Audit log

The audit log is the record of every change made to your Managed Nebula account: what changed, who or what made the change, when, and the values before and after. Changes made in the admin panel, through the API, and by hosts as they enroll are all recorded, along with admin sign-ins.

Each entry has an actor, a target, and an event. The actor can be an admin, an API key, a host enrolling itself, an endpoint user signing in through SSO, or Defined Networking itself. A host enrolled with a join key shows the key as its actor, so you can trace each host back to the key that created it. The target is the thing that changed, such as a host, network, role, route, tag, or join key.

To see the audit log, open Logs in the admin panel. The Audit logs page lists the newest changes first. Click any row to see its full details, or filter by target type, for example Hosts or Users. Export CSV downloads the last 7, 30, or 90 days. If you need logs older than 90 days, contact support.

To read the audit log from a script or copy it into a SIEM, use an API key with the audit-logs:list scope and the List audit logs operation. Viewing and downloading audit logs covers filtering, exporting, and polling the API without gaps or duplicates.