{"id":8989,"date":"2026-10-21T00:27:22","date_gmt":"2026-10-20T21:27:22","guid":{"rendered":"https:\/\/support.withsecure.com\/support-articles\/audit-log-feature-in-the-elements-security-center-portal\/"},"modified":"2026-10-21T00:27:22","modified_gmt":"2026-10-20T21:27:22","slug":"audit-log-feature-in-the-elements-security-center-portal","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/fr\/support-articles\/audit-log-feature-in-the-elements-security-center-portal\/","title":{"rendered":"Audit log feature in the Elements Security Center portal"},"content":{"rendered":"<h3>Issue:<\/h3>\n<p>Where is the audit log and what is the information available in the Audit log feature in Elements Security Center portal? Does Elements Security Center portal have an auditing feature to see which administrator account did what and when?\u00a0<\/p>\n<h3>Resolution:<\/h3>\n<p>The audit log feature can be found in the Elements Security Center portal:<\/p>\n<ol>\n<li>Log in to the Elements portal: <a href=\"https:\/\/elements.withsecure.com\" target=\"_blank\" rel=\"noopener noreferrer\">https:\/\/elements.withsecure.com<\/a><\/li>\n<li>Navigate to the <strong>Management &gt; Audit Log <\/strong>page<\/li>\n<\/ol>\n<p>The current Audit log version allows you to see the following events \/ actions:<\/p>\n<ul>\n<li>Access changed<\/li>\n<li>Access granted<\/li>\n<li>Access revoked<\/li>\n<li>Account updated<\/li>\n<li>Acknowledge Security Event<\/li>\n<li>Activate device<\/li>\n<li>Add labels<\/li>\n<li>Allowlisting rule created<\/li>\n<li>Asset deleted<\/li>\n<li>Asset tagged for removal<\/li>\n<li>Asset untagged for removal<\/li>\n<li>Asset updated business context<\/li>\n<li>Asset updated criticality<\/li>\n<li>Assets export<\/li>\n<li>Assets offboarding<\/li>\n<li>Assets onboarding<\/li>\n<li>Assign asset groups<\/li>\n<li>Assign profile<\/li>\n<li>Automated action scenario created<\/li>\n<li>Automated action scenario updated<\/li>\n<li>Cancel remote operation<\/li>\n<li>Change subscription<\/li>\n<li>Collaboration created<\/li>\n<li>Credential updated<\/li>\n<li>Customer contact added<\/li>\n<li>Decrypt drive<\/li>\n<li>Delete device (Note: Devices deleted by Manage Automatic deletion feature are not listed)<\/li>\n<li>Download diagnostic file<\/li>\n<li>Edit alias<\/li>\n<li>Edit comment<\/li>\n<li>Edit importance<\/li>\n<li>Email report create<\/li>\n<li>Email report delete<\/li>\n<li>Email report update<\/li>\n<li>Encrypt drive<\/li>\n<li>Exposure finding status updated<\/li>\n<li>Exposure recommendation elevated<\/li>\n<li>Exposure recommendation elevation commented<\/li>\n<li>Exposure recommendation status updated<\/li>\n<li>Fetch diagnostic file<\/li>\n<li>Finding definition removed<\/li>\n<li>Fix an infection<\/li>\n<li>Identity business context updated<\/li>\n<li>Identity response actions updated<\/li>\n<li>Inactivate device<\/li>\n<li>Incident resolution changed<\/li>\n<li>Incident status changed<\/li>\n<li>Install software updates<\/li>\n<li>Isolate from network<\/li>\n<li>Login<\/li>\n<li>Move to organization<\/li>\n<li>Multiple accounts updated<\/li>\n<li>Profile created<\/li>\n<li>Profile deleted<\/li>\n<li>Profile updated<\/li>\n<li>Release from network isolation<\/li>\n<li>Remove device<\/li>\n<li>Remove labels<\/li>\n<li>Replace labels<\/li>\n<li>Report a possible false positive in quarantine<\/li>\n<li>Request bitlocker key<\/li>\n<li>Request diagnostic file<\/li>\n<li>Response action failed<\/li>\n<li>Response action requested<\/li>\n<li>Restart system<\/li>\n<li>Restore feature<\/li>\n<li>Role assigned to security group<\/li>\n<li>Role assigned to user<\/li>\n<li>Role revoked from user<\/li>\n<li>Save rules<\/li>\n<li>Scan AD root<\/li>\n<li>Scan configuration created<\/li>\n<li>Scan executed<\/li>\n<li>Scan for malware<\/li>\n<li>Scan for updates<\/li>\n<li>Scan for vulnerabilities<\/li>\n<li>Security event notifications enabled<\/li>\n<li>Security group created<\/li>\n<li>Security group deleted<\/li>\n<li>Send full status<\/li>\n<li>Send message<\/li>\n<li>Set change tracking value<\/li>\n<li>Synchronise devices<\/li>\n<li>Turn off security feature<\/li>\n<li>Unassign asset groups<\/li>\n<li>Uninstall<\/li>\n<li>User added to organization<\/li>\n<li>User added to security group<\/li>\n<li>User info<\/li>\n<\/ul>\n<p>Events can be filtered by time range, administrator name, transaction ID, profile name, device UUID, organization name, and action.<\/p>\n<p>The Audit Log cannot be currently forwarded to SIEM either by using Elements Connector or Elements API. This is a feature that we currently do not have any details on when and if it will arrive.\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"<p>What are the information available from Audit log feature in Elements Endpoint Protection portal?<\/p>\n","protected":false},"template":"","support_article_product":[99],"class_list":["post-8989","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000012267","source_version":1,"source_system":"salesforce","source_date_updated":"2026-10-20 20:44:46","import_hash":"f1a4458e6515dccca28366636b05522e76712228","vanilla_article_id":"","vanilla_url":"","vanilla_kb_id":"","vanilla_category_id":"","machine_translated":false,"reactions_helpful_yes":"","reactions_helpful_no":""},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/support_article\/8989","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/media?parent=8989"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/support_article_product?post=8989"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}