> ## Documentation Index > Fetch the complete documentation index at: https://neuraltrust-92b43583-develop.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Audit Logs > Browse platform audit events in Telemetry → Logs. Track authentication, user and role changes, SSO, and product configuration — with filters, search, CSV export, and SOC2 retention. # Audit Logs **Audit logs** are the tenant security trail for *who changed what* in NeuralTrust — sign-ins, membership and role changes, SSO and SCIM, and configuration of TrustGate and TrustGuard resources. In the console they live under **Telemetry → Logs** (platform stream). Use them for compliance evidence, security monitoring, and incident investigation. **Logs** is not the same as product **Activity** (Gateway or Runtime request explorers) or [Alerts](/platform/alerts) (detection findings from TrustGuard / TrustGate telemetry). Those surfaces show runtime traffic and raised detections; **Logs** shows console and configuration audit events. *** ## Open Logs 1. Sign in to NeuralTrust with access to the **Telemetry** product (at least **Read only**). 2. Open **Telemetry** from the top bar (or go to `/{teamId}/telemetry`). 3. Select the **Logs** tab. Telemetry has three tabs: **[Alerts](/platform/alerts)**, **Logs**, and **[Integrations](/platform/alert-integrations)**. *** ## What you see Each row is one audit event: | Column | Contents | | ------------ | -------------------------------------------------------------------------------------- | | **Date** | When the event occurred (local time in the table) | | **Category** | Badge such as Authentication, User Management, Gateway, Policy | | **Actor** | Who performed the action (email when available; otherwise actor id, type, or `system`) | | **Action** | Human-readable description, or the event type if no description was stored | | **Resource** | Target name or id when the event touched a resource | Row menu: * **Copy details** — copies the full row as JSON to the clipboard (for tickets or SIEM correlation). Toolbar: * **Search action** — filters the **currently loaded** rows by action text * **Filter** — Author email, Trace ID, Event type (applied when loading from the server) * **Date range** — optional bounds on when events occurred * **Export** — downloads a CSV of the **visible** (loaded + filtered) rows * **Refresh** — reloads the list * Scroll / load more — pages of up to 100 events *** ## Filters | Control | Behavior | Typical use | | ----------------- | ----------------------------------------- | ------------------------------------ | | **Author** | Exact actor email | “What did this user do?” | | **Trace ID** | Exact trace id | Correlate with a single request path | | **Event type** | Exact type string (e.g. `policy.created`) | Narrow to one kind of change | | **Date range** | Inclusive window | Investigation timeframe | | **Search action** | Client-side match on the Action column | Quick refine of the loaded page set | Sort any column in the table (default: newest first). *** ## Categories Events are grouped into categories. Platform Logs include identity, admin, and product-configuration categories: | Category | What it covers | | -------------------- | ------------------------------------------------------------------------------------------------ | | **Authentication** | Sign-in, sign-out, sessions, SSO enforcement, break-glass access, password reset, Turnstile | | **User Management** | User create/delete, role changes, team join/remove, password changes, account unlock | | **SSO & Security** | SSO config, break-glass users, SCIM provision/deprovision, OIDC / Google Workspace login | | **API Access** | API token generation and related access events | | **Administrative** | Team settings, invitations, org requests, custom domains, platform IAM (users, roles, ownership) | | **Gateway** | Gateway create/update/delete, deployments, service credentials | | **Policy** | TrustGate policy lifecycle | | **Consumer** | Consumers and consumer API keys | | **Registry** | LLM / MCP registries | | **Identity** | Gateway auths and roles used for identity-based routing | | **Collector** | TrustGuard collectors, API keys, hook secrets, collector policies | | **Runtime Detector** | Runtime detector create/update/delete | | **Runtime Policy** | Runtime policy lifecycle | | **TrustGuard** | TrustGuard instance lifecycle | A separate **Activity** stream is reserved for runtime product operations (e.g. runtime security and posture). The Logs table today focuses on the **platform** audit trail above. *** ## Representative event types Exact type strings appear in filters and in **Copy details**. Common examples: ### Authentication | Event | Description | | ----------------------------------------------- | ------------------------------------------------- | | `auth.login.success` | Successful sign-in | | `auth.login.failure` | Failed sign-in | | `auth.logout` | Sign-out | | `auth.session.created` / `auth.session.expired` | Session lifecycle | | `auth.break_glass.access` | Break-glass password access under SSO enforcement | | `auth.sso_enforcement.blocked` | Password access blocked because SSO is enforced | | `auth.login.account_locked` | Account locked after repeated failures | | `auth.password_reset.*` | Self-service password reset flow | ### User management & platform IAM | Event | Description | | --------------------------------------------------------------------------- | ------------------------------- | | `user.created` / `user.deleted` | Account lifecycle | | `user.role.changed` | Role update | | `user.team.joined` / `user.team.removed` | Membership changes | | `platform.user.invited` / `platform.user.updated` / `platform.user.removed` | Platform Users & Roles | | `platform.ownership.transferred` | Organization ownership transfer | | `platform.role.created` / `updated` / `deleted` | Custom platform roles | | `invitation.sent` / `invitation.accepted` | Invitations | ### SSO, SCIM, OIDC | Event | Description | | --------------------------------------------------- | ---------------------- | | `sso.config.created` / `updated` / `deleted` | SSO configuration | | `sso.break_glass.user_added` | Break-glass user added | | `scim.user.provisioned` / `scim.user.deprovisioned` | SCIM user lifecycle | | `oidc.config.*` / `oidc.login.*` | Generic OIDC | | `google_workspace.login.*` | Google Workspace SSO | ### TrustGate & TrustGuard configuration | Event | Description | | --------------------------------------------------- | ------------------------------------------------------------------- | | `gateway.created` / `updated` / `deleted` | Gateway instance | | `policy.created` / `updated` / `deleted` | Gateway policies | | `consumer.created` / `updated` / `deleted` | Consumers | | `registry.created` / `updated` / `deleted` | Registries | | `auth.created` / `role.created` (and update/delete) | Gateway identity resources | | `gateway_service_credential.*` | TrustGate machine credentials (ids only — secrets are never logged) | | `collector.created` / `updated` / `deleted` | Collectors | | `runtime_detector.*` / `runtime_policy.*` | Runtime detectors and policies | | `trustguard.created` / `updated` / `deleted` | TrustGuard instances | Sensitive values (passwords, tokens, secrets, cookies, session material) are redacted from stored metadata. *** ## Login failures When investigating `auth.login.failure` (or related auth events), common failure reasons include: | Reason | Meaning | | ------------------------------------------------------------ | ---------------------------------------------------------------------- | | `invalid_credentials` | Wrong password | | `sso_enforced` | Password login blocked; use the configured IdP | | `break_glass_single_org_violation` | Break-glass user is not allowed under the single-org policy | | `rate_limited` | Too many attempts | | `account_disabled` / `account_not_found` | Account state | | `account_locked` | Locked after consecutive failures — unlock via password reset or admin | | `oauth_error` / `entra_token_invalid` / `oidc_token_invalid` | IdP token or OAuth failure | | `oidc_discovery_failed` | OIDC discovery endpoint failed | | `insufficient_role` | IdP role mapping required but no matching claim | ### Suspicious patterns worth reviewing 1. Many failures from one IP across different accounts 2. Success immediately after a burst of failures 3. Break-glass or off-hours admin activity 4. Rapid role or ownership changes 5. Unexpected SSO config or SCIM deprovision events *** ## Export and retention * **CSV export** includes Date, Category, Actor, Action, and Resource for the rows currently visible after filters and search. Load more pages before export if you need a wider window. * **Copy details** is the full JSON for a single event. * Audit events are retained for **365 days** (SOC2 minimum). Forward critical streams to your own SIEM if you need longer retention. *** ## Access | Requirement | Access | | ----------------------------- | ------------------------------------------------------------------------------ | | **Telemetry** product | Caller must have product access (not blocked) | | **View Logs** | **Read only** or higher on Telemetry | | **Configure SIEM for alerts** | Higher Telemetry permission — see [Integrations](/platform/alert-integrations) | Platform IAM admins and Global Admins typically already have Telemetry access; grant Telemetry **Read only** when a compliance reviewer needs the trail without product admin rights. *** ## Forwarding to a SIEM **Telemetry → Integrations** forwards **alert findings** (detections), not every audit row, as OCSF Detection Findings. See [Integrations](/platform/alert-integrations). For the audit trail itself: * Use **Export** / **Copy details** for investigations and evidence packs, or * Ingest exported CSV/JSON into your SIEM on a schedule if you need the full console audit stream outside NeuralTrust. *** ## Troubleshooting | Issue | What to check | | --------------------------- | ------------------------------------------------------------------------------------------------------------ | | Can't open Telemetry / Logs | Confirm Telemetry product access and at least Read only | | Empty table | Widen or clear the date range; clear Author / Trace / Event type filters; confirm events exist for this team | | Search finds nothing | Search only matches **Action** text on **loaded** rows — load more or use server filters | | Missing older events | Outside the retention window, or never emitted for that action | | Need request-level traffic | Use Gateway or Runtime **Activity**, not Logs | | Need detection findings | Use [Alerts](/platform/alerts), not Logs | *** ## Best practices 1. Review authentication and SSO categories regularly, especially after IdP changes. 2. After offboarding, filter by the user’s email and confirm role removals and SCIM deprovision events. 3. Prefer **Event type** + **Author** over free-text search for forensic queries. 4. Export or copy JSON when opening an incident ticket so the evidence is immutable. 5. Do not confuse **Logs** with Gateway/Runtime Activity when answering “what did this API call do?” *** ## Related documentation * [Alerts](/platform/alerts) — detection findings from TrustGuard and TrustGate * [Integrations](/platform/alert-integrations) — forward alert findings to Splunk, Elastic, Sentinel, and more * [User & Roles](/platform/users) — membership and permission changes appear in Logs * [SSO Configuration](/platform/sso) — SSO and break-glass events * [SCIM Provisioning](/platform/scim) — provision and deprovision events * [Break-glass access](/platform/break-glass) — emergency password access is logged * [Security overview](/neuraltrust/security/overview) — platform security posture