Skip to main content

Audit Log Export

Audit Log Export delivers your organization's audit and conversation activity to your own systems once an hour, ready for ingestion into a SIEM or long-term archive.

Available on Enterprise plans. Configure it under Setting and Permissions → Audit Logs. Organization administrators only.

Destinations​

Each delivery is a single JSON file covering the previous clock hour, sent to one destination. Settings for the others are kept if you switch.

  • Abacus.AI managed storage: Retained by Abacus.AI and replayable by support, following your retention policy
  • Cloud storage bucket: Written to your own s3://, gs:// or azure:// bucket
  • Splunk: Delivered to a Splunk HEC endpoint, with optional index and sourcetype
  • Email: Sent as a JSON attachment to the addresses you list

Up to 24 hours of history can be re-delivered on request.

What is included​

  • Administrative actions: Member and permission changes, administrator grants, API keys, secrets, connectors, and organization settings
  • Sign-ins: Successful logins, with the acting user and IP address
  • Conversation lifecycle: Conversations created and deleted
  • Conversation activity: Each assistant turn, with the user, app and model
  • Project activity: ChatLLM projects created

Record format​

Every event shares the same envelope.

FieldDescription
requestIdIdentifier for the event
userId / userEmailActing user — the id is hashed, the email is not
timestampWhen it occurred, in UTC
requestSource.ipAddressOriginating IP address, where available
externalServiceActionsWhat was done: actionType, actionSource and actionTargets
{
  "requestId": "370903830",
  "userId": "a1b2c3d4e",
  "userEmail": "admin@example.com",
  "timestamp": "2026-08-05 09:41:02+00:00",
  "requestSource": { "ipAddress": "203.0.113.24" },
  "externalServiceActions": [
    {
      "serviceName": "platform",
      "actionType": "modify",
      "actionSource": "ui",
      "actionTargets": ["Organizations: fcab0fe08"]
    }
  ]
}

actionType is one of create, modify, delete, start, stop, share, hide or login. actionSource is the interface used: ui, api, cli or system.

Object ids are hashed. They stay consistent across exports, so the same object remains recognisable over time. Credential values are never exported — only the fact that a credential changed.

What is not included​

  • Failed sign-in attempts. Only successful logins are recorded
  • Sign-out events
  • Change detail. An administrative change is recorded as modify on the object; the specific setting and its previous value are not currently included
  • Read access. The export records changes, not views

FAQs​

Why is a delivery empty? No qualifying events occurred in that hour. Empty files are expected during quiet periods.

Can a missed hour be re-sent? Yes, up to 24 hours back. Contact support with the window you need.

Is ordering guaranteed within a file? No. Records are grouped by hour — use timestamp rather than file order.