Audit log
Inspect recorded events and their actors.
Step by step
- Open the log and apply the available filters.
- Check time, action type, resource identifier and actual actor.
- Open an available event detail and retain its reference for investigation.
- Continue to later pages if the event is not in the current set.
- With security-audit permission, choose List audit IP addresses. New since filters addresses first seen in retained history at or after the chosen UTC time.
- Copy an exact IP address into List actions from an IP address to investigate it. Refine the time, actor and action filters as needed.
- Audit retention shows the current policy version and latest cleanup batch. If Change audit retention is available, enter that version and 1–3650 days, review the values and confirm with your security key.