Understanding the Admin audit log

Who can use this feature

• Supported on Enterprise plans

• Accessible to org admins and business admins

Maintain transparency and control with our new Admin audit log: a centralized record of all system-level activity.

Accessing the Admin audit log

To access the Admin audit log, go to Org settings > Billing & reporting > Audit log.

The Admin audit log provides admins with the information they need to track system-level activities like:

• Configuration changes

• User management updates

• Security-related activities

Understanding the Admin audit log

The Admin audit log records actions occurring in the WRITER app and via API. For a full list of events recorded, see the chart below.

Each recorded action includes key metadata, including:

• Actor (user email)

• IP address

• Product area (the part of the product in which the action occurred, e.g. style guide, settings, sign-in, etc)

• Action taken

• Result (whether the attempt was successful or not successful)

You can conduct a search to narrow down the events on display. You can search by:

• Event

• IP address

You can filter by:

• Area

• Event

• Actor (email address)

• Result (whether the attempt was successful or not successful)

You can sort by the most recent or least recent events.

Events captured in the Admin audit report

Note: the following connector types are supported: Box, GoogleDrive, Notion, OneDrive, SharePoint, Confluence, Zendesk

Configuring audit log export 

You can ingest data from our admin audit log into your SIEM of choice via S3 export, allowing you to query and integrate WRITER audit log data into your preferred platforms.

To get started, select Configure logs from the top right corner of the page.

Next, setup an S3 bucket and corresponding IAM policy on AWS. 

Enter your S3 bucket name and role name (ARN) copied from your IAM policy into your Writer settings and select Next.

Copy the ‘Role Trust Policy’. In your AWS console, navigate to IAM > Roles, ‘Trust relationships’ and then ‘Edit trust policy’ and paste the policy. 

Copy the ‘S3 Bucket Policy’. In your AWS console, navigate to your IAM policy and add this as a permission in the policy editor.

Click ‘Test & Save’ and you’ll see a successful authentication notice if configured correctly.

Frequently asked questions

Can I export the Admin audit log?

Yes, you can select the ••• menu next to the search bar to export as a CSV or an XLSX file. You can also set up S3 export as described above to automatically export log events.

How far back does the Admin audit log data extend?

The Admin audit log retains data up to 2 years and 1 month old.