Filtering and Searching Activity

The log's value is entirely in being able to find the entry you want. On a working system that means filtering, not scrolling.

Where to find it

Architect Panel → Activity:

Activity Log — the console, with its filters
Record Read Log — the same approach applied to reads

What you can narrow by

Person or identity — everything one actor did.
Datastore — everything that happened to one kind of record.
Record — the full history of one thing.
Action — inserts, updates or deletes.
Time range.
IP address — everything from one origin.

Start with time, then narrow

Almost every investigation begins with a rough idea of when. Bounding the time range first cuts the volume by orders of magnitude and makes every subsequent filter fast.

Starting with a person instead is the common mistake: you get their entire history and then have to find the day in it.

Two directions of enquiry

Investigations run one of two ways, and knowing which you are doing keeps you efficient:

From the record — "what happened to this?" Filter by record and read the sequence.
From the actor — "what did this account do?" Filter by identity over a time range.

The second is the security question. A compromised or misused account is investigated by looking at everything it touched in a window, and that is exactly what an identity-plus-time filter produces.

Filter by action for deletions

"What was deleted last month" is a question the action filter answers directly, and it is worth asking periodically even when nothing is wrong. Deletions are the changes people notice last and mind most.

IP address is underused

Filtering by origin address answers questions no other filter can: whether a change came from the office, from a home connection, or from an integration's known address. It is the fastest way to distinguish "somebody used this account" from "something used this account".

Confirm the absence too

When investigating, it is as valuable to establish that an account did nothing in a window as to find what it did. An empty result over a bounded range is evidence; scrolling and not noticing anything is not.

Export what you rely on

If a log extract supports a decision — a disciplinary matter, a regulatory response, a dispute — export it at the time. Retention will eventually remove the entries, and the moment you need them again is exactly when they will have aged out.

Worked example

After a leaver's account is found to have been active for two days after their last day, the log is filtered to that identity over that window. It returns eleven entries, all reads from a single unfamiliar address and no changes. The extract is exported before anything else happens, and the investigation proceeds knowing precisely what was and was not touched.

Recommendations

Bound the time range first, every time.
Know which direction you are investigating — record or actor.
Review deletions periodically, not only after an incident.
Export anything you will rely on at the moment you find it.