You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/content/docs/fundamentals/account/account-security/audit-logs.mdx
+10-9Lines changed: 10 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,7 +11,7 @@ sidebar:
11
11
12
12
import { APIRequest } from"~/components"
13
13
14
-
Cloudflare Audit Logs are account-based. All user-initiated actions are recorded automatically across both the Cloudflare API and Dashboard. System-initiated logs are also captured to reflect actions taken automatically by Cloudflare systems, such as configuration updates, background processes, or internal policy enforcement.
14
+
Cloudflare Audit Logs are account-based. All user-initiated actions are recorded automatically across both the Cloudflare API and dashboard. System-initiated logs are also captured to reflect actions taken automatically by Cloudflare systems, such as configuration updates, background processes, or internal policy enforcement.
15
15
16
16
When a user-initiated action triggers additional automated behavior, corresponding system-initiated logs may be generated. In some cases, these system-initiated logs include additional enrichments that provide more context about what was changed, offering deeper visibility into the full lifecycle of the action.
17
17
@@ -30,16 +30,16 @@ Audit Logs (version 2) provide a unified and standardized system for tracking an
30
30
-**Standardized logging**: Audit logs are automatically generated in a consistent format across all Cloudflare services, ensuring uniformity and eliminating inconsistencies.
31
31
-**Expanded product coverage**: Audit Logs covers 111 products, capturing actions from key endpoints, such as `/accounts`, `/zones`, `/user`, and `/memberships` APIs.
32
32
-**Granular filtering**: Uniformly formatted logs allow for precise filtering by actions, actors, methods, and resources, facilitating efficient investigations.
33
-
-**Enhanced context and transparency**: Each log entry includes detailed context, such as the authentication method used, the interface (API or Dashboard) through which the action was performed, and mappings to Cloudflare Ray IDs for improved traceability.
33
+
-**Enhanced context and transparency**: Each log entry includes detailed context, such as the authentication method used, the interface (API or dashboard) through which the action was performed, and mappings to Cloudflare Ray IDs for improved traceability.
34
34
-**Comprehensive activity capture**: Beyond create, edit, and delete actions, Audit Logs records GET requests and failed attempts, ensuring no critical activity is overlooked.
35
35
36
36
## Retention
37
37
38
-
Audit Logs are retained for 18 months before being deleted. Enterprise customers can use [Logpush](/logs/logpush/) to store Audit Logs for longer periods of time. Logpush for Audit Logs v2 will be available for GA.
38
+
Audit logs are retained for 18 months before being deleted. Enterprise customers can use [Logpush](/logs/logpush/) to store audit logs for longer periods of time. Logpush for Audit Logs v2 will be available for GA.
39
39
40
40
## Access Audit Logs
41
41
42
-
You can retrieve audit logs using one of the API or the dashboard. Audit Logs v2 will soon be available with Logpush.
42
+
You can retrieve audit logs using either the API or the dashboard. Audit Logs v2 will soon be available with Logpush.
43
43
44
44
### API
45
45
@@ -94,10 +94,10 @@ For more information refer to the [API documentation](https://developers.cloudfl
94
94
To access audit logs in the Cloudflare dashboard:
95
95
96
96
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select your account.
97
-
2. Go to **Manage Account** > **Audit Log**.
97
+
2. Go to **Manage Account** > **Audit Logs**.
98
98
99
99
:::note
100
-
The Audit Logs v1 UI is shown by default, and users can switch between Audit Logs v1 and v2 as needed.
100
+
The Audit Logs v1 is shown by default. You can switch between Audit Logs v1 and v2 as needed.
101
101
:::
102
102
103
103
## Audit Log structure
@@ -110,7 +110,7 @@ Audit logs can be initiated either by users or the system. Understanding the typ
110
110
111
111
#### User initiated Audit Logs
112
112
113
-
Track actions performed directly by users through Cloudflare interfaces (Dashboard or API). These logs capture who performed the action, when it occurred, and what resource was affected. User initiated actions can be performed by three actors:
113
+
Track actions performed directly by users through Cloudflare interfaces (dashboard or API). These logs capture who performed the action, when it occurred, and what resource was affected. User initiated actions can be performed by three actors:
114
114
115
115
-`actor_type="user"`: Action was performed by an individual user.
116
116
-`actor_type="Cloudflare_admin"`: Action was performed by Cloudflare.
@@ -124,7 +124,7 @@ Record changes made automatically by Cloudflare systems, without direct user inp
124
124
125
125
#### Account Activity Logs
126
126
127
-
Contain events scoped to a single Cloudflare account. These logs are filterable by `account ID` and reflect actions within that account only. You can optionally filter events further using the resource_scope field, which specifies whether the resource is associated with a user, an account, or a zone (`resource_scope ="user"`, `resource_scope ="accounts"`, or `resource_scope ="zones"`).
127
+
Contain events scoped to a single Cloudflare account. These logs are filterable by `account ID` and reflect actions within that account only. You can optionally filter events further using the `resource_scope` field, which specifies whether the resource is associated with a user, an account, or a zone (`resource_scope ="user"`, `resource_scope ="accounts"`, or `resource_scope ="zones"`).
128
128
129
129
#### User Profile Activity Logs
130
130
@@ -202,11 +202,12 @@ Use the following example to get a list of audit logs for a user account.
202
202
203
203
### Actor
204
204
205
-
The actor represents who performed the action. It includes identity attributes like user ID, email address, IP address, and the type of actor (`user`, `account`, `Cloudflare_admin`, or `system`). It also includes the context used to initiate the action, such as API or Dashboard (`dash`).
205
+
The actor represents who performed the action. It includes identity attributes like user ID, email address, IP address, and the type of actor (`user`, `account`, `Cloudflare_admin`, or `system`). It also includes the context used to initiate the action, such as API or dashboard (`dash`).
206
206
207
207
### Action
208
208
209
209
The action field captures the nature of the event and whether it was successful. It includes a high-level type (e.g., `view`, `create`, `update`, `delete`), a specific description (such as `SSO_LOGIN`), the timestamp of when the action occurred, and the result (`success` or `failure`).
210
+
210
211
All `GET` requests are captured as `view` actions in Audit Logs.
0 commit comments