> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit Logs

> A record of the actions performed through Myrmex — who did what, and when. Not a log store: Myrmex audits its own platform activity, it does not ingest your telemetry.

import { CardGroup, Card, Note, Tip } from '@mintlify/components';

**Audit Logs** is Myrmex's own accountability trail — a record of the actions people and agents perform **through the platform**, each attributed to who did it and when. It answers *"who changed this, approved that, or ran this action — and when?"* across your organization.

<Note>
  **Myrmex does not store your logs.** There is no SIEM-style event repository
  here: Myrmex reads your systems in real time, on demand, and never ingests or
  retains their telemetry. The only logs Myrmex keeps are **its own audit logs** —
  the actions taken through Myrmex itself. To query events from a connected SIEM,
  operate that tool live through its [integration](/documentation/integrations/overview).
</Note>

## What Gets Recorded

The audit log captures the meaningful actions taken through Myrmex — by users and by the AI agents acting on their behalf — for example:

<CardGroup cols={2}>
  <Card title="Access & session activity" icon="right-to-bracket">
    Sign-ins and account activity within the platform.
  </Card>

  <Card title="Changes to your environment" icon="pen-to-square">
    Devices and integrations added, edited, authorized, or removed; configuration
    changes applied through Myrmex.
  </Card>

  <Card title="Approvals & executions" icon="circle-check">
    Change approvals and rejections, actions run on hosts and integrations, and
    automations executed.
  </Card>

  <Card title="Administration" icon="users-gear">
    Role, policy, user, and organization changes made in settings.
  </Card>
</CardGroup>

Each entry records **who** performed the action (a user or an agent), **what** it was, and **when** — giving you a clear, attributable history for governance, incident review, and compliance.

## Using the Audit Log

The audit log opens as a tab in the Workspace, scoped to the [context](/documentation/get-started/concepts#how-your-account-is-organized) or organization you're reviewing. Use it to reconstruct a sequence of events, confirm who authorized a change, or export a trail for an auditor.

<Note>
  Audit logging is part of Myrmex's governance capabilities and is an
  **Enterprise** feature — a full trail of the actions users perform through
  Myrmex. See [Plans & Licensing](/documentation/get-started/license).
</Note>

## Audit Logs vs. AI-driven Audits

These sound alike but are different tools:

<CardGroup cols={2}>
  <Card title="Audit Logs (this page)" icon="clipboard-list">
    A trail of **actions performed in Myrmex** — who did what, when. About
    accountability.
  </Card>

  <Card title="AI-driven Audits" icon="robot" href="/documentation/detection-response/audits">
    Ask the AI to **audit a system's security** and it builds an interactive
    assessment. About the state of your environment.
  </Card>
</CardGroup>