Skip to content

Commit 19bd698

Browse files
Apply suggestions from code review
Co-authored-by: Rebecca Tamachiro <[email protected]>
1 parent 8578afc commit 19bd698

File tree

1 file changed

+10
-9
lines changed

1 file changed

+10
-9
lines changed

src/content/docs/fundamentals/account/account-security/audit-logs.mdx

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ sidebar:
1111

1212
import { APIRequest } from "~/components"
1313

14-
Cloudflare Audit Logs are account-based. All user-initiated actions are recorded automatically across both the Cloudflare API and Dashboard. System-initiated logs are also captured to reflect actions taken automatically by Cloudflare systems, such as configuration updates, background processes, or internal policy enforcement.
14+
Cloudflare Audit Logs are account-based. All user-initiated actions are recorded automatically across both the Cloudflare API and dashboard. System-initiated logs are also captured to reflect actions taken automatically by Cloudflare systems, such as configuration updates, background processes, or internal policy enforcement.
1515

1616
When a user-initiated action triggers additional automated behavior, corresponding system-initiated logs may be generated. In some cases, these system-initiated logs include additional enrichments that provide more context about what was changed, offering deeper visibility into the full lifecycle of the action.
1717

@@ -30,16 +30,16 @@ Audit Logs (version 2) provide a unified and standardized system for tracking an
3030
- **Standardized logging**: Audit logs are automatically generated in a consistent format across all Cloudflare services, ensuring uniformity and eliminating inconsistencies.
3131
- **Expanded product coverage**: Audit Logs covers 111 products, capturing actions from key endpoints, such as `/accounts`, `/zones`, `/user`, and `/memberships` APIs.
3232
- **Granular filtering**: Uniformly formatted logs allow for precise filtering by actions, actors, methods, and resources, facilitating efficient investigations.
33-
- **Enhanced context and transparency**: Each log entry includes detailed context, such as the authentication method used, the interface (API or Dashboard) through which the action was performed, and mappings to Cloudflare Ray IDs for improved traceability.
33+
- **Enhanced context and transparency**: Each log entry includes detailed context, such as the authentication method used, the interface (API or dashboard) through which the action was performed, and mappings to Cloudflare Ray IDs for improved traceability.
3434
- **Comprehensive activity capture**: Beyond create, edit, and delete actions, Audit Logs records GET requests and failed attempts, ensuring no critical activity is overlooked.
3535

3636
## Retention
3737

38-
Audit Logs are retained for 18 months before being deleted. Enterprise customers can use [Logpush](/logs/logpush/) to store Audit Logs for longer periods of time. Logpush for Audit Logs v2 will be available for GA.
38+
Audit logs are retained for 18 months before being deleted. Enterprise customers can use [Logpush](/logs/logpush/) to store audit logs for longer periods of time. Logpush for Audit Logs v2 will be available for GA.
3939

4040
## Access Audit Logs
4141

42-
You can retrieve audit logs using one of the API or the dashboard. Audit Logs v2 will soon be available with Logpush.
42+
You can retrieve audit logs using either the API or the dashboard. Audit Logs v2 will soon be available with Logpush.
4343

4444
### API
4545

@@ -94,10 +94,10 @@ For more information refer to the [API documentation](https://developers.cloudfl
9494
To access audit logs in the Cloudflare dashboard:
9595

9696
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select your account.
97-
2. Go to **Manage Account** > **Audit Log**.
97+
2. Go to **Manage Account** > **Audit Logs**.
9898

9999
:::note
100-
The Audit Logs v1 UI is shown by default, and users can switch between Audit Logs v1 and v2 as needed.
100+
The Audit Logs v1 is shown by default. You can switch between Audit Logs v1 and v2 as needed.
101101
:::
102102

103103
## Audit Log structure
@@ -110,7 +110,7 @@ Audit logs can be initiated either by users or the system. Understanding the typ
110110

111111
#### User initiated Audit Logs
112112

113-
Track actions performed directly by users through Cloudflare interfaces (Dashboard or API). These logs capture who performed the action, when it occurred, and what resource was affected. User initiated actions can be performed by three actors:
113+
Track actions performed directly by users through Cloudflare interfaces (dashboard or API). These logs capture who performed the action, when it occurred, and what resource was affected. User initiated actions can be performed by three actors:
114114

115115
- `actor_type="user"`: Action was performed by an individual user.
116116
- `actor_type="Cloudflare_admin"`: Action was performed by Cloudflare.
@@ -124,7 +124,7 @@ Record changes made automatically by Cloudflare systems, without direct user inp
124124

125125
#### Account Activity Logs
126126

127-
Contain events scoped to a single Cloudflare account. These logs are filterable by `account ID` and reflect actions within that account only. You can optionally filter events further using the resource_scope field, which specifies whether the resource is associated with a user, an account, or a zone (`resource_scope ="user"`, `resource_scope ="accounts"`, or `resource_scope ="zones"`).
127+
Contain events scoped to a single Cloudflare account. These logs are filterable by `account ID` and reflect actions within that account only. You can optionally filter events further using the `resource_scope` field, which specifies whether the resource is associated with a user, an account, or a zone (`resource_scope ="user"`, `resource_scope ="accounts"`, or `resource_scope ="zones"`).
128128

129129
#### User Profile Activity Logs
130130

@@ -202,11 +202,12 @@ Use the following example to get a list of audit logs for a user account.
202202

203203
### Actor
204204

205-
The actor represents who performed the action. It includes identity attributes like user ID, email address, IP address, and the type of actor (`user`, `account`, `Cloudflare_admin`, or `system`). It also includes the context used to initiate the action, such as API or Dashboard (`dash`).
205+
The actor represents who performed the action. It includes identity attributes like user ID, email address, IP address, and the type of actor (`user`, `account`, `Cloudflare_admin`, or `system`). It also includes the context used to initiate the action, such as API or dashboard (`dash`).
206206

207207
### Action
208208

209209
The action field captures the nature of the event and whether it was successful. It includes a high-level type (e.g., `view`, `create`, `update`, `delete`), a specific description (such as `SSO_LOGIN`), the timestamp of when the action occurred, and the result (`success` or `failure`).
210+
210211
All `GET` requests are captured as `view` actions in Audit Logs.
211212

212213
### Account

0 commit comments

Comments
 (0)