> ## Documentation Index
> Fetch the complete documentation index at: https://docs.monitor360.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit Logs

> Track who did what and when across your organization

## Overview

**Audit Logs** provide a chronological record of actions taken across the platform - who performed the action, what it was, and when it happened.

Go to **Administration → Logs → Audit Log**.

* **Admins** can view audit logs for **all users** in the organization
* **Users** can view audit logs for **themselves** and **their team members**
* Filter logs by **actor**, **entity type**, **action**, or **date range**
* Click **View Details** on an entry to see everything captured for that action

<img src="https://mintcdn.com/monitor360/M-OrUUQ9nhzcSjWk/images/guide/audit-logs.png?fit=max&auto=format&n=M-OrUUQ9nhzcSjWk&q=85&s=748a6911ebee572a6dd45e71b98e8445" alt="Audit logs screen" width="3824" height="2362" data-path="images/guide/audit-logs.png" />

## Actors

Each entry records who performed the action:

* **User** - a person signed in to Monitor360, or using one of their API keys
* **System** - Monitor360 itself. Currently this is the **Recurring Task Job**, which reopens a completed [recurring task](/project#tasks) for its next occurrence (logged as Project Task Updated)

## Tracked events

These are all the events Monitor360 records, grouped by entity.

### User

| Action | When it is recorded |
| - | - |
| User Created | A user is added |
| User Updated | A user's details are changed by an admin |
| User Deleted | A user is deleted |
| User Archived | A user is archived |
| User Unarchived | A user is restored from the archive |
| User Imported | Users are imported from a CSV file |
| Password Updated By Admin | An admin sets a new password for a user |
| Login Succeeded | A user signs in |
| Login Failed | A sign-in attempt fails |
| Profile Updated | A user changes their own profile |
| Password Changed | A user changes their own password |
| Password Reset Requested | A user asks for a password reset email |
| Password Reset | A user resets their password from the email link |
| Logout | A user signs out |

### MFA Method

| Action | When it is recorded |
| - | - |
| MFA Method Enrolled | A user adds an MFA method (email OTP, authenticator app, or passkey) |
| MFA Method Enabled | An MFA method is turned on |
| MFA Method Disabled | An MFA method is turned off |
| MFA Method Removed | An MFA method is removed |
| MFA Method Set Primary | An MFA method is made the primary method |
| MFA Challenge Verified | A user passes the MFA check at sign-in |
| MFA Challenge Failed | A user fails the MFA check at sign-in |
| MFA Step-Up Verified | A user passes an MFA check before a sensitive action, such as deleting a user |
| MFA Recovery Codes Generated | A user generates new MFA recovery codes |
| MFA Recovery Code Used | A user signs in with a recovery code |

### Organization

| Entity | Actions |
| - | - |
| Department | Department Created, Department Updated, Department Deleted, Department Imported |
| Designation | Designation Created, Designation Updated, Designation Deleted, Designation Imported |
| Shift | Shift Created, Shift Updated, Shift Deleted |
| Tenant | Tenant Branding Updated (logo or color), Tenant Settings Updated |

### Projects

| Entity | Actions |
| - | - |
| Project | Project Created, Project Updated, Project Deleted, Project Archived, Project Unarchived, Project Imported |
| Project Member | Project Member Added, Project Member Removed |
| Project Task | Project Task Created, Project Task Updated, Project Task Deleted |

### Tracking configuration

| Entity | Actions |
| - | - |
| Tracker Setting | Tracker Setting Global Updated, Tracker Setting User Updated, Tracker Setting Imported |
| Application Grouping Rule | Application Grouping Rule Created, Application Grouping Rule Updated, Application Grouping Rule Deleted |
| Website Grouping Rule | Website Grouping Rule Created, Website Grouping Rule Updated, Website Grouping Rule Deleted |

### Devices

| Action | When it is recorded |
| - | - |
| Tracking Device Registered | A new device registers with your workspace |
| Tracking Device Assigned | A device is assigned to a user |
| Tracking Device Unassigned | A device is unassigned from a user |
| Tracking Device Deleted | A device is deleted |
| Tracking Device Relaunch Triggered | **Re-launch App** is used on a device |
| Tracking Device Unregister Triggered | **Unregister App** is used on a device |
| Tracking Device Uninstall Triggered | **Uninstall Daemon** is used on a device |

### Connections

| Entity | Actions |
| - | - |
| API Key | API Key Created, API Key Updated, API Key Deleted, API Key Regenerated |
| Integration | Integration Added, Integration Updated, Integration Deleted, Integration Enabled Changed, Integration Users Imported, Integration Projects Imported |

### Email Reports

| Action | When it is recorded |
| - | - |
| Email Report Enabled | An [email report](/settings/email-reports) is turned on |
| Email Report Disabled | An email report is turned off |
| Email Report Updated | An email report's schedule or content is changed |
| Email Report Triggered | An email report is sent on demand with **Send now** |

<Note>
  This list of entities and actions is expected to grow as new capabilities are
  added to the platform.
</Note>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.