Monitor audit events

You can monitor audit events in the Automation Orchestrator Audit UI to review platform activity, filter events by type, actor, or time range, and export records for compliance.

Before you begin

  • You have a role with audit log read permissions in Automation Orchestrator.
  • At least one audit event has been generated on the platform.
  • User action audit logging is configured at the required granularity level. See Configure user action audit logging.

About this task

Automation orchestrator generates audit events when users or systems perform significant actions. The Audit UI displays only business_event and security_event records stored in the platform database. It does not display crud_event records at GA release; for those, query your OTLP backend directly.

Procedure

  1. Navigate to Observability > Audit Logs in the Automation Orchestrator web console.
  2. Apply filters to narrow the event list to the activity you want to review.

    The following filter dimensions are available:

    • Event type — filter by event category: User action, Workflow event, Agent interaction, LLM interaction, LLM tool call, LLM reasoning, API execution, Security event, or System operation.
    • Actor — filter by actor type: User (human authenticated user), System (internal automated process), or Service (service account or integration).
    • Time range — specify a start and end date-time in ISO 8601 format. The Audit UI supports queries within the platform database retention window (up to 90 days by default).
  3. Select an event to view its full structured data payload.
  4. Query for authentication, workflow, or agent interaction events by selecting the corresponding event category filter.
  5. Export events from the Audit UI for external audit systems.

    The Audit UI supports export in the following formats:

    • CSV — tabular export of event fields; suitable for spreadsheet analysis and compliance reports.
    • JSON — structured export preserving the full event payload including structured_data fields; suitable for ingestion into SIEM or log management systems.

Results

You have reviewed audit events in the Audit UI, applied filters to scope the view, and exported records as needed.

What to do next

To export audit data to long-term external storage, see Export audit data to external storage.