WitnessAI Documentation
List
Start Here
Start Here
Analytics
Analytics
Conversations
Conversations
Users
Users
Alerts
Alerts
Policy
Policy
Administration
Administration
Apps & Resources
Apps & Resources
Release Notes
Release Notes
Administrator Guide
Administrator Guide
Audit Logs
Audit Logs capture WitnessAI object creations, deletions, updates, and User logins. Full details of “before” and “after” are included.
Audit logs can be viewed, searched, filtered, and exported in JSON format.
Only Users with “User Admin” roles and above can access Audit Logs. Currently this only applies to “User Admin” and “Super Admin” roles. Only “Super Admin” roles can view actions by “VIP” Users.
Navigation
Access the Audit Logs by clicking on the Administration menu or icon.
Audit Logs are below the System menu
Log Filters
Use the filters above the table to narrow the log. Select Clear Filters to reset them.
Time Range Filter
- Allows precise temporal scoping of log entries
- Multiple selection methods:
- Preset ranges (e.g., last 3 days)
- Custom date and time range selection
- Interactive update button to apply selected time range
- Supports granular filtering down to specific hours and dates
- Critical for narrowing down log investigations to specific time periods
User Filter
- Filter by user email
- Display user details including:
- Name
- Role (e.g., Super Admin)
- Email address
Action Type Filters
The Action filter limits the view to the action you choose:
- Accepted Terms
- Created
- Declined Terms
- Deleted
- Exported
- Login
- Registration
- Updated
Object Type Filters
Object Types filter restricts view to only the object type chosen.
- App Catalog
- Groups
- Lists
- Policy
- Policy Order
- User
- Witness Anywhere
Viewing Audit Logs
Columns
- User
- Action
- Accepted Terms
- Created
- Declined Terms
- Deleted
- Exported
- Login
- Registration
- Updated
- Object
- Object Type
- Status (success or failure)
- Date
- Note: Columns are currently not sortable
Detail View
- Select a row to open a detail panel with the change information
- Change visualization:
- Minus (-) indicates old value
- Plus (+) indicates new value
- Shows version numbers for tracked changes
Pagination
- Rows per page options: 25 to 250 items, in steps of 25. The default is 25.
- Total action count display
- Navigation controls between pages
Exporting Audit Logs
Selecting Logs for Export
Select Export JSON to download log entries as a JSON file.
- If you've selected rows with the checkboxes, the export contains those rows. Your selection is kept as you move between pages.
- If no rows are selected, the export contains the entries on the current page. Set your filters and go to the page you need first.
Sending Audit Logs to SIEMs
The Audit Logs feature supports forwarding to Security Information and Event Management (SIEM) systems, enabling comprehensive security monitoring and compliance reporting.
Configure Audit Log forwarding in the SIEM Settings, by clicking the checkbox next to “Include Audit Logs”.
For the schema of the forwarded events, see the Data Dictionary.
Made with Bullet