Audit Log
Track and monitor all actions and changes in your organization.
The Audit Log provides a complete record of all significant actions taken within your organization.
Why Audit Logs?
Audit logs help you:
- Track changes: See who changed what and when
- Investigate issues: Understand what happened leading up to a problem
- Compliance: Maintain records for regulatory requirements
- Security: Detect unauthorized or suspicious activity
Logged Events
The audit log captures various event types:
User Events
| Event | Description |
|---|---|
user_invited | A new user was invited to the organization |
role_changed | A user's role was modified |
user_disabled | A user's access was disabled |
Policy Events
| Event | Description |
|---|---|
policy_created | A new policy was created |
policy_updated | A policy was modified or published |
Trip Events
| Event | Description |
|---|---|
trip_submitted | A trip request was submitted |
trip_approved | A trip was approved |
trip_rejected | A trip was rejected |
Finance Events
| Event | Description |
|---|---|
cost_code_created | A new cost code was added |
export_created | Data was exported |
System Events
| Event | Description |
|---|---|
domain_verified | An email domain was verified |
settings_updated | Organization settings were changed |
Understanding Log Entries
Each log entry contains:
| Field | Description |
|---|---|
| Event | The type of action that occurred |
| Category | Grouping for the event type |
| Actor | Who performed the action (email and role) |
| Resource | What was affected (type and ID) |
| Details | Additional context as JSON payload |
| Timestamp | When the action occurred |
Reading Event Details
The Details column shows a JSON payload with event-specific information:
{
"role": "travel_admin",
"invited_email": "[email protected]",
"invited_by": "[email protected]"
}This helps you understand the full context of each action.
Filtering Logs
Search
Use the search bar to find entries by:
- Event type
- Actor email
- Resource type
- Details content
Event Type Filter
Filter to specific event types:
- Click the Filter by event dropdown
- Select an event type
- The table updates to show only matching entries
Reading the Audit Log
Identifying Patterns
Look for:
- Unusual timing: Actions outside business hours
- Bulk changes: Many similar actions in sequence
- Failed attempts: Repeated access issues
- Policy changes: Who modified what and why
Investigating Issues
To investigate a specific incident:
- Note the approximate time of the issue
- Filter or search for relevant events
- Review the actor and details
- Trace the sequence of events
Common Investigations
"Who changed the policy?"
- Filter by
policy_updated - Find the relevant timestamp
- Check the actor email
"Why was this user disabled?"
- Search for the user's email
- Find the
user_disabledevent - Check who performed the action
"What happened to this trip?"
- Search for the trip ID or traveler email
- Review all related events
- Check approval/rejection details
Audit Log Limits
- Retention: Logs are kept for the duration of your subscription
- Display: The most recent 100 entries are shown by default
- Export: Contact support for full log exports
Best Practices
Regular Review
- Weekly: Quick scan for unusual activity
- Monthly: Review policy and role changes
- Quarterly: Comprehensive security review
Access Control
- Limit who can view audit logs
- Audit log access is typically for Owners and Travel Admins
- Consider who needs visibility for compliance
Documentation
When investigating:
- Note the relevant log entries
- Document your findings
- Take action if issues are found
- Record the resolution
Compliance
For regulated industries:
- Know your log retention requirements
- Establish regular review procedures
- Document your audit review process
- Export logs periodically for archival
Security Considerations
What to Watch For
- Multiple role changes in quick succession
- Disabled users being re-enabled
- Policy changes without change notes
- Actions from unexpected email addresses
- Settings changes outside change windows
Responding to Issues
If you detect suspicious activity:
- Document what you found
- Disable any compromised accounts
- Review and revert unauthorized changes
- Contact your IT security team
- Report to Helix support if needed