Monitor user activities (Audit)

Supported in:

This document explains the Audit page and its associated user activities in a clear, list-based format, giving you a comprehensive view of platform actions. 

Access the Audit page

To open the Audit page, go to Settings > Advanced > Audit.

At the top of the screen, you'll see an overview of key user activity metrics:

  • Most Common Activities
  • Most Common Resolutions
  • Most Active Users
  • Most Active Addresses
  • Most Common Browsers

View activity log and filtering

You'll see the activities displayed in a list format. You can filter this list by user and count or group for easier navigation.

To view the following details, you can take these actions:

  • Click View More on any row to open the Activity Details side drawer. This pane includes:
    • Time: When the activity occurred
    • User: Who performed the activity
    • Module: Which system module was affected
    • Activity Type: The action performed
    • Address: The IP address from which the activity originated
    • Browser: The browser used to perform the activity
    • Screen Size: The resolution of the screen used for the activity
  • Click the required activity value to view the information in the New Activity Values or Previous Activity Values.
  • Click the relevant activity row and click the toggle between New Activity Values and Previous Activity Values.

It also displays New versus Previous Activity values side-by-side in a JSON viewer layout, making investigations more efficient.

Need more help? Get answers from Community members and Google SecOps professionals.