# Audit log

The audit log is the record of every change made to your Managed Nebula account: what changed, who or what made the change, when, and the values before and after. Changes made in the [admin panel](/docs/glossary/admin-panel/), through the API, and by hosts as they enroll are all recorded, along with admin sign-ins.

Each entry has an actor, a target, and an event. The actor can be an admin, an [API key](/docs/glossary/api-key/), a [host](/docs/glossary/host/) enrolling itself, an [endpoint user](/docs/glossary/endpoint-user/) signing in through SSO, or Defined Networking itself. A host enrolled with a [join key](/docs/glossary/join-key/) shows the key as its actor, so you can trace each host back to the key that created it. The target is the thing that changed, such as a host, [network](/docs/glossary/network/), [role](/docs/glossary/role/), [route](/docs/glossary/route/), [tag](/docs/glossary/tag/), or join key.

To see the audit log, open [Logs](https://admin.defined.net/logs/audit) in the admin panel. The **Audit logs** page lists the newest changes first. Click any row to see its full details, or filter by target type, for example **Hosts** or **Users**. **Export CSV** downloads the last 7, 30, or 90 days. If you need logs older than 90 days, contact support.

To read the audit log from a script or copy it into a SIEM, use an API key with the `audit-logs:list` scope and the [List audit logs](/docs/api/operations/auditlogslist/) operation. [Viewing and downloading audit logs](/docs/guides/using-audit-logs/) covers filtering, exporting, and polling the API without gaps or duplicates.