Audit log
Audit log
Who did what, queryable with the same LSQL as everything else.
Every administrative action lands in the _audit dataset: token creation, dataset deletion, monitor changes, role grants, and every query anyone ran. It is immutable and readable with normal LSQL.
Who deleted that dataset?
read top to bottom
1['_audit']2| where _time > ago(7d) and action == "dataset.deleted"3| project _time, ['actor.email'], ['target.name'], source_ip4| order by _time descQueries run against a sensitive dataset
read top to bottom
1['_audit']2| where action == "query.executed" and ['target.dataset'] == "payments-service"3| summarize queries = count() by ['actor.email'], bin(_time, 1d)4| order by queries descRecorded actions
| Prefix | Covers |
|---|---|
token.* | created, regenerated, deleted, used-after-revocation |
dataset.* | created, updated, trimmed, deleted |
query.executed | Every query, with its LSQL and cost |
monitor.* | created, updated, muted, deleted |
user.* | invited, role changed, removed |
group.* | created, membership changed, deleted |
export.* | Every result export, with format and row count |
Monitor your own audit log
A match monitor on
action == "role.granted" and ['target.role'] == "admin" is five minutes of work and the kind of control an auditor asks about.The audit dataset has a fixed 400-day retention on Scale and cannot be trimmed or deleted — including by an owner.