Skip to content

Audit Log

NodeZero's Audit Log provides an auditable record of user actions on each NodeZero account, compliant with NIST SP 800-53 High and FedRAMP High standards. For internal teams investigating suspicious activity or responding to incidents, these logs can accelerate answers to who/what/when/where questions.

Accessing the Audit Log

Organization Admins can view, filter, and download Audit Log events – including those on clients within a parent account – as follows:

  1. At the NodeZero Portal's top right, open your user profile menu, and select Settings.
  2. From the upper tabs, select Audit Log. This displays a version of the page shown below.

Audit Log page at User Profile > Settings, showing upper "Audit Log" tab highlighted, and a lower table of multiple log events

Audit Log

Log Events (Columns)

The Audit Log displays events in some or all of the following columns, depending on your configuration:

Column Details
Timestamp When the event occurred. Sortable.
Client Displayed on parent accounts.
Actor Individual or other entity (such as a shared team ID, a NodeZero Runner, or a generic Horizon3 employee role) that performed the action.
Role Actor's access role.
Source IP address from which the action originated.
Action Access/authentication, testing, and other significant actions on the account. (To reduce noise, some high-frequency read and query event types – such as viewing test operations, or Tripwire or Rapid Response alerts – are throttled to one entry per day.)
Event Details A summary of the JSON blob available to display.
Access Reason Added as a complement when you display Horizon3 employee actions.
Details Provides View links to open the Details drawer.

Event Metadata

In the Details column, click any event's View link to open a drawer showing detailed metadata in JSON format. A Copy button is available with each JSON blob.

Audit Log page with an "API Key Sign-In" event's drawer opened on the right, displaying a two-level JSON element and a "Copy" button

Audit Log, with one event expanded

Filtering the Log

You can filter the Action Log's contents in several dimensions.

Free-Text and Date Filters

The search box above the table enables flexible filtering by client (where applicable), actor, action (event type), source IP address, event details, and other text strings.

The date range drop-down, shown below, enables filtering by predefined or custom date ranges. The default Past 90 days range is the longest range retained in the NodeZero Portal, so defining a Custom range from this drop-down cannot exceed 90 days. (You can, however, download a report containing up to three years of retrospective data.)

Audit Log page with date range drop-down opened to show Date range options: Past 24 hours, Past 7 days, Past 30 days, Past 90 days, or Custom

Audit Log's date-range filtering options

Actor, Horizon3 Access, and Other Filters

You can click the Actor, Role, and Action column headers to filter on the corresponding dimensions. The Actor column's drop-down also enables free-text searching by substring.

By default, the Actor drop-down's Show H3 Employee Access check box is not selected, so you will see only actions within your own organization. Selecting this check box adds Horizon3 employees' actions on your behalf. All these actions will display the h3_org_admin role as the actor, rather than individual employees.

Before any h3_org_admin enters a customer environment, they initiate a check-in that records who, when, and why they are doing so (see Access Reason Codes below).

Audit Log page with Actor drop-down opened to show empty Search field and top-most "Horizon3 Employee Access: Show" check box selected

Displaying Horizon3 Employee Access events

Access Reason Codes

Access Reason codes are hidden by default. If you enable the Show H3 Employee Access option. you can display this column to add context to rows that show Horizon3 employee actions on your organization's behalf. (These codes will not be displayed for your own organization's users.) The codes are:

  • Support
  • Quality_Assurance
  • Sales
  • RND (Research and Development)
  • Customer_Success
  • Rapid_Response

Exporting the Log

Click Download Events at the upper right to export your Audit Log to a CSV (comma-separated-values) file. You have two options here:

  • All Events (up to 3 years) will export the widest range of data.

  • Current Table Filters will scope the export to the filters you've set. These include your currently set date range, inclusion of Horizon3 employee actions, etc. If desired, modify your filters before selecting this option.

After selecting an option, you will receive an email containing a link to download the CSV file.

Audit Log's "Download Events" drop-down opened to reveal "All Events (up to 3 years)" and "Current Table Filters" options

Exporting log events

Frequently Asked Questions

What Events Are Logged?

The NodeZero Audit Log captures security-relevant events in accordance with FedRAMP High and NIST SP 800-53 requirements:

  • Authentication and access – User sign-ins, sign-outs, and authentication attempts.
  • Security testing activities – Pentest operations and security scans.
  • Administrative actions – Configuration changes, user management, and permission updates.
  • Security monitoring – Alert triggers and system events.

Each log entry records who performed the action (individual or other entity/role), what action was taken, when it occurred, and which account was affected.

How Long Does NodeZero Retain Logs?

Audit Log is retained in the NodeZero Portal for up to 90 days. Up to three years' retrospective data is available to export, for long-term archiving/retention in your own systems for compliance or backup purposes.

Who Can See Audit Logs?

Only users with the Org Admin role can view, filter, and export Audit Logs. (Audit Logs contain sensitive security and operational data about your organization's activity. Access is limited to Org Admins in order to ensure proper security and compliance oversight.)

The User and Read-only roles have no access, and the Audit Log feature is not visible to them in the Portal UI.

Can I Export Audit Logs?

Yes, Org Admins can export Audit Logs as CSV files, as described above.

How Do I Filter Audit Logs?

The Audit Log supports multiple dimensions of filtering.

Text Search:

  • Search across all log fields (Action, Actor, event details).
  • Partial matches supported.

Date Range Filter:

  • Default – Last 90 days.
  • Options – Past 24 hours, Past 7 days, Past 30 days, or Custom date range.

Horizon3 Employee Access:

  • Default – Hidden.

  • Option – Enable this to show Horizon3 employee access events, by role.

Combining filters and exports

All filters can be combined. CSV exports respect your active filters.

Are Horizon3 Employee Actions Visible in the Audit Log?

Using the Show Horizon3 Employee Access option, an Org Admin can choose to display or hide Horizon3 employee actions. When selected, this option displays a corresponding Access Reason column.

Horizon3 employees' personal information is automatically redacted, so you will not see individual names or emails.