Audit logs enable you to view all changes and actions done on your program so that you can review critical changes, find suspect actions, and investigate incidents for your program on HackerOne. Each log includes these details:
The user that performed the action
A description of the action that was performed
The name of the event
The user agent
The date and time of the action
To access your audit log, go to Program Settings > General > Audit Log.
You can also access the audit log via the API. See this article from the HackerOne API documentation to learn more: https://api.hackerone.com/customer-resources/#programs-get-audit-log
Note: You must be an administrator of your program to access this feature.
Searching the program audit log
To search your audit entries, you can construct search queries using a variety of quantifiers and filters.
You can search your audit log by:
Event
User
Date
Note: Cases aren’t sensitive when searching results.
Search based on the event
Each time an action is made on your program, the action is tagged with a corresponding event name. You can search based on the event name to filter your results. To search for specific events, use the event qualifier in your query. For example: event:teams.api_users.create
These are the event names that you can use to search:
Event Name | Details |
| Triggered when a new Agile Accelerator connection is created for your program. |
| Triggered when a new Agile Accelerator connection is updated for your program. |
| Triggered when a new API token is created. |
| Triggered when an existing API token is destroyed. |
| Triggered when a member creates an export of your program audit log. |
| Triggered when a new bounty is awarded. |
| Triggered when an admin creates a new team member group with permissions and members. |
| Triggered when an admin updates the name and/or permissions of an existing member group. Also triggered when members are added to or removed from this group. |
| Triggered when an admin destroys an existing team member group. |
| Triggered when a new member joins your program through an invitation. |
| Triggered when a new participant joins a report through an invitation |
| Triggered when a new JIRA OAuth connection is created for your program. |
| Triggered when the configuration of your program’s JIRA integration is updated. |
| Triggered when your program’s JIRA OAuth connection is verified. |
| Triggered when your program’s JIRA integration is destroyed. |
| Triggered when an admin or your SAML provisioner removes a member from your program. Also triggered when a member removes themselves from your program. |
| Triggered when a member exports one or more of your program’s vulnerability reports. |
| Triggered when a member exports all of your program’s vulnerability reports. |
| Triggered when a report is reassigned to another team. |
| Triggered when your program’s SAML provider settings are updated. |
| Triggered when a new Slack integration is created for your program. |
| Triggered when an existing Slack integration is destroyed. |
| Triggered when a new pipeline is created to one of your Slack channels. |
| Triggered when an existing Slack pipeline is destroyed. |
| Triggered when your program attributes are updated. |
| Triggered when the Gateway access status changes in program level for all hackers. |
| Triggered when the Gateway access status changes for selected hackers. |
| Triggered when an admin requests a Hacker Traffic Log. |
| Triggered when supporting routes have been updated. |
Search based on the user
You can also search your audit log based on the user that performed the event. To search based on the user, use the user qualifier. For example:
user:@hackbotfinds all events performed by hackbot.user:@hackbot user:data_migrationfinds all events performed by both hackbot and system user data_migration.
You can also use asterisks as a wildcard to broaden your search results to a defined subset of all possible characters. For example:
user:@h*tfinds all events performed by users that have a username that starts with h and ends with t.
Events can also be performed by the internal system on behalf of a user. You can search by these system users:
System User | Details |
| Initiated to destroy your program’s bidirectional integration to the JIRA cloud application. |
| Initiated when an event is performed through data migration. |
| Initiated when an event is performed during a product edition downgrade. This includes destroying API tokens and JIRA integration. |
| Initiated when a member is added to or removed from your program, or when a member’s team member groups are updated through SAML Just-In-Time Provisioning. |
| Initiated when setting up a sandboxed program. |
| Initiated when slack integration is destroyed due to an API error. |