Audit Logs

Audit Logs

The Logs page provides a comprehensive and immutable audit trail of all significant actions performed within the EndState CloudSec application. This is crucial for security, compliance, and troubleshooting.

Viewing Recent Activity

The main part of the page displays a table of the most recent log entries. Each entry captures key information about an event:

ColumnDescription
TimestampWhen the action occurred
UserThe email address of the user who performed the action
ActionA short, machine-readable code for the action type
DescriptionA detailed, human-readable description of the event

Logs are organization-scoped -- users can only view logs belonging to their organization.

Searching and Exporting Logs

You can easily find specific events:

  • Search -- Use the search bar to filter logs by user, action, or keywords in the description.
  • Export CSV -- Click the Export CSV button to download the currently filtered list of logs as a CSV file for offline analysis or archiving.

Action Types Reference

The system automatically logs a wide variety of events:

Profile Management

Action CodeDescription
PROFILE_CREATEA new cloud profile was created
PROFILE_UPDATEA profile's name or credentials were updated
PROFILE_DELETEA profile was permanently deleted
PROFILE_CONNECTA connection to a cloud provider was initiated
PROFILE_CONNECT_SUCCESSCloud provider connection succeeded
PROFILE_CONNECT_FAILCloud provider connection failed
PROFILE_SYNCResource re-sync was triggered

Resource Discovery

Action CodeDescription
RESOURCE_DISCOVERY_STARTResource discovery process initiated
RESOURCE_DISCOVERY_COMPLETEDiscovery finished with count of resources found

Zone and Flow Management

Action CodeDescription
ZONE_CREATEA new security zone was created
ZONE_UPDATEA zone's configuration was modified
ZONE_DELETEA zone was deleted
FLOW_CREATEA new data flow was defined
FLOW_UPDATEA flow's protocol was changed
FLOW_DELETEA data flow was removed
RESOURCE_ASSIGNA resource was moved between zones

Deployment

Action CodeDescription
DEPLOYMENT_PLANA deployment plan was generated
DEPLOYMENT_PREPAREDeployment actions were translated for cloud providers
DEPLOYMENT_EXECUTEDeployment execution started
DEPLOYMENT_SUCCESSAn individual deployment action succeeded
DEPLOYMENT_FAILAn individual deployment action failed

Validation

Action CodeDescription
VALIDATION_STARTA validation check was initiated
VALIDATION_PASSA validation check passed
VALIDATION_FAILA validation check failed with details

System

Action CodeDescription
LOG_CONFIG_UPDATELog upload configuration was changed
USER_LOGINUser authenticated successfully
MEMBER_INVITEA new team member was invited
MEMBER_REMOVEA team member was removed

Log Upload Configuration

For long-term storage and compliance, you can configure the application to automatically upload audit logs to an object storage bucket.

  1. Storage URL -- Enter the URL for your object storage bucket (e.g., s3://your-bucket-name/logs/ or similar for GCS or Azure Blob Storage).
  2. Frequency -- Choose how often logs are uploaded:
FrequencyDescription
hourlyUpload every hour
dailyUpload once per day (recommended)
weeklyUpload once per week
monthlyUpload once per month
  1. Click Save Configuration.

Log upload configuration changes are themselves logged, creating a tamper-evident audit trail. This is important for compliance frameworks like SOC 2 and PCI-DSS.