Overview
The audit log records administrator actions, employee sign-ins, automated system actions, and configuration changes across every module in the Right-Hand Cybersecurity platform.
You can:
Review entries in the Right-Hand Cybersecurity portal.
Export entries to your SIEM or monitoring tool through a read-only API.
Use the audit log as your authoritative record when you investigate administrative changes, authentication events, integration activity, data exports, and privacy operations.
Who Can Access Audit Logs
Company administrators: Only administrators with the audit log permission can view audit logs. Other users can't open the Audit Logs page.
Access the Audit Logs Page
Sign in to the Right-Hand Cybersecurity portal.
Go to Management > Settings.
Click the Audit Logs tab.
The page lists audit log entries, with the most recent activity first.
To view the full details of an entry, click the expand arrow at the start of its row.
The expanded view shows the event name, actor email, IP address, device, and a UTC timestamp.
Important note: The Date and Time column shows each event in the timezone configured for your organization (the Timezone field in your organization settings). When you expand an entry, the timestamp field in the event details is always in UTC.
For example, in the screenshot above, with the timezone set to Asia/Singapore (UTC+8), an event logged at 13:55:05Z appears as 09:55 PM in the table.
Audit Log Entry Fields
Each entry contains the following columns:
Column | Description |
Actor | The administrator, employee, or Right-Hand Cybersecurity support user who performed the action. Automated actions show System. |
Date and Time | When the action occurred, for example, 2026-10-07 09:55 PM. |
IP Address | The IPv4 or IPv6 address the action came from. This column is blank for system actions. |
Target | The area of the platform affected, such as Login Activity or Campaigns. |
Action | The type of action performed, such as Login, Update, or Access Denied. |
Summary | A short description of what happened, such as "Signed in via Training link." |
Activities Recorded in the Audit Log
1. Sign-Ins and Sessions
Successful sign-ins through any method: password, email OTP, mobile OTP, Google SSO, Microsoft SSO, SAML SSO, or training link.
Failed sign-ins through the same methods, along with the failure reason. Examples include:
Incorrect password or OTP.
Locked account or OTP lockout.
Expired or already-used link.
SSO account not found or SSO assertion failure.
Sign-outs and session expirations.
Access-denied events.
Sign-in link resends, including resends blocked by CAPTCHA, a cooldown period, or access rules.
Sessions in which Right-Hand Cybersecurity support staff access your account on your behalf.
2. Employees and Organization Structure
Employee creation, updates, archiving, restoration, and deletion, including bulk actions.
The source of each change: portal, CSV import, SCIM, Microsoft Entra ID, Google Workspace, or on-premises Active Directory.
Changes to departments, divisions, office locations, job titles, employee types, and user groups.
Employee invitations and file imports.
3. Roles and Access Control
Role changes for administrator, manager, and custom roles. The log records changes made through:
The employee form.
Bulk role assignment.
People manager assignment.
CSV import.
Automated assignment.
Changes to role definitions.
4. SSO, Provisioning, and Directory Sync
SAML SSO connections: Connected, enabled, disabled, automatically disabled, updated, or disconnected.
Microsoft Entra ID connections: Connected, updated, or disconnected.
SCIM: Enabled, disabled, or token regenerated.
Company email domains (root domains and subdomains): Added, verified, failed verification, expired, or deleted.
Active Directory: Connections, imports, and directory sync history.
5. Security Tool Connectors
New connector connections, whether an administrator connects them or they connect automatically when the first data arrives.
Connector configuration changes and disconnections.
Automatic connector disablement after repeated failures.
Webhook token generation for webhook-based sources, such as Splunk, Cloudflare, and Zscaler.
6. Human Risk Management
Changes to human risk alerts, including severity, type, and enabled status.
Company risk score recalculations, whether requested manually or triggered by the system.
Changes to the risk score configuration.
Access to automation execution history.
7. Employee Notifications
Bulk notifications, including:
Employee kickoff and Ally kickoff.
Campaign reminders.
Training and pending training reminders.
PhishArm guides.
Awareness poster distribution.
Changes to notification and email templates.
8. Reports and Data Exports
The log records every export along with its report type, including:
Company dashboards: By department, division, location, and user group.
Phishing reports: Attacker profiles, email templates, and repeat offenders.
Training reports: Targeted trainings, feedback, users, SCORM packages, and training content.
Other exports: Campaign reports, employee lists, employee activity, manager analytics, pending trainings, competition results, survey dashboards, executive PDF reports, posters, and PhishArm manifests.
9. Data Deletion and Privacy Requests
Permanent employee deletions.
Privacy requests.
10. PhishArm and Email Quarantine Automation
Email Quarantine Automation (EQA) configuration changes.
Microsoft 365 and Google Workspace connection changes.
EQA searches, query results, and remediation actions.
Reported emails and their status changes.
Blocklist history.
Phishing alert settings.
11. Phishing Simulations
Creation, updates, and deletion of:
Campaigns.
Email templates.
Landing pages.
Attacker profiles.
Brand identities.
Competitions.
12. Training and Ally
Creation, updates, and deletion of trainings, courses, slides, quizzes, and templates.
Ally configuration changes.
13. Company and Security Settings
Company profile changes.
Security setting changes.
SMTP setting changes.
API token changes.
Important note: Audit log entries are kept for 30 days. After that, they are automatically deleted and can't be recovered. If you need a longer record for compliance or investigations, take a screenshot or copy the event details of any entries you need before they expire.
Search and Filter Audit Log Entries
To narrow down the activity you're investigating:
In the Search box, enter a name or keyword.
Select a Target to filter by platform area, such as Campaigns or Login Activity.
In From and To, select the start and end dates.
Click Search.
Send Audit Log Entries to Your SIEM
The Audit Log API is read-only. Use it to retrieve audit log entries and ingest them into your SIEM or other monitoring tool.
Note: For endpoints, authentication, and request examples, see the Audit Log API documentation.
Audit Log Integrity
Audit log entries are read-only. No one can edit or delete them, either in the portal or through the API. This keeps the audit log a reliable record of all activity in your account.
For any further questions, please reach out to [email protected].