One of the most common log questions is “what did this person do?”. The activity log makes this fast — pick a user, see their timeline, drill into individual actions.
Quick Filter
In the activity log page, type the user's email or name in the actor filter. The list updates immediately.
From the User Record
Open the user's profile page and click the Activity tab. It's the same data but already scoped — useful when investigating from the user side.
Useful Sub-Filters
- By date range (default: last 30 days).
- By action verb — only updates, only deletions, etc.
- By object type — what kind of record they touched.
- By session ID — group all actions in one sign-in session.
- By IP range — actions from outside the office.
Worked Examples
- Departure review: Employee is leaving; review their last 60 days of activity to spot any data exfiltration or unusual deletes.
- Onboarding check: New starter — did they actually use the platform last week? Filter for their activity, expect a baseline of normal usage.
- Suspicious behaviour: Someone tipped off security; pull this user's activity, sort by IP, look for non-corporate IPs.
- Training gap: A support agent is making more errors than peers. Filter their activity and look for tell-tale patterns (e.g. updating records and immediately reverting).
Note: Activity log retention defaults to 1 year. Configure longer retention for compliance (some industries require 7 years), but expect log volume to grow significantly.