Audit log
What Revo records in the workspace's append-only audit log, and how to search it.
Updated
On this page
The audit log (Settings → Audit log, owners and admins) is an append-only record of what happened in your workspace and who did it. Entries can't be edited or deleted, by you or by Revo's application.
What's recorded
- Sign-ins and account changes: sign-ins, failed sign-in bursts, MFA changes and resets, password changes, invites, role and scope changes.
- Customers: created, edited, converted, archived, unarchived and deleted; domains added, verified and no longer verified.
- Assessments: requests, approvals of active scans and discovery, attestations.
- Findings: status changes, sharing (Show to customer), accepted risks with their reasons.
- Devices and agents: installer links, enrollments, edits, moves between customers, disable, enable, remove, remote uninstall, release-channel changes.
- Patching: turning patch management on or off for a customer, pause and resume, approval decisions, policy changes, Windows target approvals, safeguard overrides and unsupported-hardware upgrades.
- Agent fixes: remediation turned on or off and policy changes, who started each run (
remediation.run_started), cancellations, signed jobs and each device's result. - Ideal state: template and per-customer control changes.
- AI: approval requests, approvals and rejections, and flagged prompt-injection attempts.
- Reports: generation and downloads; scheduled report changes.
- Integrations and workspace apps: Microsoft 365, GitHub, PSA, ThreatLocker and webhook changes; API keys created and revoked.
- Support access: every grant, and every view of your data by Revo support staff. See How your data is protected.
Search it
Filter by action prefix (for example auth. for sign-ins, patching. for patch management or agent. for
devices) and by actor. Each entry shows when, who (a person, an API key, the scheduler or Revo support),
the action and its details.
Useful prefixes:
| Prefix | Covers |
|---|---|
auth. | Sign-ins, MFA, passwords |
customer. | Customer lifecycle |
domain. | Domains and verification |
agent. | Devices, installer links, commands, moves, uninstalls (agents.update_channel_set for release channels) |
patching. | Patch management, approvals, Windows upgrades |
remediation. | Agent fixes: policy, runs started and cancelled, results |
finding. | Findings and sharing |
ai. | AI approvals and actions |
integration., workspace_app. | Integrations and the workspace's Microsoft 365 and GitHub apps |
support., data_access. | Support access grants and views by Revo staff |
Related
- Device-level history is also on each device's Activity tab.
- Changes to customer security posture (what improved or regressed) are in Change history, not the audit log. See Change tracking.