Audit log

Governance, Audit log is an append-only record of every sign-in, decision, push, back-out and setting change, with who did it and from where. Entries can't be edited or deleted, from the interface or the API.

Auditors, Security and administrators can read and export it.

What's recorded

Each entry has the time, the person (or System for scheduled work, done as firesight-system), the client IP address, the action, what it applies to, and details.

Area	Actions
Sign-ins	Sign-ins (with the method), failed sign-ins (with the reason), password changes, Sign out everywhere
Users	Users created and updated (roles, enabled, password reset, unlocked)
Rule requests	Created, edited, firewalls confirmed, submitted (with the chains and why), each stage approved, approved, rejected, cancelled, review opened, review stages, review approved or rejected, deployment started, simulated, each target deployed, deployment failed, backed out, back-out simulated or failed, expired, expiry failed
Approval chains	Chains created, updated, switched on or off, deleted, restored and removed for good; conditions created, updated and deleted; management domain chain assignments
Connections	Connections created, updated (never the token), deleted and synced (with counts and warnings); workspace mode overrides; offline snapshots loaded, replaced and deleted; configuration backups downloaded
Audits	Each rule audit (with counts by finding type) and each PDF report downloaded
Regions and IP addressing	Regions created, updated and deleted; pools created and deleted; networks allocated and released; firewalls moved between regions
Device health	Check now, mute and unmute, notification settings changed and tested
Settings	Every setting changed (old and new value), sign-in method changes
License	License installed or removed, activation requests downloaded, online renewal turned on or off, renewal attempts

Secrets (passwords, tokens, keys, webhook URLs) are never written to the audit log.

Filters

Filter	Meaning
Area	Everything, Rule requests, Sign-ins, Users, Settings, FortiManager (connection changes and syncs), Audits, IP addressing, Regions or Devices.
Person	Part of a user name or display name.
Since	Entries from this date (UTC) on.

Approval chain, condition, offline snapshot, backup, license and device-health entries appear under Everything.

The page shows the 500 most recent entries that match.

The table

Column	Shows
When	Date and time.
Who	The person, or System, and the IP address.
What	The action, such as `rule.stage_approved`, and what it applies to, such as `rule 42`.
Details	Up to eight details, such as the stage, comment, firewalls or old and new values.

Export

Export CSV downloads firesight-audit.csv with every entry that matches the filters (not limited to 500).

CSV column	Content
`id`	Entry number
`time_utc`	Time (UTC)
`actor`	User name, or `system`
`ip`	Client IP address
`action`	Such as `rule.approved`
`entity_type`	Such as `rule`, `user` or `setting`
`entity_id`	Its number
`details`	All details, as JSON

Client addresses behind a proxy

If every entry shows your reverse proxy's address, set FIRESIGHT_TRUSTED_PROXIES. See Reverse proxy.