The audit log
Who viewed, edited, exported or shared what. Filter it, read an event's details, and download it, for a year of history.
The audit log is your organization's record of sign-ins, views, permission changes and changes to settings, content and connections, newest first. It's in Settings, Audit log, for people with the See the audit log permission: Owners and Admins, unless you give it to a custom role.
Entries can't be edited or deleted.
Find an event
Filter the Events list by any of these. Clear filters resets them. The filters stay in the page's address, so going back finds the log as you left it, and a link to it shows someone else the same events.
| Filter | Choices |
|---|---|
| Activity | All activity, Sign-ins, Members, Invitations, Roles, Groups, Sharing, Workspaces, Domains, Connections, Goals, Websites, Halo CRM, Webhooks, Uploaded tables, Datasets, Charts, Reports, Images, API keys, Data alerts, Halo AI, AI tools, Organization, Marketplace data, Halo support, Halo staff |
| Person | Anyone, or one member |
| Resource | Anything, Reports, Websites, Listings, Businesses, Contacts, Inbox proposals, CRM sources, Datasets, Charts, Connections, Images, Workspaces, Members or Organization |
| Dates | A date range |
Each row shows the Event, Who did it, where it came From (an IP address), and When.
Read an event
Press a row to open its details: who, their email, the action, when and from where, what it was On with a link where it still exists, and Recorded with it, which holds what else was noted, such as how a view reached the report.
Who shows up
| Who | Means |
|---|---|
| A member's name | Someone in your organization, even if they've since been removed |
| Public reader | Someone reading through a public link or an embed |
| Halo | Halo itself, such as a nightly purge |
| Halo staff | One of Halo's team. Every look at your data from the Console is recorded |
If Halo's staff view Halo Data as a member, each thing they do is recorded under that member, marked By Halo staff, viewing as them.
What's recorded
Sign-ins: successes, failures, lockouts and two-factor changes.
Members: invitations, roles, suspensions, removals and undoing them, and groups.
Content: creating, editing, publishing, moving, deleting, restoring and purging, and correcting, withdrawing and restoring editions.
Views: who opened a report or a dataset, and from where.
Data: exports, and SQL run against a connection. Halo records the SQL and its row count, never the rows.
Sharing: links made, changed, rotated and turned off, and scheduled deliveries.
Settings: the organization's, and Halo AI's. A change to What Halo AI should know says Changed What Halo AI should know, without the text. Turning who's here on or off is recorded too.
Halo AI: changes people applied from Halo AI's proposals, and catalog descriptions accepted or rejected.
AI tools: tokens made and revoked, connections approved, and every data read. A read shows the person, with Through their own AI tool. See The Halo MCP server.
Views are grouped
Opening a report ten times in an hour is one event. Views are recorded once an hour for each reader and report or dataset, a few seconds after they happen, so a view may take a moment to show up.
Activity on one report or dataset
You don't need to open the whole log to see what happened to one thing. With the same permission:
A dataset's History tab has an Activity section.
A report's Versions page has one too. It's in the report's … menu.
Download it
Press Download CSV to download every event your filters match, not only the ones on screen. The file's dates are in your organization's time zone. A download holds at most the first 10,000 events, and Halo says so when it stops there. Narrow the dates and download again to get the rest.
How long it's kept
Events are kept for a year, then dropped. They outlive whatever they're about: a report in the Trash, a removed member, or even your organization closing.