> For the complete documentation index, see [llms.txt](https://docs.couchdrop.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.couchdrop.io/security-and-governance/activity-and-audit-logs.md).

# Activity & Audit Logs

## Overview

Couchdrop records account activity so you can investigate file transfers, user access, administrative changes, workflows, and other system events.

You can review recent activity directly in Couchdrop or export historical data when you need records older than 30 days.

Navigate to **Admin Panel > Reporting > Activity**.

The **Activity** page contains four reporting views:

* **Activity Audit** — search and review individual events
* **User Breakdown** — review activity by user
* **Storage Breakdown** — review activity by storage
* **Historical Data Export** — export activity records outside the 30-day Activity Audit window

## Activity Audit

The **Activity Audit** tab provides a searchable record of events generated across your Couchdrop account.

Each event includes information such as:

<table><thead><tr><th width="151.23828125">Field</th><th>Description</th></tr></thead><tbody><tr><td><strong>Time</strong></td><td>When the event occurred</td></tr><tr><td><strong>Type</strong></td><td>The event type</td></tr><tr><td><strong>Message</strong></td><td>Details about what occurred</td></tr><tr><td><strong>Effective User</strong></td><td>The Couchdrop user associated with the event</td></tr><tr><td><strong>System</strong></td><td>The system or interface that generated the event</td></tr></tbody></table>

For example, a successful web login may appear as a `login_event`, with the username, source IP address, and `webportal` recorded in the event message.

### Filtering activity

Use **Search** to narrow the Activity Audit to specific events.

Search conditions can be combined using:

* **and** — events must match all configured conditions
* **or** — events must match at least one configured condition

Available search fields include:

| Search field                 | Type    | Description                        |
| ---------------------------- | ------- | ---------------------------------- |
| `connect.id`                 | string  | ID of the B2B Connection           |
| `event_type`                 | string  | Event type                         |
| `filename`                   | string  | Filename associated with the event |
| `inbox.id`                   | string  | ID of the Inbox                    |
| `inbox.name`                 | string  | Name of the Inbox                  |
| `is_admin`                   | boolean | Administrative events              |
| `is_authentication`          | boolean | Authentication events              |
| `is_error`                   | boolean | Error events                       |
| `is_filesystem`              | boolean | Filesystem events                  |
| `is_malware`                 | boolean | Malware events                     |
| `is_siem`                    | boolean | SIEM events                        |
| `is_transfer`                | boolean | Transfer events                    |
| `is_workflow`                | boolean | Workflow events                    |
| `sharedlink.id`              | string  | ID of the Shared Link              |
| `sharedlink.name`            | string  | Name of the Shared Link            |
| `storage.id`                 | string  | ID of the storage                  |
| `system`                     | string  | System that generated the event    |
| `transaction.id`             | string  | Transaction ID                     |
| `transfer_shield.rule_group` | string  | Transfer Shield rule group ID      |
| `user.name`                  | string  | Username associated with the event |
| `workflow.id`                | string  | Workflow ID                        |
| `workflow.name`              | string  | Workflow name                      |

These fields let you narrow activity to a particular user, filename, storage connection, Workflow, Shared Link, Inbox, transaction, or event category.

### Filtering by activity type

You can also use **Select type** to filter events by broader activity categories.

Available categories are:

* **Admin**
* **AS2**
* **Authentication**
* **Filesystem**
* **Malware**
* **SIEM**
* **Transfers**
* **Workflow**

You can select multiple categories when investigating activity across related parts of Couchdrop.

{% hint style="info" %}
Only the last 30 days of activity are available in the Activity Audit. For older records, use **Historical Data Export**.
{% endhint %}

### Exporting Activity Audit results

Click **Download as .csv** to export the current Activity Audit data as a CSV file.

This can be useful when you need to review records outside Couchdrop or retain the results of an investigation.

## User Breakdown

The **User Breakdown** tab shows activity grouped by user.

It provides a quick view of when each user was last active, how much data they uploaded and downloaded, and the number of login and failure events recorded during the selected period.

## Storage Breakdown

The **Storage Breakdown** tab shows activity grouped by storage location.

It provides a quick view of storage usage, recent activity, uploaded and downloaded data, and the number of active users for each Couchdrop folder or storage integration.

## Historical Data Export

All audit activity data, including records older than 30 days, can be retrieved through a **Historical Data Export** using the **+ New Report** button.