Filter and investigate · BreezeAuth Docs

A busy organization records many events a day. The filters at the top of the Audit Logs page narrow the list down to what you’re looking for.

The filters

Filter	What it keeps
Actor type	User: actions performed by people and service users. System: actions BreezeAuth performed on its own.
Event type	One kind of event, such as User authentication failed. The list is sorted alphabetically: type a few letters to search it.
User	Events about one user of your organization. Search by name or e-mail.
Group	Events about one group, such as its changes and the members added to or removed from it.

To remove a filter, clear it with the × in the field.

When you use several filters, an event must match all of them. For example, Event type Organization user updated and User “Ana Souza” shows only the changes made to Ana’s user.

Important: the User filter finds events about the selected user, not events the user performed. To review what an administrator did, filter by Event type and look at the Actor column.

The filters are part of the page address. To share an investigation with a colleague who can also see the audit logs, copy the address from your browser: they will see the same filtered list.

Recipes

Who changed someone’s role or status?

Set User to the person.
Set Event type to Organization user updated.
Hover over the document icon of each entry to see the changes, such as adminRole or status, and check the Actor column to see who made them.

Is someone trying to break into an account?

Set Event type to User authentication failed.
Optionally, set User to the person.
Look at the IP address and Date columns. Many failures in a short time, or from an unknown address, deserve attention.

If it looks like an attack, end the user’s sessions and consider restricting access by network or country. Failed sign-ins are recorded for managed users only.

What changed in the security settings?

Set Event type to Organization updated.
Hover over the document icon to see which settings changed, such as mfaEnforced, minimumPasswordLength or applicationsAccessLocked.

Who was given access to an application?

Set Event type to Application assignment created for access given to individual users, or to Group application assignment created for access given to groups. The Entity / Resource column shows the application and the user or group.

When was an integration last used?

Set Event type to Service user credential used. Each entry is a credential being used to obtain an access token, with the service user in the Entity / Resource column and the IP address of the integration.

What happened during an incident?

Filter by Actor type User and go through the events of the period, from the oldest to the most recent, looking for unexpected actors and IP addresses. Then check the incident-response actions themselves, such as All organization active sessions ended or Password update required for everyone. See Incident response.

For developers: read the audit logs through the API

To export the audit logs to your own logging, SIEM or compliance system, read them through the BreezeAuth API with a service user that has the Auditor role:

curl -G "https://api.breezeauth.com/organizations/$ORGANIZATIONS_UUID/audit-events" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  --data-urlencode "page=0" \
  --data-urlencode "pageSize=50" \
  --data-urlencode "sort=createdAt,desc" \
  --data-urlencode 'filter={"type":"FilterItem","field":"eventType","operator":"FILTER_OPERATOR_EQUAL","value":"USER_LOGIN_FAILED"}'

page starts at 0. The response’s meta tells you the total number of records.
filter is optional. You can filter by eventType and actorType (with FILTER_OPERATOR_EQUAL or FILTER_OPERATOR_IN and a comma-separated list), and by applicationsUuid, usersUuid, membershipsUuid or groupsUuid (with FILTER_OPERATOR_EQUAL). To combine conditions, wrap them in {"type":"FilterOperator","operator":"AND","filterItems":[…]}.
Event types use their technical names, such as MEMBERSHIP_UPDATED or USER_LOGIN_FAILED. They are listed in the event catalog.

To react to changes as they happen instead of reading the history, use webhooks.