Audit Log - Cloosphere Guide

Admin › Monitoring › Audit Logs

The Audit Log chronologically records all major activities in the system.

Transparently track who, when, what, and how — meeting security audit and compliance requirements.

Audit Log main screen — filter area, log table

Audit Log is a licensed feature. Requires a license with audit_log feature enabled.

Recorded Activities

Action Types

Core actions

Action	Description
CREATE	Resource creation
UPDATE	Resource modification
DELETE	Resource deletion
ACCESS_CONTROL_CHANGE	Resource access permission change
PERMISSION_CHANGE	Group feature permission change
MEMBER_ADD	Group/organization member addition
MEMBER_REMOVE	Group/organization member removal
ROLE_CHANGE	User role change
SETTINGS_CHANGE	System setting change
LOGIN / LOGOUT / LOGIN_FAILED	Sign in · Sign out · Sign-in failure
API_KEY_CREATED / API_KEY_DELETED	API key issuance · revocation
GUEST_SESSION	Embed widget guest session start

Integration actions (Google Workspace · DbSphere)

Action	Description
GMAIL_SEND	Send Gmail
CALENDAR_CREATE_EVENT	Create calendar event
DRIVE_CREATE_DOC	Create Google Drive document
SQL_FAILED	DbSphere SQL execution failure

Integration feature usage is also audited, and failure events are recorded in *_FAILED form (e.g., DRIVE_CREATE_DOC_FAILED).

Resource Types

Resource	Auto-tracked	Description
model	✅	AI model
knowledge	✅	Knowledge Base
dbsphere	✅	Database connection
glossary	✅	Glossary
prompt	✅	Prompt
tool	✅	Tool
user	✅	User
organization	✅	Organization
organizational_unit	✅	Organizational unit
group	✅	Group
agent	⚠️	Agent — only explicit logging calls are recorded (no auto-tracking)
chat	⚠️	Chat — only explicit logging calls are recorded (no auto-tracking)
admin_settings	⚠️	Admin settings change — explicit logging with `SETTINGS_CHANGE` action
auth	⚠️	Auth events — LOGIN/LOGOUT/LOGIN_FAILED auto, others explicit
memory	⚠️	Memory — only explicit logging calls are recorded
embed_widget	⚠️	Embed widget guest session — auto with `GUEST_SESSION` action
knowledge_graph	⚠️	Knowledge graph — recorded only via explicit logging calls
gmail_message	⚠️	Gmail send (Google Workspace)
calendar_event	⚠️	Calendar event (Google Workspace)
drive_document	⚠️	Google Drive document (Google Workspace)

✅ marked resources are auto-recorded in the audit log on DB changes. ⚠️ marked resources are recorded only at points where the backend explicitly calls logging — some events are auto (LOGIN/LOGOUT/LOGIN_FAILED for auth, GUEST_SESSION for guest, SETTINGS_CHANGE for settings), but general CRUD on agent/chat/memory isn’t auto-tracked.READ is not logged separately (for performance).

Log Entry Structure

Each audit log entry includes:

Field	Description
Timestamp	Event occurrence time
User	Activity actor (name, email)
Action	Performed action (CREATE, UPDATE, etc.)
Resource type	Target resource type
Resource ID	Target resource identifier
Resource name	Target resource name
IP	Source IP of the request
Before state	Pre-change values (JSON)
After state	Post-change values (JSON)
Changed fields	List of changed fields
Permission change details	Access permission change details (when applicable)

Viewing Logs

Filter	Description
Time range	Start/end date range (Unix timestamp)
Resource type	model, knowledge, user, etc.
Action	CREATE, UPDATE, DELETE, LOGIN, etc.
User	Search by user name
Organization	Specific organization ID
Resource ID	Track changes to a specific resource

Log Detail View

Click a log entry to see details in a modal.

Audit Log detail modal — Audit Log detail — before/after, request path, metadata

Information shown:

Full request metadata
Before/after state comparison (JSON diff)
Highlighted changed fields
Detailed access control changes for permission changes

Statistics

The top of the audit log screen shows the total number of audit log entries.

Combine the resource type and action filters to analyze activity distribution from the perspectives below.

Statistic	Description
Action distribution	Count by action (CREATE, UPDATE, DELETE, etc.)
Resource type distribution	Count by resource (model, user, chat, etc.)
Total count	Total audit log entries in the period

Use Cases

Security Incident Investigation

In the Audit Log tab, set the time range around the incident
Filter by relevant user or resource type
Review activity history chronologically
Verify changes via detail view
Preserve detailed logs as evidence

Compliance Audit

Periodically (monthly/quarterly) review audit log statistics
Review permission change logs to detect unauthorized access
Track setting change history to verify policy compliance
Compose audit reports based on audit logs

Anomaly Detection

Mass resource deletion outside business hours
Repeated permission changes in short periods
Abnormal sign-in failure patterns
Admin permission escalation

Best Practices

The system auto-records audit logs. There’s no feature to delete or modify audit logs themselves — this preserves the integrity of the records.

Periodic review: Review audit logs at least monthly to detect anomaly patterns
Long-term retention: Per compliance requirements, retain for at least 1 year
Backup: Regularly back up audit log data to external storage
Notification integration: Configure alerts for important events (permission changes, mass deletions)

​Recorded Activities

​Action Types

​Resource Types

​Log Entry Structure

​Viewing Logs

​Filter Options

​Log Detail View

​Statistics

​Use Cases

​Best Practices

Recorded Activities

Action Types

Resource Types

Log Entry Structure

Viewing Logs

Filter Options

Log Detail View

Statistics

Use Cases

Best Practices