Skip to main content

Review audit logs

Audit logs are immutable records of every action. They can't be edited, deleted, or cleared. Admin access only.

What gets logged

NimbusWiz records these event categories automatically:

CategoryWhat's logged
AuthenticationLogin, logout, failed login attempts
UsersInvitation sent, role changed, user removed
SystemsRegistered, updated, deleted
ScansStarted, completed (pass or fail)
DeploymentsStarted, phase completed, failed, rollback triggered
API keysGenerated, revoked
IntegrationsConnected, disconnected
AutomationPipeline created, executed, scheduled job ran
SettingsOrganization settings changed, notification preferences changed

Filter the audit log

In the sidebar, select Audit Logs. Use filters to find what you need:

FilterOptions
ActionAll Actions, Apply, Rollback, Simulate, Register, Delete
StatusAll Statuses, Success, Failed, Pending
UserAll Users, or a specific user email

Filters combine, so you can filter by Rollback and Failed status at the same time, for example.

Common compliance workflows

Change management audit: Filter by Action > Apply to see all upgrades. Review the target system, outcome, and timestamps in the Details column. Export the filtered view when that feature becomes available.

Access review: Filter by User to see one person's activity. Look for role changes or administrative actions like system deletion, API key revocation, and settings changes. Repeat for each user under review.

Incident investigation: Filter by Status > Failed or Action > Rollback to find relevant entries. Use the Details column to review failure reasons (for example, "Insufficient disk space (28.4 GB required, 21.1 GB available)."). Narrow further by Action type (such as Apply or Rollback), then review entries chronologically to identify the sequence of actions and anomalies.

API key activity: API key operations don't have their own Action filter, so filter by the User who manages API keys. Review generation and revocation entries in the log.

Data retention

note

Audit log retention isn't implemented in the prototype. In a production deployment, this section would document the retention period, archiving behavior, and any export options available before entries expire.