Using the reseller audit log
The audit log is a chronological record of every account-level action taken on your reseller account. It is intentionally read-only and append-only — nothing on the page changes anything; it only shows you what happened. Most resellers use it for two things: answering “what changed and when?” questions during troubleshooting, and producing evidence for compliance reviews where you need to demonstrate who took what action.
In This Article
What is tracked
The log records the actions that change the state of your account or one of your clients:
- Client created — a new client was onboarded.
- Client suspended — a client was moved into the suspended state.
- Client reactivated — a previously suspended client was returned to active.
- Client deleted — a client was removed from the account.
- License allocated — a slot in a pool was assigned to a client.
- License revoked — a slot was reclaimed from a client and returned to the pool.
Day-to-day plugin activity (scans, firewall blocks, alert generation) is not in this log; those events are visible in the relevant per-client and per-fleet views instead. The audit log is specifically for actions a reseller user took on the account.
Reading an entry
Each row of the table shows:
- Timestamp — when the action was recorded, in your local time.
- Action — one of the action types listed above.
- Target — the client the action applied to (by email).
- Details — any context relevant to the action, for example the pool a license was allocated from.
- Performed By — the reseller user who took the action.
Filtering by action type
Use the action filter to narrow the table to a single category — for example, only license revocations, or only client deletions. Filtering is the fastest way to answer questions like “how many clients did we suspend last quarter?” without scrolling through unrelated entries.
When to consult the log
The audit log earns its keep in three situations:
- “Who did this?” When something looks unexpectedly different on a client’s account — license missing, status flipped — the log tells you whether it was an action by your team or something else.
- Compliance. Auditors and security reviewers usually want evidence that account changes are traceable to a specific user. Filter and screenshot for an ad-hoc record; for a formal export, contact support.
- Reconstructing a timeline. When working through a multi-step incident, scrolling the log gives you the exact order in which actions were taken.