What is recorded
Sign-ins and failures; every change to alerts, cases, rules, playbooks, suppressions, organizations, users and settings; every response action with its target and result; every playbook run; every report publication; every portal sign-in and ticket action; every export. Each entry carries who, what, when, on which organization, and from where.
Actions from the console, from playbooks and on the endpoint fleet all land in the same trail.
Reading it
Settings › Audit log lists entries newest first. Filter by actor, action or target with the search box.
Retention and integrity
Entries are append-only and kept for one year.