Audit Logs
Audit logs allow you to view the history of all actions performed within a Lacework account so you know who made changes to the system and when. For example, you can see who suppressed certain alerts, what time an authentication setting was modified, etc.
To view audit logs, navigate to Settings > Audit logs. Click on the row for an audit log event to view the details of the event.
Timeframe Selection
Use the drop-down in the top right corner to select a timeframe for the audit logs you want to display. Note the following information about what each time range option displays:
Last Hour - Actions performed in the last hour. For example, the current time is 3:45 PM, and you select Last Hour. The audit log displays actions performed between 2:45 PM and 3:45 PM.
Last 24 Hours - Actions performed in the last 24 hours. For example, the current time is 3:45 PM on Tuesday, and you select Last 24 Hours. The audit log displays actions performed between Monday 3:45 PM and Tuesday 3:45 PM.
Last 7 Days - Actions performed from 7 days ago to 12:00 AM of the current day. For example, the current time is 3:45 PM on Tuesday, and you select Last 7 Days. The audit log displays actions performed between the previous Tuesday 12:00 AM and the current Tuesday 12:00 AM.
Last 30 Days - Actions performed from 30 days ago to 12:00 AM of the current day. For example, the current time is 3:45 PM on March 6, and you select Last 30 Days. The audit log displays actions performed between the February 5 12:00 AM and March 6 12:00 AM.
Available Actions
- Click Download to download the table in CSV format.
- Select columns to show or hide the available table columns.
- Use the Search function to find audit logs that contain specific strings, such as an account name or a user action.
Lacework Organization View
Organization-level audit logs also contain a drop-down that allows you to display audit logs for a specific account.