Audit log
The audit log is a permanent record of what happened in your workspace and who did it.
Who can see it
Section titled “Who can see it”Owners and admins. A technician who opens the page sees “Access restricted — audit log is visible to owners and admins only.” The same rule applies to the exports, which return a 403 response to anyone below admin.
What is recorded
Section titled “What is recorded”Every entry carries the actor, the action, a timestamp, the IP address and the entity that was affected. The log covers:
- Authentication — sign-ins, failed sign-ins, sign-ins with two-factor authentication or a passkey, email verification, passkey registration, two-factor authentication enabled or disabled, password reset requested and completed.
- Team — invitations sent, invitations accepted, role changes, members removed.
- Clients and domains — clients added, updated, archived, restored and deleted, domains added in ones or in bulk, domains updated and removed.
- Certificates and discovery — certificate scans, re-scan requests, certificates marked renewed, domain expiry checks.
- Alerts — alert rule changes and alert events.
- Billing and account — subscription changes, data export requests, erasure requests.
Actions taken by a Tidehawk support engineer inside your workspace are tagged with the session that produced them, and are also recorded separately. See How Tidehawk protects your data.
Finding an entry
Section titled “Finding an entry”Open Audit Log. You can narrow the record by:
- Period — the last 24 hours, 7 days or 30 days, or a date range you type in.
- Category — authentication, certificates, discovery, alerts, billing, account, team, PSA or configuration.
- Actor — a person, the system, or an API caller.
- Search — free text.
Entries are shown newest first, with a plain-English description of each action rather than a raw action code.
Exporting
Section titled “Exporting”Two exports are available from the top of the page.
- ↓ Export CSV downloads the entries matching your current filters, up to 5,000 rows. Use this for spreadsheets and for feeding another system.
- 🔐 Generate Evidence Report produces a tamper-evident report for a date range, covering up to 1,000 entries. Use this when a client or an auditor asks for proof that an action was performed.
The evidence report exists because audit entries are chained together: each entry is hashed with the one before it, so a row that was edited or deleted after the fact does not match the chain. The report re-verifies that chain at the moment you generate it and states the result.
How long entries are kept
Section titled “How long entries are kept”Audit entries are kept for the life of your workspace. They are not trimmed on a schedule.
If your workspace is erased, the entries that must be retained are pseudonymised first: IP addresses, user agents and identifying fields are removed, leaving only the action names and timings. Those pseudonymised rows are deleted a year later. See Data retention.