Access and explore audit logs

Sigma provides audit logs with a Sigma-managed connection that provides data related to user-initiated events that occur within your Sigma organization. Access the audit log to troubleshoot issues or monitor user activity for security and compliance purposes. You can also explore the audit log in a workbook to analyze how users across your organization use Sigma.

This document explains how to access the Sigma Audit Logs connection and open the data in a workbook. For more information about audit logging with Sigma, see the following:

• Enable or disable audit logging
• Audit log events and metadata
• Create an audit logs storage integration
• Export audit log data to cloud storage

User requirements

By default, the Sigma Audit Logs connection is accessible to Admin users only. If you're assigned a different account type, you or your team must be granted access to the Sigma Audit Logs connection. See Manage access to data and connections for instructions.

Access and explore the audit log

1. Go to your Home page.

2. In the navigation menu, select the Sigma Audit Logs connection.

   If your organization has more than three connections, Sigma consolidates them in a Connections page. In the navigation menu, first click Connections to open the page, then select the Sigma Audit Logs connection.

   

3. In the connection browser, select the AUDIT_LOGS table or the SIGMA_SHARED schema and tables to view all audit log entries. For a complete list of tables and schemas, see Audit log events and metadata.

   🚧

   Events can take can take up to 2 hours to appear in the audit log.

   The following screenshot obscures sensitive data available in the audit logs.

   

4. To open the audit log data in a workbook, click Explore.

   A new workbook opens with an AUDIT_LOGS table containing all entries and metadata. You can now explore, analyze, and share audit log data as needed.

Service level indicators

• Freshness: Fresh event data is available within an hour 99.9% of the time.
• Delivery: New audit log events are available at least once 99.9% of the time.

Data availability

The audit log begins logging event entries when the Sigma Audit Log connection is enabled for your organization. Entries are then stored for 30 days. Data from before the date that the Sigma Audit Log connection is enabled is not available.

If you want to store more than 30 days of audit log data, Sigma recommends saving the AUDIT_LOGS table as a workbook and scheduling exports to a cloud-based storage service. When you do, select the checkbox to Prefix file name with the current date and time to ensure each point-in-time record is saved as a new file.

For more details about exporting your audit log data, see Export audit log data to cloud storage or the section about Exporting Audit Log Data in the Audit Logging QuickStart.