Docs

Module - Security activity

Audit trails for fleet ops.

Track security events and admin activity alongside fleet operations.

  • Security activity logs auth and admin events.
  • Detections surface suspicious behavior.
  • Audit trails stay tied to the same org context.
Open security activityBrowse modules

Security activity timeline

See auth events and admin actions in one timeline.

Auth

Login visibility

Track logins and token usage.

Admin

Admin changes

Monitor role changes and policy updates.

Audit

Exportable logs

Use activity logs for compliance evidence.

Security detections

Detect suspicious activity without a separate SIEM.

Detections

Suspicious access

Detect unexpected access patterns.

Ops

Incident workflow

Tie detections into incident response.

Policy

Access policy checks

Enforce policy when detections trigger.