Skip to main content

Audit Logs

Illumera records an immutable stream of significant platform events. Each entry captures the action, the resource it touched, the actor who performed it, a timestamp, the actor's IP address, and (where applicable) a before/after payload. This guide covers the main event stream and the security-focused view.

Browse the event stream​

The Audit Logs page is a live feed: it refreshes every 10 seconds and shows the most recent events first.

  1. Navigate to Admin → Audit Logs.
  2. Watch the Live indicator in the header — the list polls automatically. Click Refresh to pull immediately.
  3. Use the resource type pills (user, tenant, engagement, project, payment, session, person_profile, or All) to narrow the stream.
  4. Add a tenant ID filter, or a From / To date range, to scope the results. Click the × to clear active filters.
  5. Click any row to open the Event Inspector on the right, which shows full context plus the before/after JSON payload when the event recorded one.
📷 ScreenshotThe live audit-log event stream with the Event Inspector open/admin/audit-logs
Export for analysis

Click Export CSV to download the currently loaded events (up to 200 rows, respecting your active filters) for offline review or archival.

What is and isn't recorded

The audit log captures engagement lifecycle events, selected project events (visibility changes and budget-override acknowledgements — project status transitions are tracked separately in each project's status history), feature-flag updates, company/person onboarding events, culture-profile submissions, and tenant create/suspend/reactivate events. Role changes made via Admin → Users → Edit Roles currently update the database but do not write an audit-log entry.

Review security events​

The Security Events view filters the same stream down to authentication, session, and permission activity, and highlights suspicious patterns.

  1. Navigate to Admin → Audit Logs → Security (/admin/audit-logs/security).
  2. The view shows session and user events plus any action whose name contains keywords such as login, logout, auth, password, role, or permission.
  3. Use the session / user / All pills, tenant filter, and date range to narrow results.
  4. Watch for the amber warning triangle: it flags failed-authentication bursts — three or more failed attempts from the same IP within a 30-minute window.
  5. Open an event to inspect it. If an IP appears repeatedly in the current results, the inspector shows a Repeated activity notice summarizing the event count, failed attempts, and number of distinct actors.
📷 ScreenshotSecurity Events with a flagged failed-authentication burst/admin/audit-logs/security
Investigate flagged bursts

A highlighted burst from a single IP — especially across multiple actors — can indicate credential-stuffing or a brute-force attempt. Review the affected accounts and consider rotating credentials or blocking the source.