Filter Audit Logs

Attribute

Description

Example

Creation time

The date and time the audit log was created.

created_at:2020-04-05..2020-04-08

Action

The audit log action type. You can search for multiple actions at once by separating them with a vertical bar (|).

action:"Automate Playbook Executed"

action:"Send Email"|"Send Webhook"

User

The user who executed an action.

user:johndoe@example.com

user:automatebot+noreply@redcanary.co

Authentication

"Authentication Token Reset", "Authentication Token Used", "Forced Sign Out", "Login Failure", "Login Successful", "Multi Factor Auth Disabled", "Multi Factor Auth Enabled"

Automate

"Automate Action Executed", "Automate Playbook Executed", "Automate Respond Executed", "Automate Respond Trigger Matched", "Automate Respond Trigger Rejected", "Automate Scheduling Action Execution", "Automate Scheduling Action Execution For Successful Playbook", "Automate Scheduling Playbook Execution", "Automate Trigger Executed"

Integrations

"Integration Successfully Triggered", "Integration Unsuccessfully Triggered", "Send Webhook", "Send Webhook Failure"

Notifications

"Email Prepared", "Email Sent", "SMS Message Status Changed"

Security

"Endpoint Deisolated", "Endpoint Isolated", "Endpoint Isolation Status Changed", "External Alert Confirmed Threatening", "External Alert Dismissed As Not Threat", "Hash Banned", "Live Response Isolation"

User Management

"User Added", "User Destroyed", "User Invitation Accepted", "User Invitation Sent", "User Removed", "User Role Added", "User Role Removed"

Others

"Activity Monitor Created", "Activity Monitored Deleted", "Activity Monitor Updated", "Allowed Email Domains Changed", "Canary Exporter Keys Generated", "External Alert Source Sync Succeeded", "Live Response Command", "Password Reset", "Sso Login Failure", "Sso Login Successful"