Audit Log Events

The Audit Log records every meaningful action across your Protect tenant. This page is the structured catalogue of events — useful for SIEM mapping, audit deliverables, and alert design.

Protect records each audit event as an Action Title × Platform Section pair. Common events include: Connected System, Created Saved View Action, Created Shared Device Saved View, Created Team Device Saved View, Created User, Enabled Vitals, Registered Multi-Tenant Integration, Saved Dynamic Column, and Saved Logic Engine Configuration. The other categories below are grouped by the platform area that produces them; exact Action Title strings can vary by release.

For the page that surfaces these events in the product, columns, filtering, and retention behaviour, see Settings → Audit Log.

How to read this page

Each event in the live Audit Log has:

Column	Meaning
Action Title	Short label (e.g. “Created Saved View Action”)
Description	One-line context (e.g. “System: Crowdstrike”)
Platform Section	The top-level area (e.g. “Vitals”, “Saved Views”)
Email	User who performed the action
Timestamp	When it happened, in your locale

The categories below correspond to the Platform Section column.

Authentication

User session and credential events.

Event	Recorded when
Sign in (password)	A user authenticates via password
Sign in (SSO)	A user authenticates via SAML / OIDC
Sign in failed	An authentication attempt failed
Sign out	A user signs out

User management

Changes to platform users, roles, and teams. Platform Section: User Management. Verified live (Action Title strings as displayed in the Audit Log):

Action Title	Description format	Recorded when
Created User	`Team: <team name>` or `User: <email>`	A team or user is created — the same Action Title is reused for both with the Description field disambiguating

Settings

Tenant-wide configuration changes. Multiple Platform Sections capture different setting areas: Verified live (Action Title × Platform Section pairs as displayed in the Audit Log):

Action Title	Platform Section	Description format	Recorded when
Saved Dynamic Column	`Dynamic Columns`	`Column Name: <name>`	A dynamic column is saved at Settings → Schemas
Saved Logic Engine Configuration	`Dynamic Columns`	`Configuration Name: <name>`	A Logic Engine rule attached to a dynamic column is saved

Other events in this area:

Event	Recorded when
Inactive threshold changed	Settings → Misc value updated
Device retention policy changed	Settings → Misc value updated
Default homepage changed	Settings → Misc value updated
Stealth Devices enabled/disabled	Settings → Misc toggle flipped
Tag created / edited / deleted	Settings → Tags change
IP location override changed	Settings → IP Locations change
Timezone changed	Settings → Timezone change

Integrations & Vitals

Lifecycle and configuration of connected tools. Platform Sections: Integrations and Vitals. Verified live (Action Title × Platform Section pairs as displayed in the Audit Log):

Action Title	Platform Section	Description format	Recorded when
Connected System	`Integrations`	`Name: <integration>` or `Name: <integration>, Tenant Name: <tenant>` for multi-tenant	A new integration connection is added (or the second tenant of a multi-tenant integration)
Registered Multi-Tenant Integration	`Integrations`	`Name: <integration>, Tenant Name: <tenant>`	Multi-tenancy is enabled and additional tenants are registered
Enabled Vitals	`Vitals`	`System: <integration>`	A Vitals row is turned on for an integration after first sync

Other events in this area:

Event	Recorded when
Disconnected System	An integration is removed
Integration credentials updated	Modify → re-enter credentials
Integration sync triggered	Manual Sync Now click
Integration auth revoked	Vendor-side revocation detected
Vitals configuration edited	Per-column gear → Configure Mode change

Actions & automations

Action Center lifecycle. Platform Section: Saved View Actions (the underlying name reflects Actions being scoped to saved views). Verified live:

Action Title	Platform Section	Description format	Recorded when
Created Saved View Action	`Saved View Actions`	`Action: <action name>, AutomationType: <type>` (e.g. `AutomationType: webhook`, `AutomationType: sendemail`, `AutomationType:` empty for some)	A new Continuous or Snapshot Action is created

Other events in this area:

Event	Recorded when
Updated Saved View Action	Trigger, automation, or settings changed
Paused Saved View Action	Action paused
Deleted Saved View Action	Action removed

Automation executions (each fire of an email / ticket / webhook) appear primarily in the per-Action Automation Log (right panel of Action Center), not the global Audit Log. The Audit Log captures Action lifecycle events; the Automation Log captures fire events.

Saved views & exports

Platform Section: Saved Views. Protect distinguishes Shared, Team, and Private saved views via separate Action Titles:

Action Title	Platform Section	Description format	Recorded when
Created Shared Device Saved View	`Saved Views`	`Saved View (active): <view name>`	A new saved view with Everyone visibility is created
Created Team Device Saved View	`Saved Views`	`Saved View (active): <view name>`	A new saved view with Team visibility is created

Other events in this area:

Event	Recorded when
Created Private Device Saved View	Private visibility saved view
Created … User Saved View	Same pattern, on User Inventory
Updated / Deleted Saved View	View modified or removed
Visibility changed	Private ↔ Team ↔ Everyone
Export run	A CSV / JSON / XLSX export is generated from a grid
Scheduled Report created / updated / deleted / sent	Scheduled Reports lifecycle and delivery

Devices & inventory

Devices themselves are largely managed via integrations; operational events on devices are sparse.

Event	Recorded when
Device manually tagged	A tag is applied to a device manually (rare — most tagging is rule-driven)
Device data filter applied	A filter scoping a user’s device view changes

API & access

Event	Recorded when
API token created	New API key issued at Settings → API Access
API token disabled	An API key is suspended via the row’s Disable key button
API token deleted	An API key is removed via the row’s Delete key button
SSO configuration changed	Access Control SSO setup change

Reporting

Events from the Reporting surface.

Event	Recorded when
App created	A Reporting app is created
App published	A Reporting app is published
App pinned	An app is pinned to the left rail
App unpinned	An app is unpinned
App deleted	A Reporting app is removed

Filtering and export

The Audit Log grid uses plain-text search across visible columns — it is not the query language used elsewhere. For structured filtering, export the log and process externally, or pull via the API. For SIEM ingest workflows, see Settings → Audit Log → Export.

Cross-references

Settings → Audit Log

The live audit log surface

Access Control

Who sees the audit log

Role Permissions

Audit Log permission by role

Error Codes

Errors that surface in the log

Webhook Payload

Automation fired — webhook

API Reference

Programmatic audit log access

ThreatAware Protect

Getting Started

Inventory

Tags & Logic Engine

Vitals & Issues

Action Center

Integrations

Reporting

Access & Admin

Reference

Trust & Security

How to read this page

Authentication

User management

Settings

Integrations & Vitals

Actions & automations

Saved views & exports

Devices & inventory

API & access

Reporting

Filtering and export

Cross-references

Settings → Audit Log

Access Control

Role Permissions

Error Codes

Webhook Payload

API Reference

​How to read this page

​Authentication

​User management

​Settings

​Integrations & Vitals

​Actions & automations

​Saved views & exports

​Devices & inventory

​API & access

​Reporting

​Filtering and export

​Cross-references

Settings → Audit Log

Access Control

Role Permissions

Error Codes

Webhook Payload

API Reference

How to read this page

Authentication

User management

Settings

Integrations & Vitals

Actions & automations

Saved views & exports

Devices & inventory

API & access

Reporting

Filtering and export

Cross-references