AdministrationTalon Studio v1.0.2-beta

Audit

An append-only record of who did what and when — sign-ins, account and role changes, configuration, detections and deployments — kept for a configurable window and exportable as CSV or through the API.

What it is

Settings → Audit (/settings/audit, admin only) is the organisation's audit trail. Rows are only ever added; the one thing that removes them is the retention purge, which deletes entries older than AUDIT_LOG_RETENTION_DAYS (default 365) each time the app starts.

Each entry records the action (for example user.role_updated), a message, the actor and — where there is one — the target user, structured details, and the IP address and user agent of the request. Entries made by the system itself, such as creating the first admin, show the actor as System.

Recorded events

Actions are grouped into eleven categories, which the page filters on:

Account & security

Sign-ins and failed sign-ins; users created, role changes, disables, password and MFA resets; your own password, MFA and recovery-code changes; teams and custom roles.

Workspace & commits

Workspaces created, updated and deleted; commits and pushes; branch-policy changes; workboard cards.

Detections

Saves, edits, proposals, deprecations and restores; forks, copies and org promotions; content-pack installs.

Deployments

Releases staged, pushed, installed and rolled back.

Change requests

Approved, merged, closed, updated and recreated.

Configuration

Org settings saved; config-repo commits and reverts; SSO provider changes; log forwarding; MCP server registration; AI connections.

Threat intel

Threat feeds created, updated, deleted and synced; threat-profile changes.

Connections

SIEM connections created, updated and deleted.

Agents

Agent, skill and flow changes and runs.

SOC

Alerts dismissed or promoted (singly or in bulk); case updates and comments.

Other

API tokens created and revoked; writes and searches made through the public API; licence activations; SOC on-call and suppression rules.

Finding failed sign-ins

Failed sign-ins — a wrong password, a bad two-factor code, a disabled account — are recorded as auth.login_failed and also appear in App Logs. Search for that action name: the Status filter does not separate them today.

Filtering and export

The page loads the newest 500 events; Load older events pages further back.

Filter by free text (user, event or IP address), Status, Category and a From / To date range. Expand a row for the user agent and the entry's details.

Export CSV downloads the filtered events currently loaded in the page, with the columns createdAt, action, category, status, message, actorName, actorEmail, targetName, targetEmail, ipAddress and userAgent. Load older events first if you need them in the file.

The whole trail is also available from GET /api/v1/audit-logs: newest first, 200 rows by default and up to 2,000 per call, with since and until bounds and a cursor — pass the previous page's nextCursor until it comes back null. It needs an organisation-wide token with audit:read, a scope that requires the admin capability and an Enterprise key. See API Tokens.

Tip

If your compliance regime needs a longer trail than AUDIT_LOG_RETENTION_DAYS, raise it, or archive exports before the window rolls off — on the Community Edition by Export CSV, since the API route needs Enterprise.