The audit log keeps who did what, when and from where in your Livespace. It's append-only, and nothing can skip the log. You can search it, export it as CSV or JSON, or stream every event to your security tools.
The audit log comes with the Enterprise plan. Owners and admins open it in Settings › Audit Log.
What's recorded
Events are grouped into areas, which you can filter by:
- Sign-in, Single sign-on, Provisioning (SCIM) and Two-step verification: sign-ins, failed and blocked sign-ins, sign-outs, identity provider and SCIM token changes.
- People and Seats: invitations, joins, role changes, removals and content handed over, and someone who couldn't join because every seat was taken.
- Policies, Models, Data protection, Usage, Retention and Legal holds: every setting an admin changes, and when data protection masks or blocks a message.
- Assistant actions: each time someone lets Dvina use an app, open a site or use the computer, or stops it.
- Sharing, Data and Tables: what's shared and with whom, public links, exports, and who queried a table.
- API keys, Webhooks, Goals and Audit log: keys and webhooks, goals on tasks, and changes to the log's own exports and destinations.
Each event names who did it: a member, an admin, your identity provider, Dvina or the assistant.
Find an event
- Open Settings and choose Audit Log.
- Choose Events.
- Narrow the list with Search (an action, a person or an address), Area, Person, From and To.
- Choose an event to see its details: When, Who, IP Address, Action, Target and Device.
The newest events come first. Choose Show more to see older ones.
Export the log
- In Events, set the filters for what you want to export.
- Choose Export as CSV for a spreadsheet, or Export as JSON for a tool.
If there are a lot of events, only the newest are exported, and Dvina tells you. Narrow the dates to export the rest. Each export is recorded in the log too.
See who queried a table
A table's owner and the admins can see each time someone queried it. Open the table's share sheet, choose People with access, then Who queried this table. Each entry shows how many Rows came back and where the query came From: a chat, a card or an insight. See Control which rows and columns people see.
Send events to your SIEM
- In Settings › Audit Log, under SIEM destinations, choose Add Destination.
- Choose your SIEM, then give the destination a Name.
- Fill in the Connection fields for your SIEM (see below), then choose Add.
For a webhook destination, Dvina shows a Signing secret once. Use it to check each request's signature.
| SIEM | What to enter |
|---|---|
| Splunk | Your HTTP Event Collector URL (…/services/collector/event) as the URL, and its token after “Splunk ” in the Authorization header under Headers. |
| Microsoft Sentinel | Create a data collection endpoint and rule for a custom table, and give an app registration the Monitoring Metrics Publisher role on the rule. Then enter the Endpoint, Tenant ID, Client ID, Client secret, Rule ID and Stream. |
| IBM QRadar | Add a TLS Syslog log source with Universal LEEF, then enter its Host and TLS Port. |
| Google SecOps (Chronicle) | Create a webhook feed. Enter its endpoint URL as the URL, then your Google Cloud API key and the feed's secret key under Headers. |
Dvina also has destinations for Elastic Security, CrowdStrike Falcon LogScale, Datadog, Sumo Logic, ArcSight, Exabeam, Securonix and LogRhythm, syslog servers like Wazuh or Graylog, and a Custom webhook for any HTTPS endpoint.
Note
A destination needs a public HTTPS address or a public syslog host.
Manage a destination
Choose a destination to see its Status, how many events were Sent, when it Last Sent and any Last Error.
- To pause it, turn off Send Events.
- To send events right away instead of waiting, choose Send Now.
- To stop sending to it, choose Delete Destination….
A destination that's Failing, retrying keeps trying on its own.