Audit Logs

You can view and export a record of all activities that are monitored by Sophos Central using the Audit Log report.

To find the Audit Log reports, go to the Logs & Reports page and select Audit Logs.

All activities for the past 7 days are shown in the Audit Log by default. You can view all activities for up to 90 days. You can export an Audit Log report containing a record of all activities.

The Audit Log lists the following for each activity:

  • Date: Date and time when the activity or change occurred.
  • Modified by: The Sophos Central Admin account that made the change or signed in.
  • Item type: The type of activity or change. For example Users and Groups were changed.
  • Item modified: What was added, changed or deleted. For example the name of a new user that was added.
  • Description: More details about the activity or change. For example a successful authentication by a Sophos Central account.
  • IP address: The IP Address from where activity or change was carried out.

You can filter the Audit Log by date range and by search results. You must click Update to apply the filters.

  • From and To: Use these options to set the date range for the activities you want to view. You can select any date within the last 90 days. The date range works with the Search field and the Audit Log shows the items related to your selected date range and search term. If you do not enter a search term the Audit Log shows all activities for your selected date range.
  • Search: There is a limited search available. The Audit Log shows the items related to your search term and the selected date range. If you do not set a date range the Audit Log shows the items related to your search term for the last 7 days, by default. You can search by:
    • IP address: Shows all changes and activity from an IP Address over the selected date range.
    • Modified By: Shows all changes and actions made by a Sophos Central account over the selected date range.

Export

You can export an Audit Log report that contains a record of activities for a selected date range or the last 90 days. You can filter the Audit Log before exporting. Search filtering applies to all export options. The date range does not.

To export an audit report:

  1. Filter the Audit Log, if required. Click Update to apply the filters to the Audit Log.
  2. Click Export on the right-hand side of the Audit Log page and choose an option from the drop-down list.
    • CSV of current view or PDF of current view: Exports the current view as a comma separated file or as a PDF file. If you select one of these options all currently selected filters are applied to the exported file.
    • CSV of past 90 days or PDF of past 90 days : Exports activities from the past 90 days as a comma separated file or as a PDF file. If you select one of these options only search filtering is applied to the exported file.
  3. Review the audit report to check that it contains the information you require.
  4. Change the audit report name.

    Audit reports are exported as audit.csv or audit.pdf.