Get early access
Features · Security & Backup · Audit Log
Security & Backup · Audit Log

Every action, every API call,
signed and searchable.

A single timeline of everything that happened in the tenant — UI clicks, API calls, MCP tool calls, agent actions. Tamper-evident, exportable, hash-chained. The view that makes “who did this” one query, not three.

audit · last entries
14:31 ui incident.ack sascha
14:29 mcp mcp.read_file claude
14:22 api server.update ci-bot
13:58 agent service.restart web-prod-04
exportable · signed · searchable
— Why this matters

One timeline, or you are reconstructing from four.

01

The AI counts as a user.

An MCP tool call is an action against your infrastructure. It belongs in the same timeline as a click and an API call, not in a separate log nobody reads.

02

Attribution is the whole point.

Action, actor, target, IP, timestamp. Any one of those missing and the entry cannot answer the question you are asking it.

03

Config changes need a diff, not a flag.

Knowing a file changed is half an answer. The snapshot comparison shows what changed.

— What's included

What lands in the timeline.

UI actions
Every click that changes something, with the user behind it.
API calls
Same treatment, attributed to the key or the token that made them.
MCP tool calls
Including the ones the local Tailnet bridge made off-platform, pushed up and merged into the same view.
Agent activity
Service restarts, enrolments, remote commands — what the agent did on your behalf.
Config diffs
Snapshots compared side by side, so a change is readable rather than merely recorded.
Filter and export
By type and severity, streamed out as CSV when someone needs it in a spreadsheet.
— Works with

Connected capabilities

Audit Log Signing
HMAC chain that makes the log tamper-evident.
→
SIEM Forwarding
Real-time stream of audit events to Splunk / Sentinel / Elastic / Datadog.
→
Policy Engine
Build "must be audited" policies on top of the log.
→
SSH Session Recording
Cross-linked: a recording is the body for an audit entry.
→
— FAQ

Questions, answered honestly.

How is it different from the activity timeline? +
The timeline is per-host. The audit log is per-tenant + every action everywhere. Audit is a superset.
How long is it kept? +
90 days standard; 1 year on Pro; configurable retention on Enterprise + signed-export to your own storage.
Can I narrow by IP? +
Yes — actor IP captured per event. Useful for "who logged in from where".

The compliance answer to "who did this?"

Audit Log on every plan; long retention from Pro.

Get early access Back to Security & Backup