# Use the audit log

> See who did what and when in your Livespace, export the log, and stream every event to your SIEM.

The audit log keeps who did what, when and from where in your Livespace. It's append-only, and nothing can skip the log. You can search it, export it as CSV or JSON, or stream every event to your security tools.

The audit log comes with the Enterprise plan. Owners and admins open it in Settings › **Audit Log**.

## What's recorded

Events are grouped into areas, which you can filter by:

- **Sign-in**, **Single sign-on**, **Provisioning (SCIM)** and **Two-step verification**: sign-ins, failed and blocked sign-ins, sign-outs, identity provider and SCIM token changes.
- **People** and **Seats**: invitations, joins, role changes, removals and content handed over, and someone who couldn't join because every seat was taken.
- **Policies**, **Models**, **Data protection**, **Usage**, **Retention** and **Legal holds**: every setting an admin changes, and when data protection masks or blocks a message.
- **Assistant actions**: each time someone lets Dvina use an app, open a site or use the computer, or stops it.
- **Sharing**, **Data** and **Tables**: what's shared and with whom, public links, exports, and who queried a table.
- **API keys**, **Webhooks**, **Goals** and **Audit log**: keys and webhooks, goals on tasks, and changes to the log's own exports and destinations.

Each event names who did it: a member, an admin, your identity provider, Dvina or the assistant.

## Find an event

1. Open Settings and choose **Audit Log**.
2. Choose **Events**.
3. Narrow the list with **Search** (an action, a person or an address), **Area**, **Person**, **From** and **To**.
4. Choose an event to see its details: **When**, **Who**, **IP Address**, **Action**, **Target** and **Device**.

The newest events come first. Choose **Show more** to see older ones.

## Export the log

1. In **Events**, set the filters for what you want to export.
2. Choose **Export as CSV** for a spreadsheet, or **Export as JSON** for a tool.

If there are a lot of events, only the newest are exported, and Dvina tells you. Narrow the dates to export the rest. Each export is recorded in the log too.

## See who queried a table

A table's owner and the admins can see each time someone queried it. Open the table's share sheet, choose **People with access**, then **Who queried this table**. Each entry shows how many **Rows** came back and where the query came **From**: a chat, a card or an insight. See [Control which rows and columns people see](/docs/connectors/row-and-column-access).

## Send events to your SIEM

1. In Settings › **Audit Log**, under **SIEM destinations**, choose **Add Destination**.
2. Choose your SIEM, then give the destination a **Name**.
3. Fill in the **Connection** fields for your SIEM (see below), then choose **Add**.

For a webhook destination, Dvina shows a **Signing secret** once. Use it to check each request's signature.

| SIEM                          | What to enter                                                                                                                                                                                                                                            |
| ----------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Splunk**                    | Your HTTP Event Collector URL (…/services/collector/event) as the **URL**, and its token after “Splunk ” in the Authorization header under **Headers**.                                                                                                  |
| **Microsoft Sentinel**        | Create a data collection endpoint and rule for a custom table, and give an app registration the Monitoring Metrics Publisher role on the rule. Then enter the **Endpoint**, **Tenant ID**, **Client ID**, **Client secret**, **Rule ID** and **Stream**. |
| **IBM QRadar**                | Add a TLS Syslog log source with Universal LEEF, then enter its **Host** and TLS **Port**.                                                                                                                                                               |
| **Google SecOps (Chronicle)** | Create a webhook feed. Enter its endpoint URL as the **URL**, then your Google Cloud API key and the feed's secret key under **Headers**.                                                                                                                |

Dvina also has destinations for Elastic Security, CrowdStrike Falcon LogScale, Datadog, Sumo Logic, ArcSight, Exabeam, Securonix and LogRhythm, syslog servers like Wazuh or Graylog, and a **Custom webhook** for any HTTPS endpoint.

> [!NOTE]
> A destination needs a public HTTPS address or a public syslog host.

### Manage a destination

Choose a destination to see its **Status**, how many events were **Sent**, when it **Last Sent** and any **Last Error**.

- To pause it, turn off **Send Events**.
- To send events right away instead of waiting, choose **Send Now**.
- To stop sending to it, choose **Delete Destination…**.

A destination that's **Failing, retrying** keeps trying on its own.

## Related

- [Single sign-on and provisioning](/docs/teams/sso)
- [Members and roles](/docs/teams/members-and-roles)
- [Dvina for teams and companies](/docs/teams/overview)
- [Privacy and data](/docs/help/privacy-and-data)