Audit Log

The Audit Log provides a complete, immutable record of all user actions taken within the CMDash platform. It supports compliance requirements for demonstrating that your governance processes were followed and that the platform's data has not been tampered with.

What Is Logged

Every create, update, and delete action across all platform resources is recorded. Each log entry includes:

• Timestamp — exact date and time (UTC) of the action
• Actor — the user who performed the action (email address and display name)
• Action type — what was done (Created, Updated, Deleted, Exported, Approved, Attested, etc.)
• Resource type — the type of record affected (Risk, Control, Policy, Integration, User, Alert Rule, etc.)
• Resource ID and name — the specific record that was changed
• Before value — the state of the record before the action (for update actions)
• After value — the state of the record after the action (for update actions)
• IP address — the client IP from which the action was performed
• Session ID — the session identifier, useful for correlating related actions

Actions logged include (but are not limited to):

• Risk created, modified (any field), status changed, deleted
• Compliance control status updated
• Evidence added or removed
• Policy created, version updated, submitted for review, approved, published, archived
• Policy attestation completed or reminder sent
• Integration connected, credentials updated, or disconnected
• Alert rule created, modified, or deleted
• User invited, role changed, or removed from workspace
• Report generated or exported
• Evidence package generated or downloaded
• Posture configuration thresholds modified
• Audit log exported

The Audit Log is append-only. Entries cannot be edited or deleted, including by Owners or CMDash support staff.

Filtering the Audit Log

Navigate to Settings > Audit Log. The log defaults to showing the last 30 days of activity, most recent first. Use the filter controls to narrow the view:

• Date range — select a start and end date
• User — filter to actions by a specific workspace member
• Action type — filter by action category (Created, Updated, Deleted, Approved, Exported, etc.)
• Resource type — filter to a specific type of resource (Risk, Policy, Integration, etc.)
• Resource name — free-text search for a specific record name

Filters are combinable. For example, to investigate all changes to a specific policy, filter by Resource Type = Policy and search for the policy name. To audit a specific user's activity on a given date, filter by User and Date Range.

Exporting the Audit Log

Click Export in the Audit Log toolbar to download the currently filtered view as a CSV file. The export contains all columns in the log view.

Audit log exports are themselves recorded as Audit Log entries (action: Exported, resource: Audit Log), ensuring a complete chain of custody.

Enterprise workspaces can configure automated audit log exports to an S3 bucket or SIEM via the API and webhook settings for long-term retention beyond the platform's 12-month rolling log window.