Overview
The audit log records administrator actions, employee sign-ins, automated system actions, and configuration changes across every module in the Right-Hand Cybersecurity platform.
You can:
Review entries in the Right-Hand Cybersecurity portal.
Export entries to your SIEM or monitoring tool through a read-only API.
Use the audit log as your authoritative record when you investigate administrative changes, authentication events, integration activity, data exports, and privacy operations.
Who Can Access Audit Logs
Company administrators: Only administrators with the audit log permission can view audit logs. Other users can't open the Audit Logs page.
Access the Audit Logs Page
Sign in to the Right-Hand Cybersecurity portal.
Go to Management > Settings.
Click the Audit Logs tab.
The page lists audit log entries, with the most recent activity first.
To view the full details of an entry, click the expand arrow at the start of its row.
The expanded view shows the event name, actor email, IP address, device, and a UTC timestamp.
Important note: The Date and Time column shows each event in the timezone configured for your organization (the Timezone field in your organization settings). When you expand an entry, the timestamp field in the event details is always in UTC.
For example, in the screenshot above, with the timezone set to Asia/Singapore (UTC+8), an event logged at 13:55:05Z appears as 09:55 PM in the table.
Audit Log Entry Fields
Each entry contains the following columns:
Column | Description |
Actor | The administrator, employee, or Right-Hand Cybersecurity support user who performed the action. Automated actions show System. |
Date and Time | When the action occurred, for example, 2026-10-07 09:55 PM. |
IP Address | The IPv4 or IPv6 address the action came from. This column is blank for system actions. |
Target | The area of the platform affected, such as Login Activity or Campaigns. |
Action | The type of action performed, such as Login, Update, or Access Denied. |
Summary | A short description of what happened, such as "Signed in via Training link." |
Activities Recorded in the Audit Log
The audit log records the following activities.
Sign-ins and sign-outs
Successful sign-ins using a password, email OTP, mobile OTP, Google SSO, Microsoft SSO or Company SAML SSO.
Incorrect password attempts, incorrect email or mobile OTPs, and rejected Google, Microsoft or SAML SSO sign-ins.
Sign-ins through Ally magic links; access denied when an Ally link is expired, already used or blocked; requests for a new Ally magic link; and blocked Ally magic-link resends.
Sign-outs.
Session starts when a Right-Hand administrator signs in as an employee.
Employees and role assignments
Employee creation, updates and archiving through the portal UI, CSV import, SCIM, Azure Entra ID sync, Google Workspace sync or on-premises Active Directory sync.
Employee deletion through the portal UI.
Employee invitations and updates to user details.
Employee role changes made by an administrator, and automatic assignment of the people-manager role.
Organization structure
Department creation, updates, deletion and linking of a new department.
Office-location additions, updates and deletions.
User-group additions and updates.
Campaign-group creation, updates and deletion.
SSO, provisioning and directory integrations
Azure Entra ID integration connections, configuration updates and disconnections.
SCIM enablement, disablement and bearer-token regeneration.
SAML SSO integration connections, configuration updates and disconnections; and provider enablement and disablement.
Automatic disablement of an SSO provider when another SSO provider is enabled.
Integration additions, updates and removals; updates to integration sync details; deletion of integration sync history; and starts of new user syncs.
Active Directory token generation, establishment of a new AD remote connection, starts of AD syncs and updates to AD sync details.
Security tool connectors
Connector connections, failures, removals and settings updates.
Generation of connector webhook tokens.
Human Risk Management and risk scores
Alert configuration updates.
Company risk-score updates and requests to recalculate the company risk score.
Employee emails and poster distribution
Bulk employee kickoff emails to all active employees and Ally kickoff emails to all employees.
Bulk campaign reminders, training reminders and pending-training reminders by email.
Bulk PhishArm guide emails to all active employees.
Distribution of posters to employees.
Reports and data exports
Exports of department, division, location and user-group dashboards.
Exports of Attacker Profiles, Email Templates and Repeat Offenders.
Exports of campaign reports for campaigns or campaign groups, and Custom Campaign Reports.
Exports of Executive Campaign Reports in PDF format.
Exports of Custom User Reports for Phishing and Training in CSV format.
Exports of employee lists, employee activity, Manager Analytics Reports and manager pending-training reports. Manager pending-training reports are exported in CSV format.
Exports of the Trainings Report, Training Assigned Users and Training Feedback; training content in XLSX format; and training SCORM packages in ZIP format.
Exports of survey dashboards in CSV format, posters in PDF or image format, and the PhishArm Outlook manifest in XML format.
Exports of other reports generated from Company Reports.
Automatic sending of competition-results reports at campaign end.
Permanent deletion
Requests for permanent deletion of a company or employee, and completion of those deletions.
PhishArm and Email Quarantine Automation
Employee reporting of emails, and updates to reported-email details, status and severity.
Updates to PhishArm plugin settings and notification settings.
Updates to Email Quarantine Automation configuration and its Gsuite and Office365 connections.
Creation of EQA search queries and updates to query details.
Campaigns and phishing content
Campaign creation, updates and deletion; sending campaigns to test users; changes to campaign publish status; and attaching users to campaigns.
Updates to campaign and competition risk indicators for simulation emails.
Email-template creation, updates and deletion.
Landing-page creation, updates and deletion.
Sender Profile creation, updates and deletion.
Training content and posters
Training creation, updates and deletion.
Adding slides to trainings, updating or deleting training slides, and updating content within a slide.
Updates to training templates and notification templates, and training assignments.
Poster additions and deletions.
Ally
Completion of Ally assessments.
Creation of Ally course content, addition or removal of Ally categories from company course content, and updates to Ally content details.
Creation and updates of Ally Manager Profiles.
Creation and updates of Ally Notification Settings.
Updates to Ally onboarding follow-up emails, company-specific onboarding follow-up details, training delivery settings and automated follow-up configuration.
Company settings, templates and file uploads
Updates to company details, employee-related company settings and glossary details.
Updates to phishing, security and SMTP settings.
Updates to training-content, training-feedback and training-reminder settings.
Updates to notification-template configuration.
File uploads and updates to file details.
Important note: Audit log entries are kept for 30 days. After that, they are automatically deleted and can't be recovered. If you need a longer record for compliance or investigations, take a screenshot or copy the event details of any entries you need before they expire.
Search and Filter Audit Log Entries
To narrow down the activity you're investigating:
In the Search box, enter a name or keyword.
Select a Target to filter by platform area, such as Campaigns or Login Activity.
In From and To, select the start and end dates.
Click Search.
Send Audit Log Entries to Your SIEM
The Audit Log API is read-only. Use it to retrieve audit log entries and ingest them into your SIEM or other monitoring tool.
Note: For endpoints, authentication, and request examples, see the Audit Log API documentation.
Audit Log Integrity
Audit log entries are read-only. No one can edit or delete them, either in the portal or through the API. This keeps the audit log a reliable record of all activity in your account.
For any further questions, please reach out to [email protected].