanup offered after accepting an invitation
• Security setting changes (2FA enforcement, session policies, IP allowlist, permission matrix saves)
• API token creation and revocation
• SCIM provisioning events from your identity provider
• Data exports, imports, and plan changes
• File activity: uploading a file to a document folder, downloading a document or a task attachment (including an agent reading one), restoring an earlier version of a document, and saving a Word, Excel or PowerPoint file in the browser editor, alongside deleting, sharing and attaching files. See File activity below

Browse and filter

1. Open Logs from the sidebar.

2. Filter by member, action, resource type, IP address, or date range, or use the free-text search to find a specific record.

3. Open any entry to see its full details, including the before and after values where they were captured.

4. To keep a combination you return to, such as one member’s failed sign-ins, save it as a named view from the views menu beside the filters. Saved views are personal to you and follow your account to another device. See Save your filters as a view.

Tip

When investigating one person, filter by member rather than searching. The member filter also catches events where they were the subject (for example, an IdP deactivating them) and not just the actor.

The Client column: where a request came from

Newer audit entries record which client performed the action, alongside who performed it. They are different questions: the actor tells you the privilege held; the client tells you the surface the request came through. The same person acting from the web app and through a connected AI agent produces visibly different entries.

Values you’ll see: Web, Maker, Extension, Desktop, Mobile, MCP (a connected agent), PAT (a personal access token), System (background jobs), and Unknown.

Two readings that are easy to get wrong:

• Blank is not Unknown. A blank Client means the entry predates the feature, older rows are deliberately not backfilled with guesses. Unknown means the request was seen but couldn’t be classified.
• It’s an attribution hint, not a security control. Part of the signal is self-reported by the client, so filter and investigate with it, but don’t build access decisions on it.

File activity: who opened a file

When the question is “who opened the contract”, start from the file actions rather than the whole trail.

1. Open Organization Settings → Security & Compliance and go to the Security Events sub-tab.

2. Pick a Period: 7, 14, 30 or 90 days.

3. In the events card, switch Event type from Access control to File activity. The card lists the most recent 100 file actions in the period, newest first, each with the person, the time, and the client it came from: “via WEB” for the web app, the agent’s name for a connected agent, “via Office editor” for a save in the browser editor.

The File activity view shows these actions:

Action	Recorded when
WORKSPACE DOCUMENT UPLOADED	A file is uploaded to a document folder, as a new file or a replacement, from the app or by an agent
FILE DOWNLOADED	A document or a task attachment is downloaded or opened, exported to .docx or .pdf, or read by an agent
WORKSPACE DOCUMENT VERSION RESTORED	An earlier version of a document is restored
WORKSPACE DOCUMENT OFFICE SAVED	A Word, Excel or PowerPoint file is saved in the browser editor. The client reads Office editor
Deletes, shares and attachments	A document is deleted (one or in bulk), shared outside the organization or has a share revoked, or a task attachment is added or removed

• Repeat downloads are recorded once an hour. One person downloading the same file again within an hour makes no new entry, so the trail holds at most one download entry per person, file and hour. A second person downloading the same file gets an entry of their own.
• Older entries. File uploads, downloads, restores and Office saves are recorded from the release that added them; earlier activity of those kinds was not logged and is not backfilled.
• Plan. File activity reads the audit trail, so it needs the plan that includes audit logs, the same as the Audit Export. On another plan the view shows an upgrade card, and Access control stays available.

For the full history beyond the 100 most recent, use the Logs page filters or the Audit Export below.

Export for auditors

Open Organization Settings → Security & Compliance and go to the Audit Export sub-tab. Pick a date range (the export defaults to the last 30 days) and a format, CSV for spreadsheets and GRC tools or JSON for programmatic processing. The file downloads immediately. Each row ends with the client columns, the client the action came from and its label (for example the agent’s name, or Office editor for a save in the browser editor).

Retention

Audit entries are kept for one year by default. How long data is kept, in the Data retention section of Security & Compliance → Controls, sets this: choose a compliance preset or a custom window, including keeping logs indefinitely. Choosing a shorter period asks first. Entries older than the configured window are purged automatically.

Best practices

1. Review monthly for anomalies. Failed login spikes, off-hours admin changes, unusual IPs. Monthly scan catches patterns.
2. Export quarterly for archival. Even with 1-year retention, archive exports per quarter for compliance.
3. Filter by member when investigating. Catches both “member as actor” + “member as subject” of actions.
4. Set retention by compliance regime. SOX = 7 years. HIPAA = 6 years. GDPR = case-by-case. Pick the preset that fits.
5. Cross-reference with compliance evidence export. Compliance events are in audit log + dedicated export. See Export compliance evidence.

Troubleshooting / common pitfalls

• Specific event missing. Three causes: (a) action not yet supported; (b) actor was system (filter); (c) past retention window. Check retention.
• Export taking long. Large date ranges = slow. Narrow range or use JSON for programmatic processing.
• Audit log inaccessible. Owner/ Admin only. Portfolio Manager can’t see it.
• Filter returns 0 results. Date range mismatch (audit log uses UTC). Widen date range.
• CSV cells show formulas. Onplana sanitizes; if you see formula execution, file a bug.

How this combines with other features

• Audit log + Compliance evidence. Compliance events in audit log; also in dedicated evidence export. See Export compliance evidence.
• Audit log + SCIM. SCIM events flow through audit log.
• Audit log + Workflows. Workflow actions audit-logged.
• Audit log + Tokens. Token activity audit-logged. See Create API tokens.

Coming from another tool

Tool	Mapping
Splunk audit trail	Direct concept
AWS CloudTrail	Direct
ServiceNow Activity log	Direct
Microsoft Compliance Center	Direct
Custom audit table	Onplana standardizes the pattern

FAQs

Can Portfolio Managers see the audit log? No. Audit data is restricted to Owners and Admins, both on the Logs page and in the export.

Are automated actions logged too? Yes. Background jobs, workflow automations, and provisioning events are recorded and marked as system actions, so you can distinguish them from human activity.

How do I prove a leaver lost access on a specific date? Filter the log by that member. Their deactivation event from SCIM or the manual removal is recorded with a timestamp, see Provision users with SCIM.

Is the export safe to open in Excel? Yes. Exported cells are sanitized so that values cannot execute as formulas when opened in a spreadsheet.

Can I stream audit log to my SIEM? Yes. Microsoft Sentinel, Splunk, Elastic and Datadog can poll the audit log with a read-only token. See Send the audit log to a SIEM.

Are audit log entries immutable? Yes, entries cannot be edited or deleted. Only retention purges them.

Does Onplana audit log include data export events? Yes, every export (audit, compliance evidence, etc.) writes its own audit entry.

Related

• Export compliance evidence, compliance-specific events
• Create API tokens, token activity recorded here
• Provision users with SCIM, SCIM events here