Trace explorer

The Trace explorer is the investigation surface over your organization's full audit log. The activity reports are the same screen pinned to one stream; the Trace explorer searches every stream at once. Open it via Reports → Trace Explorer.

Filter the trail#

Filters apply as soon as you change them; Reset clears them.

Filter	Options
Range	Last 24 hours, 7 days, 30 days or 3 months — or exact dates and times, up to 3 months apart
Search actions	Part of an action name, such as login, share or export
Stream	All streams, or one of: Sign-in & sessions, Roles & permissions, Vault access, Vault changes, Administration, Tasks, DevOps secrets, Billing & payments, Security, Sharing, Platform operations — only the streams you may read are listed
Severity	Low, Medium, High, Critical
Result	Success, Failure, Access denied
Include sign-in & read activity	Off by default: session refreshes, vault listings and report views are recorded but routine

Times are entered and shown in your browser's time zone, which the page names under the range. Results are paged — 25, 50, 100 or 200 per page.

Links from the Audit dashboard open the Trace explorer over the dashboard's exact dates, with the matching stream, severity, result or actions already applied — so the rows add up to the figure you selected. From Most active accounts it opens on that account's own events, shown as a removable Done by chip; from High & critical it opens on both severities at once, shown as a removable High & Critical severity chip. An action count on Feature usage opens it on exactly the rows that number counts — the area's actions, successful only, by current members only, over the report's exact dates — shown as removable chips above the table. Remove Current members only to include people who have since left.

Reading an event#

Each row is one immutable audit entry. Select its stream to expand it:

• What happened — the recorded description.
• Event code — the exact action, useful when searching or talking to support.
• Correlation ID — shared by every entry recorded during the same request, so related actions can be tied back to one operation.
• Affected member and Resource ID, where there is one.

Export for evidence#

Export CSV and Export JSON download exactly the rows your filters select — CSV for spreadsheet review (each row carries its signature), JSON for tooling and SIEM ingestion. Export is included on Team, Business and Enterprise, and every export is recorded in the trail as Audit log exported with who took it and how many entries it held.

A typical investigation#

1. Set Stream to Sign-in & sessions and Result to Failure to surface failed sign-ins.
2. Narrow the range to the suspicious window and note the actor and address involved.
3. Switch the stream to Vault access for the same window to see what was viewed or copied.
4. Export the filtered evidence and record an integrity check result.

Access requires audit read access to the organization — see Roles & permissions.