> ## Documentation Index > Fetch the complete documentation index at: https://docs.threataware.com/llms.txt > Use this file to discover all available pages before exploring further. # Audit Log Events > Catalogue of every event that appears in the Protect Audit Log, grouped by category The [Audit Log](/settings/audit-log) records every meaningful action across your Protect tenant. This page is the structured catalogue of events — useful for SIEM mapping, audit deliverables, and alert design. Protect records each audit event as an **Action Title × Platform Section** pair. Common events include: Connected System, Created Saved View Action, Created Shared Device Saved View, Created Team Device Saved View, Created User, Enabled Vitals, Registered Multi-Tenant Integration, Saved Dynamic Column, and Saved Logic Engine Configuration. The other categories below are grouped by the platform area that produces them; exact Action Title strings can vary by release. For the page that surfaces these events in the product, columns, filtering, and retention behaviour, see [Settings → Audit Log](/settings/audit-log). ## How to read this page Each event in the live Audit Log has: | Column | Meaning | | -------------------- | ------------------------------------------------- | | **Action Title** | Short label (e.g. "Created Saved View Action") | | **Description** | One-line context (e.g. "System: Crowdstrike") | | **Platform Section** | The top-level area (e.g. "Vitals", "Saved Views") | | **Email** | User who performed the action | | **Timestamp** | When it happened, in your locale | The categories below correspond to the **Platform Section** column. ## Authentication User session and credential events. | Event | Recorded when | | ------------------ | ------------------------------------ | | Sign in (password) | A user authenticates via password | | Sign in (SSO) | A user authenticates via SAML / OIDC | | Sign in failed | An authentication attempt failed | | Sign out | A user signs out | ## User management Changes to platform users, roles, and teams. **Platform Section: `User Management`.** Verified live (Action Title strings as displayed in the Audit Log): | Action Title | Description format | Recorded when | | ---------------- | -------------------------------------- | -------------------------------------------------------------------------------------------------------------- | | **Created User** | `Team: ` or `User: ` | A team or user is created — the same Action Title is reused for both with the Description field disambiguating | ## Settings Tenant-wide configuration changes. Multiple Platform Sections capture different setting areas: Verified live (Action Title × Platform Section pairs as displayed in the Audit Log): | Action Title | Platform Section | Description format | Recorded when | | ------------------------------------ | ----------------- | ---------------------------- | -------------------------------------------------------------------- | | **Saved Dynamic Column** | `Dynamic Columns` | `Column Name: ` | A dynamic column is saved at [Settings → Schemas](/settings/schemas) | | **Saved Logic Engine Configuration** | `Dynamic Columns` | `Configuration Name: ` | A Logic Engine rule attached to a dynamic column is saved | Other events in this area: | Event | Recorded when | | -------------------------------- | -------------------------------------------------------- | | Inactive threshold changed | [Settings → Misc](/settings/misc) value updated | | Device retention policy changed | [Settings → Misc](/settings/misc) value updated | | Default homepage changed | [Settings → Misc](/settings/misc) value updated | | Stealth Devices enabled/disabled | [Settings → Misc](/settings/misc) toggle flipped | | Tag created / edited / deleted | [Settings → Tags](/settings/tags) change | | IP location override changed | [Settings → IP Locations](/settings/ip-locations) change | | Timezone changed | [Settings → Timezone](/settings/timezone) change | ## Integrations & Vitals Lifecycle and configuration of connected tools. **Platform Sections: `Integrations` and `Vitals`.** Verified live (Action Title × Platform Section pairs as displayed in the Audit Log): | Action Title | Platform Section | Description format | Recorded when | | --------------------------------------- | ---------------- | -------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ | | **Connected System** | `Integrations` | `Name: ` or `Name: , Tenant Name: ` for multi-tenant | A new integration connection is added (or the second tenant of a multi-tenant integration) | | **Registered Multi-Tenant Integration** | `Integrations` | `Name: , Tenant Name: ` | Multi-tenancy is enabled and additional tenants are registered | | **Enabled Vitals** | `Vitals` | `System: ` | A Vitals row is turned on for an integration after first sync | Other events in this area: | Event | Recorded when | | ------------------------------- | --------------------------------------- | | Disconnected System | An integration is removed | | Integration credentials updated | Modify → re-enter credentials | | Integration sync triggered | Manual Sync Now click | | Integration auth revoked | Vendor-side revocation detected | | Vitals configuration edited | Per-column gear → Configure Mode change | ## Actions & automations Action Center lifecycle. **Platform Section: `Saved View Actions`** (the underlying name reflects Actions being scoped to saved views). Verified live: | Action Title | Platform Section | Description format | Recorded when | | ----------------------------- | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------- | | **Created Saved View Action** | `Saved View Actions` | `Action: , AutomationType: ` (e.g. `AutomationType: webhook`, `AutomationType: sendemail`, `AutomationType: ` empty for some) | A new Continuous or Snapshot Action is created | Other events in this area: | Event | Recorded when | | ------------------------- | ---------------------------------------- | | Updated Saved View Action | Trigger, automation, or settings changed | | Paused Saved View Action | Action paused | | Deleted Saved View Action | Action removed | Automation **executions** (each fire of an email / ticket / webhook) appear primarily in the per-Action **Automation Log** (right panel of [Action Center](/action-center)), not the global Audit Log. The Audit Log captures Action lifecycle events; the Automation Log captures fire events. ## Saved views & exports **Platform Section: `Saved Views`.** Protect distinguishes Shared, Team, and Private saved views via separate Action Titles: | Action Title | Platform Section | Description format | Recorded when | | ------------------------------------ | ---------------- | ---------------------------------- | ---------------------------------------------------- | | **Created Shared Device Saved View** | `Saved Views` | `Saved View (active): ` | A new saved view with Everyone visibility is created | | **Created Team Device Saved View** | `Saved Views` | `Saved View (active): ` | A new saved view with Team visibility is created | Other events in this area: | Event | Recorded when | | --------------------------------------------------- | -------------------------------------------------------------- | | Created Private Device Saved View | Private visibility saved view | | Created … User Saved View | Same pattern, on User Inventory | | Updated / Deleted Saved View | View modified or removed | | Visibility changed | Private ↔ Team ↔ Everyone | | Export run | A CSV / JSON / XLSX export is generated from a grid | | Scheduled Report created / updated / deleted / sent | [Scheduled Reports](/scheduled-reports) lifecycle and delivery | ## Devices & inventory Devices themselves are largely managed via integrations; operational events on devices are sparse. | Event | Recorded when | | -------------------------- | -------------------------------------------------------------------------- | | Device manually tagged | A tag is applied to a device manually (rare — most tagging is rule-driven) | | Device data filter applied | A filter scoping a user's device view changes | ## API & access | Event | Recorded when | | ------------------------- | ------------------------------------------------------------------- | | API token created | New API key issued at [Settings → API Access](/settings/api-access) | | API token disabled | An API key is suspended via the row's **Disable key** button | | API token deleted | An API key is removed via the row's **Delete key** button | | SSO configuration changed | [Access Control](/access-control) SSO setup change | ## Reporting Events from the Reporting surface. | Event | Recorded when | | ------------- | --------------------------------- | | App created | A Reporting app is created | | App published | A Reporting app is published | | App pinned | An app is pinned to the left rail | | App unpinned | An app is unpinned | | App deleted | A Reporting app is removed | ## Filtering and export The Audit Log grid uses **plain-text search** across visible columns — it is not the [query language](/query-language) used elsewhere. For structured filtering, export the log and process externally, or pull via the API. For SIEM ingest workflows, see [Settings → Audit Log → Export](/settings/audit-log#export). ## Cross-references The live audit log surface Who sees the audit log Audit Log permission by role Errors that surface in the log Automation fired — webhook Programmatic audit log access