Audit log

Overview⁠

The audit log is a record of the changes and sensitive reads that happen in your workspace. It shows who changed a member's role, who opened a candidate's file, who added an IP network to the allowlist, and many more events like these.

Events are append-only. Nobody in the workspace can edit or delete one.

Who can use it⁠

The audit log is available on the Enterprise plan. On that plan, every workspace admin can open it, filter it and export it, and so can the workspace owner. A member who is not an admin cannot open the page.

Open it from Settings → Audit log, in the Administration section of the settings sidebar.

On any other plan, an admin who opens the page sees Audit log is available on Enterprise, with a View Enterprise button that takes you to the plans page.

What Attia records⁠

Attia records changes to members, teams, jobs, candidates, applications and workspace settings, along with reads of sensitive candidate data. Some examples of what you will see in the Event column:

• Viewed candidate profile and Accessed candidate file
• Changed member role and Removed member
• Created team and Changed team visibility
• Changed job status and Changed application status
• Created API key and Revoked API key
• Blocked by IP allowlist, when someone outside your allowed IPs tries to get in
• Exported audit log, each time an admin exports from the Export button

Each row shows these columns:

• Time: when the event happened.
• Actor: the person who did it. An event with no person behind it shows System. A person who has since left the workspace is marked Former member.
• Event: what happened.
• Target: the kind of object it happened to, such as a candidate, a team or a workspace setting.
• Summary: the object and the change, in a short line.
• Source: Admin action, System, Webhook, Signed URL or Access denial.

How long events are kept⁠

Attia keeps each event for two years from the time it happened, then deletes it.

IP addresses go sooner. After 90 days, Attia removes the IP address from a Blocked by IP allowlist event and the IP network from an allowlist event. The rest of the event stays for the full two years.

Find an event⁠

Built-in views⁠

The tabs above the table are seven views you cannot rename or delete:

• All events: everything.
• Security: changes to the IP allowlist.
• Members: workspace members joining, leaving and changing role.
• Candidates: candidates, applications, candidate files and profile access.
• Teams: changes to teams.
• Workspace: the workspace itself and its settings.
• System: activity on the audit log itself, such as exports.

Filters⁠

Filter the table by Time, Actor, Target and Source. A filter on Time narrows the list to a date range.

The Event filter appears once you filter Target to exactly one type. It then lists the events that type can have, so you can look for one kind of change, for example Changed team visibility on teams.

Save a view⁠

Once the filters show what you want, save them as a view. Attia asks Where should this view live? and offers three choices:

• Just for me: only you see it.
• Everyone in this workspace: every admin who opens the audit log can apply it.
• A team: one of the teams you are a member of.

You cannot change where a view lives after you save it.

Event details⁠

Click a row to open Event details. It shows the actor, the event, the target, its source and the exact time. An event that changed an object can also have Change details, with the old and new values or the list of Changed fields.

Under Advanced metadata, Show raw metadata reveals the event's own record, and Copy event ID copies its ID for a support request. Where the target still exists, View target opens it.

The page address changes to point at the open event. Send that link to another admin and it opens on the same event.

Export the audit log⁠

Use Export in the top right of the page.

1. Pick a format: CSV (.csv) or Excel (.xlsx).
2. Decide whether to tick Include PII (IP addresses, raw values). Leave it off and the file leaves out IP addresses, IP networks and identity provider user IDs.
3. Choose Download.

The export takes every filter you have set, so the file holds the events the list shows. That includes Event, Source and an is not filter.

Every export from this button adds an Exported audit log event to the audit log, with the number of rows, the date range, the Actor and Target filters, and whether PII was included. With an Event, Source or is not filter on, that number is the count before those filters, so it can be higher than the number of rows in the file. This happens whether or not you tick Include PII.

One export holds at most 50,000 events. When your filters match more, the export panel says Too many events and Download is turned off. Narrow the date range and split the export into parts, or use Contact support for a larger export. With an Event, Source or is not filter on, the limit applies to the events in the date range and the Actor and Target filters, before the other filters. If that is 50,000 events or more, the export stops with a message and no file is made. Narrow the date range and try again.

The file has one row per event, with these columns: occurred_at, actor_workspace_member_id, actor_display_name, actor_primary_email, actor_member_status, entity_type, action, entity_id, metadata and id. The actor's email address is always included. The event details are in the metadata column as JSON.

Export only some events⁠

Select rows in the table, then choose Export in the bar that appears. Pick CSV or Excel and choose Download. Attia builds this file from the rows on your screen, so it has no PII choice and does not add an Exported audit log event.