# Security and audit overview

## Security and audit information

Security and audit information is available in two scopes: one selected project or the
whole organization. Use the project view when you are checking activity for one selected
project. Use the organization view when you need activity across all projects.
The administrative **Security & Audit** area contains this overview, a detailed security
review, and an audit reference.

| If you need to… | Go to |
|---|---|
| Check activity for one project | [Review security information](doc:review-security-information) |
| Check activity across the organization | [Organization audit](doc:organization-audit) |
| Understand audit records and related administration | [Audit reference](doc:audit-reference) |
| Check who can open the administrative audit surfaces | [Security & Audit access](doc:security-and-audit-access) |

![Identify the audit table headers and **Export CSV** on the project audit surface.](https://atloriaassets.blob.core.windows.net/assets/a438221c-c1af-407c-b9e6-a56c986db846/7c1f1061d351b8a9c06ccf2ad0dafb60.png)

## Before you start

The project audit view needs a selected project and an active signed-in session. The
organization audit view requires administrator or maintainer access. Start with the
organization view when your question concerns more than one project; start with the
project view when you need to trace activity in one project.

| Before you open the surface | What to have ready |
|---|---|
| Project audit | A selected project and an active session |
| Organization audit | Administrator or maintainer access |
| Project-specific review | The project whose activity you need to inspect |

If no project is selected, the project surface displays **Select a project**. Its guidance
states: `The audit trail is scoped to one project at a time.` It also says:
`Choose a project from the header dropdown to view its audit log.`

The project surface provides an action filter. Date, actor, and project filters belong to
the organization audit surface instead.

## Find the audit surface

Use the administrative navigation to choose the scope that matches your question.

**Prerequisites**

- You have administrator access for the administrative area.
- You know whether the activity you need belongs to one project or the whole organization.

**Steps**

1. Open **Security & Audit** from the administrative navigation.
2. Choose the page that matches your question.

   | If you need to… | Open |
   |---|---|
   | Review one selected project's activity | [Review security information](doc:review-security-information) |
   | Review activity across all projects | [Organization audit](doc:organization-audit) |
3. On the organization audit surface, select **Members** to return to the organization
   settings area.

**Result:** The audit surface for your question is open.

## Review a project's audit information

A project audit log lists events for one selected project. Each row
identifies when the event occurred, the user, the action, and its details.

**Prerequisites**

- A project is selected.
- The project audit surface is open.

**Steps**

1. Open **All Actions** and choose the action family you need to inspect. The list
   includes `All Actions`, `version.published`, `document.updated`, `document.edited`,
   `webhook.received`, `version.reviewed`, `export.downloaded`, and `schedule.triggered`.
2. Read the event row under the **When**, **User**, **Action**, and **Details** headers.
3. Select the event row to expand its metadata when you need the event's additional detail.
4. Choose one project-audit action from the table.

   | If you need to… | Select |
   |---|---|
   | Move to the preceding page of events | **Previous** |
   | Move to the following page of events | **Next** |
   | Request a CSV file for the selected project's audit data | **Export CSV** |

**Result:** The project audit table is filtered or inspected, and the available page or
CSV-export control is ready for the next action.

The project surface has four stable table headers: **When**, **User**, **Action**, and
**Details**. The project view also showed **Next** and **Export CSV**, with no event row
expanded on arrival.

## Review organization audit information

The organization audit log brings recorded activity from all projects into one filterable
list. An actor is the person or account associated with an event. Use the filters to narrow
the list before reading individual events.

**Prerequisites**

- You have administrator or maintainer access.
- The organization audit surface is open.

**Steps**

1. Open **All Actions** and choose an action from the available organization action list.
2. Open **All Actors** and choose the actor whose activity you need to inspect.
3. Open **All Projects** and choose the project whose activity you need to inspect.
4. Enter a beginning date in **Start date**.
5. Enter an ending date in **End date**.
6. Read the event row under the **Time**, **Actor**, **Action**, **Project**, **Entity**,
   and **Details** headers. **Entity** identifies the record associated with the event.
7. Select an event row to expand its metadata, which contains additional event details.
8. Choose a pagination action from the table.

   | If you need to… | Select |
   |---|---|
   | Move to the preceding page | **Previous** |
   | Move to the following page | **Next** |
9. Choose an export format from the table.

   | If you need to… | Select |
   |---|---|
   | Request the organization audit data as CSV | **Export CSV** |
   | Request the organization audit data as JSON | **Export JSON** |

**Result:** The organization audit list is narrowed to the criteria you entered, and its
records or export controls are available for the next action.

The organization audit view filters by action, actor, project, start date, and end date and
lists up to 50 events at a time. The project audit view lists up to 20 events at a time.

## Handle empty, loading, and access branches

The audit surfaces use distinct messages for a missing project, loading data, an empty
result, and an access or loading error. Match the message you see to the action in the
table below.

| What you see | What it means | What to do |
|---|---|---|
| `Select a project` | The project audit view has no selected project. | Choose a project from the header dropdown. |
| `Loading audit events…` | The project audit list is loading. | Wait for the list to finish loading. |
| `No audit events found` | The project query returned no events. | Check the selected project and the action filter. |
| `Events appear here as soon as anything is published, edited, or exported.` | The project audit list is empty until an event is recorded. | Check the selected project and the action filter. |
| `Loading...` | The shared audit table is loading. | Wait for the organization list to finish loading. |
| `No audit events` | The shared audit table has no rows to display. | Review the filters and date range. |
| `Only admins and maintainers can view the organization audit log.` | The organization audit request was refused for access reasons. | Sign in with administrator or maintainer access. |
| `Could not load the audit log.` | The organization audit list could not be loaded. | Return to the organization audit surface and try again. |
| `Export failed` | An organization export request failed. | Return to the organization audit surface and try the export again. |

**Result:** You can identify the message on screen and choose the corresponding recovery action.

## Choose the next audit task

The project and organization views answer different questions: one narrows activity to a
selected project, while the other brings activity from all projects together. Continue
with the page that matches the work you need to do.

- For a detailed review of the project security surface, open [Review security
  information](doc:review-security-information).
- For organization-wide audit work, open [Organization audit](doc:organization-audit).
- For audit-record definitions and related administrative records, open [Audit
  reference](doc:audit-reference).
- For access requirements, open [Security & Audit access](doc:security-and-audit-access).
- For related project history, open [Project changes and audit](doc:project-changes-and-audit).