Audit Log - Cloosphere Guide

Admin › Monitoring › Audit Logs

The Audit Log chronologically records major resource changes along with authentication and setting changes.

Transparently track who, when, what, and how — meeting security audit and compliance requirements.

Audit Log main screen — filter area, log table

Audit Log is a licensed feature. Requires a license with audit_log feature enabled.

Recorded Activities

The audit log records major changes and access in the system by action and resource. See the tabs for the full lists.

Action types
Resource types (auto/explicit)

Core actions

Action	Description
CREATE	Resource creation
UPDATE	Resource modification
DELETE	Resource deletion
ACCESS_CONTROL_CHANGE	Resource access permission change
PERMISSION_CHANGE	Group feature permission change
MEMBER_ADD	Group/organization member addition
MEMBER_REMOVE	Group/organization member removal
ROLE_CHANGE	User role change
SETTINGS_CHANGE	System setting change
LOGIN / LOGOUT / LOGIN_FAILED	Sign in · Sign out · Sign-in failure
GUEST_SESSION	Embed widget guest session start

API key issuance and revocation are not recorded as separate actions. Those changes are kept as Update records on the User resource.

Integration actions (Google Workspace · DbSphere)

Action	Description
GMAIL_SEND	Send Gmail
CALENDAR_CREATE_EVENT	Create calendar event
DRIVE_CREATE_DOC	Create Google Drive document
SQL_PENDING	Recorded right before a DbSphere SQL execution
SQL_COMMITTED	Approved SQL executed successfully
SQL_REJECTED	User rejected the execution
SQL_FAILED	SQL execution failure (error or timeout)

Integration feature usage is also audited, and failure events are recorded in *_FAILED form (e.g., DRIVE_CREATE_DOC_FAILED).A DbSphere SQL execution leaves separate records right before execution and for its outcome, so success, rejection, and failure are all traceable.

Resource	Auto-tracked	Description
model	✅	AI model
knowledge	✅	Knowledge Base
dbsphere	✅	Database connection
glossary	✅	Glossary
prompt	✅	Prompt
tool	✅	Tool
user	✅	User
organization	✅	Organization
organizational_unit	✅	Organizational unit
group	✅	Group
admin_settings	⚠️	Admin settings change — recorded with the `SETTINGS_CHANGE` action
auth	⚠️	Auth events — sign in, sign out, sign-in failure, and embed widget guest session start are recorded here
memory	⚠️	Memory — only explicit logging calls are recorded
knowledge_graph	⚠️	Knowledge graph — recorded only via explicit logging calls
gmail_message	⚠️	Gmail send (Google Workspace)
calendar_event	⚠️	Calendar event (Google Workspace)
drive_document	⚠️	Google Drive document (Google Workspace)

✅ marked resources are recorded automatically, with no extra configuration, whenever their data changes. ⚠️ marked resources are recorded only at the specific moments the feature runs — sign in, sign out, sign-in failure, guest session start, setting changes, and integration feature usage are all recorded, but ordinary create/update/delete activity is not captured exhaustively.Ordinary list and detail lookups are not recorded, for performance. Lookups that need to be traceable for security reasons — such as reading a calendar you don’t own — are recorded as an exception.

Log Entry Structure

Each audit log entry includes:

Log entry fields

Field	Description
Timestamp	Event occurrence time
User	Activity actor (name, email)
Action	Performed action (CREATE, UPDATE, etc.)
Resource type	Target resource type
Resource ID	Target resource identifier
Resource name	Target resource name
IP address	Source IP of the request
Request path	The API path that was called
User agent	Browser or client that sent the request
Before state	Pre-change values (JSON)
After state	Post-change values (JSON)
Changed fields	List of changed fields
Access control changes	Access permission change details (when applicable)

Viewing Logs

Filter	Options
Period	Last 1 hour · 6 hours · 1 day · 7 days · 30 days · All · Custom (default last 1 hour)
Resource	Checkbox list that accepts multiple selections (all selected by default)
Action	Checkbox list that accepts multiple selections (all selected by default)
User name	Search by partial name. Paste a user ID to retrieve only that user’s records exactly

The resource and action lists show only values that actually have records. Actions and resources that have never occurred are not listed. Changing one selection also narrows the other list to match.

Log Detail View

Click a log entry to expand that row and show its details. The arrow on the right indicates the expanded state. Only one row expands at a time, and it collapses when you search or change pages.

Audit Log detail — after value, request path, user agent

Information shown:

Time, user, action, resource, IP address
Request path (API endpoint) and user agent
List of changed fields
Access permission changes (when applicable)
Before and after values (JSON, when recorded — shown not only for setting changes but also for model, knowledge, and user modifications)

Statistics

The top of the audit log screen shows the total number of audit log entries.

Combine the resource type and action filters to analyze activity distribution from the perspectives below.

Perspective	Description
Action distribution	Count by action (CREATE, UPDATE, DELETE, etc.) — select actions one at a time in the filter to read the count
Resource type distribution	Count by resource (model, user, knowledge, etc.) — select resources one at a time in the filter to read the count
Total count	Total audit log entries in the period

Use Cases

Security Incident Investigation

In the Audit Log tab, set the time range around the incident
Filter by relevant user or resource type
Review activity history chronologically
Verify changes via detail view
Preserve detailed logs as evidence

Compliance Audit

Periodically (monthly/quarterly) review audit log statistics
Review permission change logs to detect unauthorized access
Track setting change history to verify policy compliance
Compose audit reports based on audit logs

Anomaly Detection

Mass resource deletion outside business hours
Repeated permission changes in short periods
Abnormal sign-in failure patterns
Admin permission escalation

Best Practices

The system auto-records audit logs, and there is no feature to edit or delete individual records from the screen. They are, however, subject to the retention policy — set the Audit logs retention period to 1 day or more under Admin › Settings › Data Retention and records older than that are deleted at the scheduled cleanup time, or immediately via Run Cleanup Now. The default is 0 (retain forever), so nothing is deleted until you enter a value.

Periodic review: Review audit logs at least monthly to detect anomaly patterns
Long-term retention: Per compliance requirements, retain for at least 1 year — retention periods are managed in Data Retention
Backup: The audit log screen has no export feature, so keep long-term evidence through database backups
Notifications: The audit log itself has no alerting — if you need alerts for important events such as permission changes or mass deletions, handle them in an external monitoring tool

​Recorded Activities

​Log Entry Structure

​Viewing Logs

​Filter Options

​Log Detail View

​Statistics

​Use Cases

​Best Practices

Recorded Activities

Log Entry Structure

Viewing Logs

Filter Options

Log Detail View

Statistics

Use Cases

Best Practices