> For the complete documentation index, see [llms.txt](https://docs.cipp.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cipp.app/user-documentation/tenant/administration/audit-logs.md).

# Audit Logs

CIPP stores a copy of any audit log entry that matches an Audit Log Alert rule, so you keep a durable record even after the entry ages out of the tenant. This page lists those saved entries and lets you open any of them in full. Entries are only captured going forward from the point an alert rule exists, so nothing appears here for a rule that has not yet matched.

## Search Options

The Search Options panel controls the time window the table covers. It defaults to the last 7 days.

| Field            | Description                                                                                               |
| ---------------- | --------------------------------------------------------------------------------------------------------- |
| Date Filter Type | Choose `Relative` to look back a set amount of time from now or `Start / End` to specify an exact window. |
| Last             | Shown for a relative filter. The number of hours or days to look back.                                    |
| Interval         | Shown for a relative filter. Whether the number above counts Hours or Days.                               |
| Start Date       | Shown for a start and end filter. The beginning of the window.                                            |
| End Date         | Shown for a start and end filter. The end of the window.                                                  |

Select **Apply Filters** to reload the table for the chosen window. Use the table's own filter and search to narrow the results further.

## Table Details

| Column    | Description                                                                                                         |
| --------- | ------------------------------------------------------------------------------------------------------------------- |
| Timestamp | When the original event occurred in the tenant, taken from the raw audit record rather than the time CIPP saved it. |
| Tenant    | The tenant the entry was captured from.                                                                             |
| Title     | A short summary of what the alert matched, generated when the entry was processed.                                  |

{% hint style="info" %}
The table respects the tenant selected at the top of CIPP. Choose All Tenants to see captured entries from every tenant in one list.
{% endhint %}

## Table Actions

<table><thead><tr><th>Action</th><th>Description</th><th data-type="checkbox">Bulk Action Available</th></tr></thead><tbody><tr><td>View Log</td><td>Opens the full structured view of the selected entry, including the raw audit record, any actions CIPP took, and geolocation for the originating IP address where one is available.</td><td>false</td></tr></tbody></table>

***

## Feature Requests / Ideas

We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.cipp.app/user-documentation/tenant/administration/audit-logs.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.