Skip to main content

Audit Logs

Audit logs allow you to view the history of all actions performed within a Lacework account so you know who made changes to the system and when. For example, you can see who suppressed certain alerts, what time an authentication setting was modified, etc.

To view audit logs, navigate to Settings > Usage > Audit logs.

Use the drop-down in the top right corner to select a timeframe for the audit logs you want to display. Note the following information about what each time range option displays:

  • Last Hour - Actions performed in the last hour.
    For example, the current time is 3:45 PM, and you select Last Hour. The audit log displays actions performed between 2:45 PM and 3:45 PM.

  • Last 24 Hours - Actions performed in the last 24 hours.
    For example, the current time is 3:45 PM on Tuesday, and you select Last 24 Hours. The audit log displays actions performed between Monday 3:45 PM and Tuesday 3:45 PM.

  • Last 7 Days - Actions performed from 7 days ago to 12:00 AM of the current day.
    For example, the current time is 3:45 PM on Tuesday, and you select Last 7 Days. The audit log displays actions performed between the previous Tuesday 12:00 AM and the current Tuesday 12:00 AM.

  • Last 30 Days - Actions performed from 30 days ago to 12:00 AM of the current day.
    For example, the current time is 3:45 PM on March 6, and you select Last 30 Days. The audit log displays actions performed between the February 5 12:00 AM and March 6 12:00 AM.

Use the search function to find audit logs that contain specific strings, such as an account name or a user action.

Organization-level audit logs also contain a drop-down that allows you to display audit logs for a specific account.