Audit log
This page explains what your team's audit log records, how to search it, and how it differs from coverage reporting.
What's recorded
Every entry in the audit log is one action: who did it, what they did, what it touched, and exactly when — an absolute timestamp, not a relative one. Entries carry a monospace reference where one applies, so you can match a row back to the exact assignment or scenario involved.
The log groups activity into categories — Users, Access, Security, Billing, Data, Assignments, and Training — so a member joining your workspace, an assignment being created, and a learner starting or completing a lab all land in a category you can scan by kind. Login policy changes and seat or licence changes fall under Access, Security, and Billing as your workspace generates that activity.
Read-only, on purposeEntries can't be edited or deleted from the log itself. It's a record of what actually happened, not what got tidied up afterward.
Filter and search
A single search box matches actor, action, and target together, so typing a person's name or a lab title narrows the list the same way either time. Category pills sit above it — only the categories your workspace has actually generated appear, so an early-stage team isn't shown empty tabs for activity it hasn't produced yet.
Entries always sort newest first. There's no separate date-range picker in the log itself; for a bounded slice of time, export first and filter the spreadsheet, since the export carries every column the on-screen row does.
Retention and export
There's no fixed retention window that quietly drops old rows — entries accumulate for the life of your workspace. Export produces a CSV of whatever is currently visible, so narrow with search or a category first if you only want that slice.
// audit log export — column order
Timestamp, Category, Actor, Action, Target, Role, Reference
Audit log vs coverage reporting
The audit log and coverage reporting answer different questions from the same underlying activity. The audit log is the compliance trail: who did what, and when, one row per action, exported as CSV. Coverage reporting is the learning-progress view: how much of the OWASP Top 10 your roster actually covers, exported as a polished PDF — overall or narrowed to one framework — plus a CSV of the underlying numbers.
Reach for the audit log to answer "did this happen, and who did it." Reach for coverage reporting to answer "are we actually covered."