> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ultra.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Admin Log

> Security event log for administrative actions

The Admin Log captures security-relevant events across your organization. It provides an audit trail for compliance and incident investigation.

<Note>
  The Admin Log is restricted to users with **Admin** or **Owner** roles. See [Roles & Permissions](/hub/rbac) for details.
</Note>

## Events Tracked

The Admin Log captures the following categories of events:

### Member Management

* Member invited to organization
* Member accepted invitation
* Member invitation revoked
* Member removed from organization
* Member role changed

### Authentication

* Successful login attempts
* Failed login attempts
* Account lockout events

### Organization & Structure

* Organization settings changed
* Team created, updated, or deleted
* Workspace created, updated, or deleted

### Gateway Lifecycle

* Gateway registered
* Gateway linked to workspace
* Gateway unlinked from workspace
* Gateway archived
* Diagnostics report uploaded (manual [`ultra doctor --report`](/cli/doctor) only)

### Guardrail Configuration

* Guardrail created (custom guardrails)
* Guardrail updated (enforcement mode or configuration changed)
* Guardrail deleted (custom guardrails)
* Guardrail enabled
* Guardrail disabled

Creating, deleting, or disabling a security control is logged at **warning** severity to ensure visibility when protection is removed. Enabling or updating a guardrail is logged at **info** severity.

Each guardrail event includes metadata describing what changed:

| Field                         | Description                                                                       |
| ----------------------------- | --------------------------------------------------------------------------------- |
| **Guardrail slug**            | Human-readable identifier (e.g., `credential-protection`)                         |
| **Category**                  | `builtin` or `custom`                                                             |
| **Enforcement mode**          | The post-change mode (`block`, `alert`, `monitor`, or `redact`)                   |
| **Previous enforcement mode** | The pre-change mode, included only when the mode changed                          |
| **Scope**                     | The level at which the guardrail is configured (`org`, `workspace`, or `gateway`) |

## Event Details

Each event in the Admin Log records:

| Field          | Description                                                           |
| -------------- | --------------------------------------------------------------------- |
| **Actor**      | The user who performed the action (name and email)                    |
| **Target**     | The entity affected by the action (user, team, workspace, or gateway) |
| **Action**     | What was done (e.g., "member.invited", "role.changed")                |
| **Timestamp**  | When the event occurred (UTC)                                         |
| **IP Address** | The IP address of the actor                                           |

## Identity attribution

Audit and trace entries in the Hub dashboard surface the user behind each event with three visual cues. The full attribution model is documented on the [Identities](/hub/identities) page.

* **Assurance dot** — a small coloured dot next to the user's name indicates how the event was attributed.
  * **Green** (`authenticated`) — performed by a logged-in user with an active session.
  * **Amber** (`gateway`) — attributed via the gateway's registered owner rather than a session. Typical for unauthenticated stdio traffic on a personal gateway.
  * **Grey** — no identity could be attributed.
* **Role chip** — shows the user's organization role (`owner`, `admin`, `member`, or `viewer`) when known.
* **Non-member badge** — appears when an event is attributed to a user who is not a current member of the organization. Use this to spot activity from offboarded employees or external identities that were never granted membership.

Clicking the user's name in any drawer opens their identity detail page, which shows aggregate activity, peak hours, and any anomaly findings for that identity.

## Viewing the Admin Log

The Admin Log is accessible from the Hub web interface:

1. Navigate to your organization in Hub
2. Select **Admin Log** from the sidebar
3. Browse events chronologically (newest first)

Events can be filtered by action type, actor, target, and time range.