Logs

Both pages are strictly read-only. There is no create, edit or delete anywhere in this chapter — only viewing, filtering and export.

Part 1 — Audit Log

What you can do here

• As a security auditor, I want to see every key operation in the tenant, so that I can trace what happened.
• As a security auditor, I want to know exactly who performed each action, so that responsibility is clear.
• As a security auditor, I want the full detail of one entry, so that I have evidence, not a summary.
• As a security auditor, I want to narrow the log to a specific event, so that I am not reading noise.
• As a security auditor, I want to export what I filtered, so that I can analyse or archive it offline.

1. Columns

Only five columns are shown by default — Created At, Operator, Identity, Title and Content. Type, Action, Resource, Status, IP and Duration are hidden; turn them on from the gear in the operation column header, which also lets you drag columns into a different order. The setting persists per browser.

Only Action, Resource, Status and Created At are sortable; the server accepts no other sort field.

2. Who performed the action

Every entry resolves to exactly one identity:

If the operator’s name cannot be resolved (the account has been deleted), the raw ID is shown instead of a blank.

3. Reading one entry

Select View Details on a row, or double-click the row. The dialog has three sections:

The user agent is parsed into something readable — browser, operating system, device and layout engine — with the raw string underneath. When it cannot be parsed (a curl or automation client, for example) the raw string is shown directly.

4. Filtering

For every multi-select, selecting nothing means all — there is no separate “All” option, and the control simply reads “all” while empty. Multiple values inside one filter are OR; different filters are AND.

The Action filter has one deliberate exception. Leaving it empty does not mean “every action” — it means “every action except GET”. Read traffic is noise, so it is excluded on the server by default and paging stays correct. To include reads, tick GET explicitly. The other three multi-selects behave normally.

Applying a filter resets to page 1, and all filters plus paging are written into the URL so a view can be shared or restored.

5. Paging

10 / 20 / 50 / 100 per page. The footer reads 共 {total} 筆.

6. Exporting evidence

6.1 Export everything the filter matches

1. Open the Export button in the toolbar (grouped with Filter and Refresh).
2. Confirm.

The job is queued, pages are fetched 200 at a time, and the result downloads as audit-logs-YYYY-MM-DD.csv (UTF-8 with BOM, so Excel reads Chinese correctly). Progress shows fetched / total once the first page returns. If several tabs export at the same time, one runs and the others queue.

Exported columns: created time, operator, identity, type, action, resource, resource ID, status, status code, title, content, path, IP address, duration, request ID.

6.2 Export just the rows you picked

1. Tick the checkbox on the rows you want.
2. Open Review selection (N) in the toolbar.
3. Select Export selection.

Selected rows are written straight to CSV from what is already on screen — no server round-trip. Because the log is read-only, the review dialog’s action area is empty (“no batch actions available”); export is the only thing it offers.

Anyone who can open the page can export it — no stricter permission applies.

Part 2 — Connection Log

What you can do here

• As a security auditor, I want to see every network connection, so that I can follow each session’s lifecycle.
• As a security auditor, I want to know who used which device to reach which application, so that access behaviour is legible.
• As a security auditor, I want the network path a connection took, so that I have routing evidence.
• As a security auditor, I want to export connections, so that I can build a case file.

Each row is one network connection, assembled from the authentication server’s events.

7. Columns

Only five columns are shown by default — Opened at, Member, Device, Application and Closed at. Client IP, Status and Duration are hidden; turn them on from the gear.

8. Connection statuses

A connection moves open → active → closed. While open or active it has no close time and its duration is computed live; once closed, both are final.

9. How names are resolved

Member, device and application names are resolved at query time from the current records, not from a snapshot taken when the connection happened. If the identity no longer exists — a deleted device, or a system identity — there is no name to show and the ID is displayed instead.

This is why the Include Unmapped Connections toggle exists: by default the list shows only connections whose device could be mapped. Turning it on brings back system-identity and deleted-device connections too, which is exactly the population whose names appear as IDs.

10. Filtering

Sortable fields: opened at, closed at, status, duration.

11. Reading one connection

Select View Details, or double-click the row.

The node path is the forwarding chain end to end; it is the piece of evidence you cannot get from the list view.

12. Exporting

Identical to the audit log: a toolbar Export for everything the filter matches, downloading connection-logs-YYYY-MM-DD.csv, and Export selection in the review dialog for hand-picked rows. Because the log is read-only, the review dialog offers no batch actions.

Exported columns: opened at, closed at, member, device, application, client IP, status, duration, entry node, node path (;-separated).

13. Permission summary

Both pages share the same permission. There is no stricter gate on export — anyone who can read the page can export what they can see.

Next

• Decide the requests these logs record: 06 · Approvals
• Tighten who can do what: 08 · Administrators & Roles