Audit log
Answer “who did this?” and “what did this agent touch?” from one page. The audit log records sign-ins, spaces, every network request and tool call from a space, credential changes, runs and admin changes. Admins can stream it to a bucket in their own cloud, and Marshal never deletes an event until that bucket holds a copy.
What you can do with it
- See what an agent touched. Open a run and select its Audit link. The log opens filtered to that run’s space: every request, tool call and blocked call, in order.
- Find who removed the prod token. Switch to Organization and pick Credential Deleted in the action filter. The row shows who did it and when.
- Prove it to an auditor. Stream every event to your own S3, GCS or Azure bucket as compressed NDJSON, and hand over the Export Compliance CSV from the admin dashboards for network policy evidence.
See it end to end: Let agents use secrets they never see.
How it works
Open Audit in the sidebar. Everyone can open it. What you see depends on your role.
| Role | What the page shows |
|---|---|
| Member | Your own events. |
| Admin or owner | Your own events by default. The Mine / Organization switch shows the whole org, and you can filter to one member. |
Reading the log is recorded too, as an audit.read event that says which scope was read.
What is recorded
The names below are the action names you see in the table.
| Area | Examples |
|---|---|
| Sign-in | auth.login, auth.register, auth.logout, auth.password_change |
| Spaces | space.create, space.stop, space.resume, space.archive, space.delete, space.compute.resize |
| Space updates on resume | space.manifest_refreshed (the old and new stack version, the images that changed, and the reason when an update could not be applied) |
| Launches with missing credentials | space.launch_with_missing_credentials, space.launch_refused_missing_credentials, org.missing_credentials_policy_change (the old and new value) |
| Network and tools from a space | http.request, tcp.connect, tool.call, mcp.call, db.connect, db.query |
| LLM use | llm.usage |
| Credentials | credential.add, credential.delete, credential.rotate, credential.owner_change |
| Runs | deputy.run_start, run.succeeded, run.failed, run.timed_out, run.canceled, run.park, run.wake, run.secrets_redacted (a secret hidden from a run’s output, with its kind and count, never the value; see Output redaction) |
| Deputies and triggers | deputy.create, deputy.mission_create, deputy.schedule_create, deputy.trigger_create |
| Questions and approvals | engagement.raise, engagement.respond, agent_req.respond |
| People and teams | member.role_change, member.remove, team.create, invitation.create, apikey.create |
| Manifests, stacks, network policies | manifest.create, stack.publish, stack.set_flags (Auto-upgrade modules or Also update to new major versions turned on or off), network_policy.update |
| Network approvals | space.policy_approved (an approved blocked domain), manifest.network_allow_add (a domain saved to a manifest with Approve & remember for next run) |
| Marketplace | marketplace.install, marketplace.uninstall, marketplace.auto_update_set, marketplace.auto_upgrade, marketplace.auto_upgrade_skipped |
| Automatic updates and holds | manifest.auto_move, manifest.hold, manifest.release_hold, manifest.revert, manifest.upgrade_held (events Marshal writes itself carry no person) |
| Webhooks | webhook.secret.rotated, webhook.format.changed, webhook.delivery.body_read |
| Connections | oauth.connected, slack.connected |
| Org settings | org.update, org.auth_provider_update, org.oauth_app_update |
| Security Center | security.version_blocked, security.version_unblocked, security.fix_applied (a Fix affected run), manifest.security_move and stack.security_publish (each manifest or stack moved off a blocked version), security.bulk_stop, space.security_stop and run.security_cancel (each space stopped and run cancelled for security), launch.refused_blocked_version (a launch or start refused, with the package, version and path), security.notify_owners, security.restart_outdated and space.security_restart (outdated spaces restarted) |
Security events carry a shield icon, for example a secret that Marshal kept from going to the wrong host. Blocked requests are recorded with the status Blocked.
Automatic updates read cleanly. A held manifest (manifest.upgrade_held) appears once for each version it is held back from, and a package version waiting for approval (marketplace.auto_upgrade_skipped) appears once, however many API replicas your deployment runs. An automatic package upgrade (marketplace.auto_upgrade) carries trigger: auto and no person; when a person installed the package, installed_by names them for context.
Reading the page
The page is live and refreshes every 15 seconds. The header states the time range it covers.
- Filter by space ID… limits the list to one space. The Audit link on a run page fills it in for you.
- All actions limits the list to one action, such as Credential Added or Run Failed.
- All statuses can be Allowed, Blocked or Error.
- The columns are Time, Count, Action, User, Space, Resource, Details and Status. Repeated events are grouped into one row with a count.
- Select a row to open its details. Select Load older to go further back.
Configure it
Keep a copy in your own cloud
Admins and owners can stream audit events to a bucket in their own cloud under Settings > Auditing.
- Choose a Provider: Amazon S3, Google Cloud Storage or Azure Blob Storage.
- Enter the bucket or container name, without a
s3://style prefix, and the Path prefix and Region if the form asks for them. The path prefix defaults toaudit. - Leave the credential fields empty to use the identity of the cluster (IRSA or an instance profile on S3, workload identity on GCS, managed identity on Azure), or enter credentials. The page shows an example of the permissions the identity needs.
- Select Test connection. A passing test writes an init file to the bucket.
- Select Save, or Save & enable when you switch provider.
Marshal writes events as gzip-compressed NDJSON files, one folder per day: <prefix>/<org>/YYYY/MM/DD/. The settings page shows the time of the last test and the last flush.
| Setting | Default | Range | What it controls |
|---|---|---|---|
| Flush interval | 60 seconds | 30 to 300 seconds | How often Marshal writes a new file. |
| Max events / flush | 5,000 | 1,000 to 10,000 | Writes a file early when this many events are waiting. |
How long events are kept
Both settings are under Settings > Configuration, in the Security group. Admins and owners can change them.
| Setting | Default | Range | What it controls |
|---|---|---|---|
| Audit Retention Days | 30 | 0 to 3650 | How long events stay in Marshal. 0 keeps them forever. |
| Tool-Call Audit Retention Days | 7 | 0 to 3650 | A shorter window for tool calls, which are most of the volume. 0 means tool calls follow Audit Retention Days. It cannot be longer than Audit Retention Days. |
Retention never costs you an event. Marshal removes an expired event only after your audit archive confirms that it holds a copy. Until an archive is set up, nothing is removed, whatever the windows say. The check runs once a day.
The Audit page header tells you which case you are in: “Covers the last N days” with the windows, or “Showing all retained history: nothing is trimmed for this organization.” Events older than the window stay in your bucket.
Edge cases
- A member’s view never shows other people’s events, even with the space filter.
- Grouped rows hide repeats, not data. The count shows how many events the row holds, and the detail panel shows them.
- The Export Compliance CSV on Dashboards > Operations is a network report, not an export of the audit log. It covers denied and blocked traffic for the last 90 days, your network policy mix, and stale credentials. See Admin dashboards.
Try it
Open any finished run and select Audit. You see every request and tool call that run made.