> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codethreat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit Logs

> Track all actions in your CodeThreat organization

Audit logs track all significant actions in your organization for compliance, security, and troubleshooting.

## What is Logged?

<CardGroup cols={2}>
  <Card title="User Actions" icon="user">
    Sign ins, role changes, member additions/removals
  </Card>

  <Card title="Security Actions" icon="shield">
    Violations suppressed, scans triggered, settings changed
  </Card>

  <Card title="Repository Actions" icon="folder">
    Repositories added/removed, settings modified
  </Card>

  <Card title="Access Actions" icon="key">
    Permission changes, access grants/revokes
  </Card>
</CardGroup>

***

## Accessing Audit Logs

<Steps>
  <Step title="Navigate to Audit Logs">
    **Organization Settings** → **Audit Logs**
  </Step>

  <Step title="View Recent Activity">
    See chronological list of all logged actions
  </Step>

  <Step title="Filter and Search">
    Use filters to find specific actions
  </Step>
</Steps>

***

## Logged Events

### User Management

* User invited, invitation accepted/declined
* User role changed, user removed
* User sign in/sign out
* Password changed, 2FA enabled/disabled

### Repository Management

* Repository connected/removed
* Repository settings changed
* VCS integration configured
* Webhook created/deleted

### Security Actions

* Scan triggered
* Violation assigned/suppressed
* Violation status changed
* AI features enabled/disabled
* Automated scanning configured

### Access Control

* Repository access granted/revoked
* Team created/deleted
* Team membership changed
* Permission level modified

### Organization Settings

* Organization settings changed
* Billing information updated
* Subscription plan changed
* API key created/deleted
* Integration configured

***

## Audit Log Details

Each log entry includes:

* **Timestamp**: When the action occurred
* **Actor**: Who performed the action (user email)
* **Action**: What was done
* **Target**: What was affected
* **Details**: Additional context
* **IP Address**: Where the action originated
* **User Agent**: Browser/client used

***

## Filtering Audit Logs

### Filter Options

* **By Time**: Last 24 hours, 7 days, 30 days, custom date range
* **By Action Type**: User management, repository actions, security actions, access control, settings changes
* **By Actor**: Specific user, all admins, all users, API actions
* **Search**: User email, repository name, action keyword, IP address

***

## Exporting Audit Logs

Export audit logs for compliance or external analysis:

<Steps>
  <Step title="Apply Filters">
    Filter to the specific logs you want to export
  </Step>

  <Step title="Click Export">
    Click **Export** button
  </Step>

  <Step title="Choose Format">
    Select CSV, JSON, or PDF (report format)
  </Step>

  <Step title="Download">
    Download exported audit logs
  </Step>
</Steps>

***

## Audit Log Retention

| Plan     | Retention Period |
| -------- | ---------------- |
| **FREE** | 30 days          |
| **PRO**  | 90 days          |

<Note>
  Need extended retention for compliance? Contact sales about custom enterprise options.
</Note>

***

## Common Use Cases

### Security Incident Investigation

1. Filter by date range when incident occurred
2. Review all actions during that period
3. Identify suspicious actions
4. Track changes to security settings
5. Generate report for incident documentation

### Compliance Audits

1. Export audit logs for audit period
2. Demonstrate access control enforcement
3. Show timely access removal
4. Prove security settings compliance
5. Document change management

### Troubleshooting

1. Check recent configuration changes
2. Verify who modified settings
3. Identify when problem started
4. Correlate with logged actions
5. Determine root cause

***

## Best Practices

* Regular review: Weekly review of audit logs by security team
* Monitor critical actions: Set alerts for sensitive actions
* Export regularly: Monthly export for compliance documentation
* Investigate anomalies: Review unusual activity
* Document reviews: Note audit log reviews in compliance records
* Long retention: Enable longer retention for regulated industries

***

## Next Steps

<CardGroup cols={2}>
  <Card title="Roles and Permissions" icon="user-shield" href="/team/roles-and-permissions">
    Understand access control
  </Card>

  <Card title="Compliance Reports" icon="file-shield" href="/reporting/security-reports">
    Generate compliance documentation
  </Card>
</CardGroup>