Audit Logs

Audit logs provide a comprehensive record of all significant actions performed in your Legend instance. They help you track user activity, monitor administrative changes, investigate incidents, and maintain compliance with organizational policies.

Accessing Audit Logs

To access audit logs:

Click your user menu in the top-right corner
Select Admin Panel from the dropdown
Click Audit Logs in the admin sidebar

All authenticated users can view audit logs, but only administrators can export them.

What Gets Logged

Legend automatically logs the following types of events:

Authentication Events

Login: When a user successfully authenticates
Logout: When a user explicitly logs out
Failed login: When authentication fails (invalid credentials, account locked)
Session created: When a new session is established
Session expired: When a session times out
Password changed: When a user changes their password
OIDC login: When a user authenticates through OIDC/SSO

Entity Events

Entity created: When a new landmark, person, or team is created
Entity updated: When an entity’s properties are modified
Entity deleted: When an entity is permanently removed
Entity deactivated: When an entity is deactivated (not deleted)
Entity reactivated: When a deactivated entity is reactivated
Relationship created: When a dependency, association, or ownership relationship is added
Relationship deleted: When a relationship is removed
Documentation added: When documentation is attached to an entity
Documentation updated: When documentation content is modified
Documentation deleted: When documentation is removed

Administrative Events

User created: When a new user account is created
User updated: When user properties are modified
User deactivated: When a user account is deactivated
User deleted: When a user account is permanently removed
Group created: When a new group is created
Group updated: When group properties are modified
Group deleted: When a group is removed
Group membership changed: When users are added to or removed from groups
Category created: When a new category is created
Category updated: When category properties are modified
Category deleted: When a category is removed
Tag created: When a new tag is created
Tag updated: When tag properties are modified
Tag deleted: When a tag is removed
Settings changed: When system settings are modified
Branding updated: When custom logos or favicons are uploaded
OIDC configuration changed: When OIDC settings are modified

License Events

License applied: When a license key is applied
License revoked: When a license is revoked
License renewed: When a license is renewed
License expired: When a license reaches its expiration date
Tier changed: When the license tier changes (upgrade or downgrade)

System Events

Backup created: When a database backup is created
Backup restored: When a backup is restored
Alert created: When an alert banner is created
Alert updated: When an alert is modified
Alert deleted: When an alert is removed
Link health scan triggered: When a link health scan is initiated
Link health scan completed: When a link health scan finishes

Audit Log Structure

Each audit log entry contains:

Timestamp: When the event occurred (UTC)
User: The user who performed the action (or “System” for automated actions)
Action: The type of action (e.g., “entity.created”, “user.login”)
Resource Type: The type of resource affected (e.g., “landmark”, “user”, “group”)
Resource ID: The unique identifier of the affected resource
Details: Additional context about the action (e.g., what changed, previous values)

Filtering Audit Logs

The audit log viewer provides powerful filtering options to help you find specific events:

Filter by Action Type

Select one or more action types to filter the log:

Authentication events (login, logout, failed login)
Entity events (created, updated, deleted)
Administrative events (user management, group management)
License events (applied, revoked, renewed)
System events (backups, alerts)

Filter by Resource Type

Select one or more resource types to filter the log:

Landmarks
People
Teams
Users
Groups
Categories
Tags
Settings
License

Filter by User

Enter a username or email address to show only actions performed by that user. This is useful for investigating specific user activity or auditing administrative actions.

Filter by Date Range

Select a start and end date to show only events within a specific time period. This is useful for:

Investigating incidents that occurred during a specific window
Generating reports for compliance audits
Reviewing activity during a specific project or time period

Combining Filters

You can combine multiple filters to create precise queries. For example:

Show all entity updates by a specific user in the last 7 days
Show all user account creations in a specific month
Show all license-related events in the last year

Pagination

Audit logs are paginated to handle large volumes of data efficiently. By default, 50 entries are displayed per page.

Navigation:

Use the Previous and Next buttons to navigate between pages
Use the page number dropdown to jump to a specific page
The total number of entries and current page are displayed at the top

Sorting:

By default, entries are sorted by timestamp (newest first)
Click column headers to sort by different fields (timestamp, user, action)

Retention Periods

Community 1 day retention

Starter 30 days retention

Professional 90 days retention

Business Unlimited retention

Audit log retention varies by license tier:

Community tier:

Audit logs are retained for 1 day
Older entries are automatically deleted
Limited historical visibility

Starter tier:

Audit logs are retained for 30 days
Provides a month of historical data
Suitable for most operational needs

Professional tier:

Audit logs are retained for 90 days
Provides a quarter of historical data
Suitable for organizations with extended compliance needs

Business tier:

Audit logs are retained indefinitely
No automatic deletion
Full historical record for compliance and auditing

Exporting Audit Logs

Business CSV export requires the Business tier.

Administrators on the Business tier can export audit logs to CSV format for external analysis, compliance reporting, or archival purposes.

To export audit logs:

Apply filters to select the entries you want to export
Click the Export to CSV button
The CSV file is generated and downloaded to your computer
The file includes all visible columns (timestamp, user, action, resource type, resource ID, details)

Export use cases:

Compliance audits and regulatory reporting
Integration with SIEM (Security Information and Event Management) systems
Long-term archival beyond retention periods
Custom analysis and reporting

Using Audit Logs for Incident Investigation

Audit logs are valuable for investigating security incidents, unauthorized changes, or operational issues.

Investigation workflow:

Identify the time window when the incident occurred
Filter logs by date range to narrow the search
Filter by action type (e.g., “entity.updated”, “user.login”)
Filter by user if you suspect a specific account
Review the details of each relevant entry
Look for patterns or anomalies

Common investigation scenarios:

Unauthorized entity changes:

Filter by action type: “entity.updated” or “entity.deleted”
Filter by date range: when the change was discovered
Review the user who made the change and what was modified

Suspicious login activity:

Filter by action type: “user.login” or “user.failed_login”
Filter by user: the account in question
Look for logins from unusual times or locations

Administrative action audit:

Filter by action type: “user.”, “group.”, “settings.*”
Filter by user: the administrator in question
Review all administrative actions performed

License or configuration changes:

Filter by action type: “license.” or “settings.”
Review when and by whom changes were made
Verify changes align with organizational policies

Best Practices

Regular Monitoring:

Review audit logs periodically for unusual activity
Set up alerts for critical actions (user deletions, license changes)
Monitor failed login attempts for potential security issues

Compliance:

Export audit logs regularly if retention periods are insufficient
Maintain exported logs in a secure, compliant storage system
Document your audit log review process for compliance audits

Security:

Investigate failed login attempts and suspicious activity promptly
Monitor administrative actions for unauthorized changes
Review user account creation and deletion regularly

Operational:

Use audit logs to track entity changes and understand history
Review backup and restore operations for data management
Monitor system configuration changes for troubleshooting

Troubleshooting

Cannot access audit logs:

Verify you have appropriate permissions (all users can view, only admins can export)
Check that audit logging is enabled (it’s enabled by default)
Ensure you’re accessing the correct Legend instance

Audit logs not appearing:

Verify the action you’re looking for is logged (see “What Gets Logged” above)
Check that the retention period hasn’t expired for your tier
Review the filters to ensure they’re not too restrictive

Cannot export audit logs:

Verify you have the Business tier (required for CSV export)
Ensure you have administrator privileges
Check that your browser allows file downloads
Try a different browser or disable browser extensions

Missing audit log entries:

Verify the action occurred within the retention period
Check that the action type is logged (some system actions may not be logged)
Review filters to ensure entries aren’t being filtered out
Contact Legend support if you suspect a logging issue

Next Steps

After reviewing audit logs, proceed to Backups and Recovery to protect your data, or Alert Banners to configure system-wide notifications.