Skip to content
CasePack Docs

Audit Log

The Audit Log provides a searchable, read-only timeline of all significant actions within a tenant. Every create, update, and delete operation is recorded automatically by the API.

Overview

Section titled “Overview”
  • Audit logs are tenant-scoped — you see actions in the current tenant only
  • The log is immutable — entries cannot be modified or deleted
  • Requires Owner or Admin tenant role to view
  • Gated by the auditLog feature

If your plan doesn’t include Audit Log access, you’ll see an upgrade prompt. See Licensing & Access States.

Viewing the Audit Log

Section titled “Viewing the Audit Log”
  1. Navigate to Audit Log in the sidebar
  2. Browse entries in reverse chronological order (newest first)

Columns

Section titled “Columns”
ColumnDescription
TimestampWhen the action occurred
UserWho performed the action (email or “system”)
ActionWhat was done (e.g., INCIDENT_CREATED, EVIDENCE_FINALIZED)
ResourceWhat was affected (e.g., incident title, evidence filename)

Filtering

Section titled “Filtering”
  • Search — Filter by action type, user, or resource name
  • Pagination — Navigate through pages of entries (25 per page)

Tracked Actions

Section titled “Tracked Actions”
ActionDescription
INCIDENT_CREATEDNew incident created
INCIDENT_UPDATEDIncident fields changed (title, severity, status, description)
INCIDENT_DELETEDIncident soft-deleted
EVIDENCE_INITEvidence upload initialized
EVIDENCE_FINALIZEDEvidence file uploaded
EVIDENCE_DOWNLOADEDEvidence file downloaded
EVIDENCE_DELETEDEvidence file removed
EVIDENCE_PACK_EXPORTEDEvidence pack generated
INCIDENT_CREATED_VIA_WEBHOOKWebhook delivery created an incident
WEBHOOK_CREATEDWebhook endpoint added
WEBHOOK_DISABLEDWebhook endpoint disabled
NIS2_ENABLEDNIS2 reporting enabled for an incident
MILESTONE_CREATEDNIS2 milestone created
MILESTONE_COMPLETEDNIS2 milestone marked as done
TIMELINE_EVENT_CREATEDTimeline event added
TIMELINE_EVENT_UPDATEDTimeline event changed
TIMELINE_EVENT_DELETEDTimeline event deleted
REPORT_GENERATEDIncident report generated

Audit Log in Evidence Packs

Section titled “Audit Log in Evidence Packs”

Audit log entries related to an incident are included in evidence pack exports (both PDF and ZIP formats), providing a tamper-evident trail for auditors.

Tips & Best Practices

Section titled “Tips & Best Practices”
  • Review the audit log regularly for unexpected activity
  • Use the audit log to verify incident timelines during post-mortems
  • All entries include the authenticated user — useful for accountability
  • Export evidence packs to get a snapshot of audit entries for a specific incident
  • The audit log is your compliance safety net — it’s always recording
Section titled “Related Features”