Access and explore audit logs (Beta)
This functionality is part of a premium beta feature that’s subject to quick, iterative changes. As a result, the latest product version may differ from the contents of this document.
Sigma's audit log feature is facilitated by a Sigma-managed connection that provides data related to user-initiated events that occur within your Sigma organization. Access the audit log to troubleshoot issues or monitor user activity for security and compliance purposes. You can also explore the audit log in a workbook to analyze how users across your organization utilize Sigma.
This document explains how to access the Sigma Audit Logs connection and open the data in a workbook. For more information about audit logging with Sigma, see the following:
- Enable audit logging
- Audit log events and metadata
- Create an audit logs storage integration
- Export audit log data to cloud storage
User requirements
By default, the Sigma Audit Logs connection is accessible to Admin users only. If you're assigned a different account type, you must be granted access in the connection's Permission tab.
Access and explore the audit log
-
Go to your Home page.
-
In the navigation menu, select the Sigma Audit Logs connection.
If your organization has more than three connections, Sigma consolidates them in a Connections page. In the navigation menu, first click Connections to open the page, then select the Sigma Audit Logs connection.
-
In the connection browser, select the AUDIT_LOGS table to view all audit log entries.
Real-time user events may take several minutes to appear in the audit log.
-
To open the audit log data in a workbook, click Explore in the connection header.
A new workbook opens with an AUDIT_LOGS table containing all entries and metadata. You can now explore, analyze, and share audit log data as needed.
Frequently Asked Questions
How much historical data is stored in the audit log?
The audit log begins logging event entries when the Sigma Audit Log connection is enabled for your organization. Entries are then stored for 30 days.
My organization just enabled the audit log, but we want data from the past several months. Can the audit log retroactively record events that predate enablement?
No, the audit log can only reflect events that occur after the Sigma Audit Log connection is enabled.
My business requires more than 30 days of audit log data. Can it be customized to store entries for a longer period of time?
No, the audit log can currently store entries for 30 days only. If you need to retain entries for an extended period of time, we recommend saving the AUDIT_LOGS table as a workbook and scheduling exports to a cloud-based storage service. For information about the prerequisites to exporting your audit log data as a workbook, see Workbook export to cloud storage.
Updated 3 months ago