Filter events
On the Audit logs screen, narrow events with search, time range, and the sensitive filter. For where each element is, see the numbered annotations in View audit logs (search·period = No. 2, summary·trend = No. 3).
Search (No. 2-1)
Filter by the following attributes in the search box, combining multiple conditions. Applied filters appear as tags you can remove individually or all at once.
| Filter | Method |
|---|---|
| Actor (TPN) · Target (TRN) · Actor IP | Text input (IP supports CIDR/wildcard) |
| Action · action verb (create/read/update/delete, etc.) | Select |
| Result (Success / Fail / Denied) · Service · Compliance labels | Select |
- You can also type
key:valuedirectly in the query bar. - Keyword search targets the action, actor ID/name, target ID/name, and reason fields.
- Reset: removes all filters and returns to a 24h range with the sensitive toggle off.
Period (No. 2-2)
Pick a preset among 30m · 1h · 6h · 24h · 7d · 30d, or set start/end times directly with Period. The summary stats, trend chart, and list all refresh to match the selected range.
Sensitive only (No. 3-2)
Turning on the Sensitive only toggle in the summary area shows only sensitive events such as sensitive-resource access. Prioritize Failure and sensitive events during security investigations.