Audit Logs Guide

One Model provides exportable JSON Audit Logs to help Admins, Security, and Compliance officers monitor system usage, meet regulatory requirements, and investigate security incidents.

Technical Requirement: One Model does not provide in-app searching or filtering. Logs must be ingested into your SIEM (e.g., Splunk, Sentinel, Datadog) or a secure  tool for analysis.

Getting Started

Log Availability & Retention

• Permanent Record: One Model maintains your audit history for the lifetime of your instance.
• Download Expiry: Once a log file is generated for download, that specific file remains available in the Admin Reports UI for 14 days. After 14 days, the file is deleted from the list, though the underlying data remains archived in the system.
• Recommendation: Download and ingest logs into your SIEM every 7 days to maintain a searchable local history.

Best Practices

1. Automate Ingestion: Regularly upload the daily JSON batches to your SIEM for long-term analysis and retention.
2. Stay Current: Download “partial-day” logs if you need immediate visibility between daily batches.
3. Monitor Volume: Large volumes may slow down downloads; frequent exports keep file sizes manageable.

What Is Tracked? 

Logs track activity from the moment the feature is enabled (no historical data). Each log entry includes:

• Event Type: The specific action taken.
• Timestamp: Recorded in UTC. 
• Actor: Name and Person ID (including proxy users). May appear “Unidentified” when logging out of the system, terminating a session or pre-auth actions
• Context: IP address, Hostname, and data changes.
• Data Changes: May appear across a series of logs to reflect each itemised event. 
• Method: Distinguishes between manual and automated activity.

Sample log below:

Audit Log Events: 

Coming Soon: 

• Integration into Data Destinations (or similar) for automated log delivery.
• Expanded tracking for additional system and user events.

Feedback Form

We encourage our users to complete this Feedback Form to let us know what’s working well, report any issues encountered, and share ideas for future enhancements.

Troubleshooting & FAQs

Common Troubleshooting Scenarios

• Missing Logs for a Specific Date:
  • Audit logging only captures activity from the moment the feature was enabled. Historical data prior to activation is not available.
• "Unidentified" Actor in the Log:
  • This typically occurs during Logouts or session timeouts, where the user's active session has ended before the event is finalized. It can also appear for pre-authentication events like hitting the login page.
• Download is Slow or Times Out:
  • High-traffic instances generate very large JSON files. Try downloading logs in smaller increments (e.g., daily instead of weekly) or during off-peak hours to reduce the load.
• Missing "Changes" Data:
  • Not all events have "Before/After" states (e.g., a "View" event or a "Login"). In these cases, the Changes block will be empty {}.

Frequently Asked Questions

Q: I missed the 14-day download window. Is the data gone?

A: No. The data is stored permanently for the life of your instance. However, the pre-generated file is removed from the Admin Reports page to keep the interface clean. You can retrieve data older than 14 days that wasn't downloaded by using the date picker in the Audit Logs download window.

Q: Why use JSON instead of CSV?

A: Audit data is often "nested" (e.g., one event might change five different permissions). JSON handles this complex data structure much more reliably than a flat CSV, making it the industry standard for ingestion into SIEM tools like Splunk or LogRhythm.

Q: Can I automate the download process?

A: Currently, downloads are manual via the Admin Reports page. Automated delivery to Data Destinations is on our active roadmap to allow for seamless "push" integration into your security stack.

Q: Does "Success" in the Result field mean the data was correct?

A: "Success" means the system successfully processed the request (e.g., a role was updated). It does not validate the intent—security officers should still review "Success" logs for unauthorized but technically valid changes.

Q: Are Storyboard views tracked?

A: Yes, Storyboards Viewed is included in the logs, allowing you to audit who is accessing specific sensitive storyboards.