Audit Log

Audit Log collects, stores, and displays security-related events within a Cube Cloud account, across all deployments. You can use it to maintain and review a historical record of activity for compliance purposes. Read below about collected events. Also, see how you can enable Audit Log, view events, and download them.

​

Configuration

To enable Audit Log, navigate to the Team & Security page, open the Audit Log tab, and turn the Enable Audit Log switch on.

​

Viewing events

​

Table view

Audit Log displays events in a table with the following information for each event:

• Event timestamp in your local time zone.
• User email, if applicable to a particular event.
• Event name (see event types for the full list).
• Deployment name, if applicable to a particular event.

​

Extended view

You can click on any event to view extended information:

• IP address from which an event was initiated.
• Event-specific attributes.

​

Sanitization

Audit Log uses heuristics to detect sensitive values (e.g., passwords and tokens) and sanitize them, i.e., replace them with [HIDDEN] in event-specific attributes. You can see that a password was sanitized on the screenshot above. If you’d like your custom environment variable to be sanitized, include one of the following substrings in its name: PASS, SECRET, TOKEN, KEY.

​

Filters

You can also customize the table view with filters on the top and in the right sidebar:

• Text input for full-text search.
• Date range filter.
• Filters to narrow the view down to a specific user, event, or deployment.

​

Downloading events

You can use the ↓ CSV button to download a CSV file with all events in the current view:

​

Exporting events via API

You can also export audit log events as a CSV file programmatically using the /api/v1/audit-logs/export endpoint of the Control Plane API. This is useful for integrating with external log aggregation or SIEM tools.

​

Event types

Audit Log collects the following types of events: