> For the complete documentation index, see [llms.txt](https://docs.couchdrop.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.couchdrop.io/security-and-governance/activity-and-audit-logs.md).
# Activity & Audit Logs
## Overview
Couchdrop records account activity so you can investigate file transfers, user access, administrative changes, workflows, and other system events.
You can review recent activity directly in Couchdrop or export historical data when you need records older than 30 days.
Navigate to **Admin Panel > Reporting > Activity**.
The **Activity** page contains four reporting views:
* **Activity Audit** — search and review individual events
* **User Breakdown** — review activity by user
* **Storage Breakdown** — review activity by storage
* **Historical Data Export** — export activity records outside the 30-day Activity Audit window
## Activity Audit
The **Activity Audit** tab provides a searchable record of events generated across your Couchdrop account.
Each event includes information such as:
Field
Description
Time
When the event occurred
Type
The event type
Message
Details about what occurred
Effective User
The Couchdrop user associated with the event
System
The system or interface that generated the event
For example, a successful web login may appear as a `login_event`, with the username, source IP address, and `webportal` recorded in the event message.
### Filtering activity
Use **Search** to narrow the Activity Audit to specific events.
Search conditions can be combined using:
* **and** — events must match all configured conditions
* **or** — events must match at least one configured condition
Available search fields include:
| Search field | Type | Description |
| ---------------------------- | ------- | ---------------------------------- |
| `connect.id` | string | ID of the B2B Connection |
| `event_type` | string | Event type |
| `filename` | string | Filename associated with the event |
| `inbox.id` | string | ID of the Inbox |
| `inbox.name` | string | Name of the Inbox |
| `is_admin` | boolean | Administrative events |
| `is_authentication` | boolean | Authentication events |
| `is_error` | boolean | Error events |
| `is_filesystem` | boolean | Filesystem events |
| `is_malware` | boolean | Malware events |
| `is_siem` | boolean | SIEM events |
| `is_transfer` | boolean | Transfer events |
| `is_workflow` | boolean | Workflow events |
| `sharedlink.id` | string | ID of the Shared Link |
| `sharedlink.name` | string | Name of the Shared Link |
| `storage.id` | string | ID of the storage |
| `system` | string | System that generated the event |
| `transaction.id` | string | Transaction ID |
| `transfer_shield.rule_group` | string | Transfer Shield rule group ID |
| `user.name` | string | Username associated with the event |
| `workflow.id` | string | Workflow ID |
| `workflow.name` | string | Workflow name |
These fields let you narrow activity to a particular user, filename, storage connection, Workflow, Shared Link, Inbox, transaction, or event category.
### Filtering by activity type
You can also use **Select type** to filter events by broader activity categories.
Available categories are:
* **Admin**
* **AS2**
* **Authentication**
* **Filesystem**
* **Malware**
* **SIEM**
* **Transfers**
* **Workflow**
You can select multiple categories when investigating activity across related parts of Couchdrop.
{% hint style="info" %}
Only the last 30 days of activity are available in the Activity Audit. For older records, use **Historical Data Export**.
{% endhint %}
### Exporting Activity Audit results
Click **Download as .csv** to export the current Activity Audit data as a CSV file.
This can be useful when you need to review records outside Couchdrop or retain the results of an investigation.
## User Breakdown
The **User Breakdown** tab shows activity grouped by user.
It provides a quick view of when each user was last active, how much data they uploaded and downloaded, and the number of login and failure events recorded during the selected period.
## Storage Breakdown
The **Storage Breakdown** tab shows activity grouped by storage location.
It provides a quick view of storage usage, recent activity, uploaded and downloaded data, and the number of active users for each Couchdrop folder or storage integration.
## Historical Data Export
All audit activity data, including records older than 30 days, can be retrieved through a **Historical Data Export** using the **+ New Report** button.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.couchdrop.io/security-and-governance/activity-and-audit-logs.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.