Audit Logs Guide

For Admins, Security and Compliance Officers

As an Admin, Security Officer, or Compliance lead, you may need visibility into user activity within One Model to:

• Monitor system usage and changes
• Meet regulatory compliance requirements
• Investigate security breaches.

One Model now supports exportable Audit Logs in JSON format. We recommend uploading the JSON files into your Security Information and Event Management (SIEM) system or any secure platform for detailed querying and analysis. We currently do not offer search, filtering or querying capabilities within One Model for Audit Logs. 

Getting Started

Permission

Enable the Application Access permission - CanViewAuditLogs for Admins to download the Audit Log Report in Admin Reports.  

How Audit Logs Work

Scope of Tracking

The audit logging system is designed to enhance visibility into platform changes and user activity beyond what is available in Usage Statistics. The logs will include the following information: 

• Event type
• Date and Time of activity ( UTC )
• Who is performing the activity (name and person ID, and proxy if a proxy account is being used)
• A manual or automated activity
• Data before and after the activity
• Category and sub-category of activity (this is to help with searching the logs)

Sample log below:

Key Capabilities Include:

• Tracks events from the date of activation onward (no historical data prior to feature enablement).
• Collects detailed logs on specific events as listed below.
• Events are batched daily into downloadable JSON files. Partial days will be provided when logs are requested at times in-between complete days.
• Files are retrievable through the Admin Reports page. Downloads do not appear on the Export page and will be automatically deleted after 14 days.

How to Retrieve Audit Logs

• Logs are stored as JSON files and are available to download from Admin>Admin Reports for Admins with the permission CanViewAuditLogs. Learn more about Admin Reports here. 
• Please note that JSON files were selected for the first iteration of Audit Logs delivery as the preferred method of ingestion into SIEMs.
• We strongly recommend downloading the files regularly i.e. every 7 days and uploading them into your security management system for searching, filtering etc. as the older the logs and the larger the volume, the harder they will be to retrieve and may be slow to download.

Audit Log Events

Logging Now:

Coming Soon: 

What’s Coming Next

• Expanded tracking for additional system and user events.
• Integration into Data Destinations for automated log delivery.

Feedback Form

We encourage our users to complete this Feedback Form to let us know what’s working well, report any issues encountered, and share ideas for future enhancements.