> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pharussecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Audit trail
> The append-only log of every determination, approval, filing and setting in your workspace: how to read it, filter it and export it.
**Plans:** Every plan, and Free. **Who:** every member views and exports it. Nobody can change or delete an entry.
Pharus writes an audit entry for every action that matters to a reporting decision: matches, incidents, determinations, approvals, filings, pages, settings and more. Each entry records what happened, who or what did it, and when. The trail is append-only: "Entries can't be changed or deleted." It is the record you show when someone asks how a decision was made.
## What is logged
Entries are written in the same step as the change itself, so a change and its entry can't come apart. Each one names its actor: a member by name, **Pharus** for automatic events, an API token for SBOM uploads, or the partner on a review link.
| Type filter | Examples of what is logged |
| - | - |
| **Incidents and paging** | Incidents opened automatically or declared, details updated, the awareness time corrected (with the old time, the new time and the reason), a fix marked as available, users informed, incidents closed and reopened, pages sent, escalated, acknowledged or cancelled, deadline warnings sent, drills started and completed |
| **Determinations** | Determinations recorded, approved and declined (with the revision and the comment), every regime assessment with its reason, the DORA monthly check for recurring incidents |
| **Filings** | Reports marked as submitted (with the recipient and the time), receipts recorded (with the reference), filings voided (with the reason), more information sent for a report, expert help and partner review, reports to a component's maintainers |
| **SBOMs and matches** | SBOMs received, unreadable or retired, matches against CISA KEV and EUVD, possible name-only matches and their confirmation, VEX status changes |
| **Settings and members** | Product families and support periods, API tokens, members invited, joined, changed role or removed, the on-call rota, company settings, readiness to file in the SRP, alert destinations, verified phone numbers, billing changes, the workspace being created, exported, closed or reopened |
**All events** also shows the entries outside these five types: disclosure reports and replies, advisories, the weekly exposure digest and the technical documentation.
Some actions remove data but leave their entry. Removing a reporter's personal data from a disclosure report, or deleting a technical documentation attachment for good, is logged like any other action; the entry stays.
## The Audit trail page
Select **Audit trail** in the sidebar. The page shows "Every event, in the order it happened", newest first and grouped by day ("Today", "Yesterday", then the date). Times are Oslo time. An entry that belongs to an incident links to it.
The page shows 100 entries at a time. **Show older** goes further back, and **Back to newest** returns to the top.
### Filter the trail
Three filters sit above the list. They combine, and **Clear filters** resets them.
| Filter | Choices |
| - | - |
| **Incident** | **All incidents**, or one incident by reference and title |
| **Actor** | **Everyone**, **Pharus (automatic)**, **Partner (review link)**, or one member |
| **Type** | **All events**, **Incidents and paging**, **Determinations**, **Filings**, **SBOMs and matches**, **Settings and members** |
## An incident's Audit tab
Every incident has an **Audit** tab: "Every action on this incident, oldest first. Times in Oslo time." It shows the number of entries and has a **Print** button, so you can hand over one incident's full history. To filter or export one incident, use the **Incident** filter on the Audit trail page.
## Export the trail
Select **Export CSV** on the Audit trail page. The file holds the entries that match your current filters, oldest first (the order a reviewer reads them), up to 50 000 entries per file. Every member can export, also while the workspace is read-only.
| Column | What it holds |
| - | - |
| `id` | The entry's number |
| `occurred_at_oslo` | Date and time in Oslo time, with the zone |
| `occurred_at_utc` | The same moment in UTC, ISO 8601 |
| `action` | The event's key, for example `report.submitted` |
| `title` | The entry as the page shows it, for example "Marked notification as submitted" |
| `detail` | The details line of the entry |
| `actor` | Who did it: a name, Pharus, API token or Partner |
| `actor_kind` | `user`, `system`, `api_token` or `partner` |
| `incident` | The incident reference, if any |
| `params` | The entry's recorded values, as JSON |
* The file is UTF-8 with a byte-order mark, so spreadsheet programs read æ, ø and å correctly.
* `title` and `detail` are in the language you use the app in.
* A cell that starts with `=`, `+`, `-` or `@` gets a leading apostrophe, so opening the file in a spreadsheet can't run it as a formula.
* The file is named after your workspace and the date, and after the incident when you filtered by one, for example `pharus-audit-nordlys-INC-0042-2026-10-14.csv`.
Owners and admins can also download everything the workspace holds, the audit trail included, as one file under **Settings → Company**. See [Data and deletion](/workspace/data-and-deletion).
## Entries can't be edited or deleted
Nobody in the workspace can change or remove an entry, whatever their role. A correction is a new entry, such as a corrected awareness time or a voided filing, and the original stays. If a member leaves or deletes their account, the entries they made keep their name. The trail is deleted only together with the whole workspace. See [Data and deletion](/workspace/data-and-deletion).
## Related
The determinations and approvals the trail records.
The filings, receipts and voids the trail records.
The quarterly summary for your board.
How long the workspace's data is kept, and how to export it.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.