Access and explore audit logs (Beta)

This feature is currently in open Beta and subject to quick, iterative changes. As a result, the latest product version may differ from the contents of this document.

The Sigma Audit Log is a connection that provides data related to user-initiated events that occur within your Sigma organization. Access the audit log to troubleshoot issues or monitor user activity for security and compliance purposes. You can also explore the audit log in a workbook to analyze how users across your organization utilize Sigma.

For details about audit log event categories, types, and entry data, see Audit log events and entry data.

Contents

User requirements

Access and explore the audit log

Related resources

User requirements

By default, the Sigma Audit Logs connection is accessible to Admin users only. If you're assigned a different account type, you must be granted access in the connection's Permission tab.

Access and explore the audit log

  1. In the navigation menu, select the Sigma Audit Logs connection. If your organization has more than three connections, Sigma consolidates them in a Connections page. In the navigation menu, click Connections to open the page, then select the Sigma Audit Log connection.
  2. In the Sigma Audit Logs menu, select the AUDIT_LOGS table to view the entries.

    Real-time user events may take several minutes to appear in the audit log.

  3. To explore the audit log as a workbook, click Explore in the connection header. A new exploration opens with the the AUDIT_LOGS table available for analysis.

Frequently Asked Questions

How much historical data is stored in the audit log?

The audit log begins logging event entries when the Sigma Audit Log connection is enabled for your organization. Entries are then stored for 30 days.

My organization just enabled the audit log, but we want data from the past several months. Can the audit log retroactively record events that predate enablement?

No, the audit log can only reflect events that occur after the Sigma Audit Log connection is enabled.

My business requires more than 30 days of audit log data. Can it be customized to store entries for a longer period of time?

No, the audit log can currently store entries for 30 days only. If you need to retain entries for an extended period of time, we recommend saving the AUDIT_LOGS table as a workbook and scheduling exports to a cloud-based storage service. For information about the prerequisites to exporting your audit log data as a workbook, see Workbook export to cloud storage.

Related resources

Was this page helpful?
Yes No