Audit Logs

Overview

Audit logs provide a complete record of every action taken across your organization. Every change - from domain configuration updates to team member invitations - is logged with who made it, when, and what was affected.

Audit logs are available at two levels:

• Organization-level: view activity across all teams and domains in your organization
• Team-level: view activity scoped to a specific team and its domains

Accessing Audit Logs

Organization audit logs

1. Open the dashboard and navigate to your Organization Settings
2. Select the Audit Logs tab

Team audit logs

1. Open the dashboard and navigate to your Team Settings
2. Select the Audit Logs tab

What’s logged

Every audit log entry includes:

Field	Description
Action Time	When the action occurred
Action	The type of action: created, updated, deleted, invited, reviewed, login, or issued (blocks and block overrides)
Scope	Whether the change was at the organization, team, or domain level
User	Who performed the action
Resource	The specific resource that was affected

You can expand any row to view additional metadata about the action.

Tracked actions

Audit logs cover all major actions in cside, including:

• Domain management: creating, updating, transferring, and deleting domains; managing subdomains; updating script options, blocking settings, checkout paths, and page settings
• Team & organization management: creating, updating, and deleting teams; inviting, removing, and changing roles of members; changing payment pages
• Security actions: reviewing script alerts, creating blocks and block overrides, managing script patterns, approving and revoking outbound connections
• Notification & integration setup: creating, updating, and deleting notification configs; connecting and removing integrations (Jira, Linear, etc.)
• Public API tokens: creating and revoking individual API tokens (org.api_token.create, org.api_token.revoke) and Revoke all tokens (org.api_secret.rotate)
• Device Intelligence: creating and revoking API keys; creating, updating, enabling, and deleting rulesets
• PCI DSS: creating, updating, and deleting PCI reporting configurations, generating reports, and updating auto-review settings
• Reports and exports: downloading reports (report.download) and downloading or exporting CSP reports (team.csp_reports.download, team.csp_reports.export)
• Billing: adding and removing payment methods
• Login attempts: successful and failed logins (user.login.success, user.login.failed), recorded since 14 August 2026
• User account changes: enabling/disabling MFA, regenerating backup codes, changing passwords, revoking sessions, updating settings
• Security policy: updating MFA enforcement for the organization or a team
• SSO: creating, updating, and deleting OIDC and SAML integrations

Filtering

Use the toolbar filters to narrow down the audit log:

• Time range: filter by date range
• Scope: filter by organization, team, or domain-level actions
• User: filter by one or more team members
• Subject: filter by resource type (e.g., Domain, Script Alert Review, Invitation, Block, etc.)
• Search: free-text search across resource IDs and action metadata

Permissions

Viewing audit logs requires membership in the organization or team. Organization administrators with View All Teams permissions can see logs across all teams.