Read the audit log
See who did what, and when. Find out which domains an agent tried to reach last night, who added a credential, or what a run did before it failed. The audit log records what happens through Marshal: sign-ins, spaces, credentials, network requests, tool calls, and runs.
Before you start
- Role: any member. Members see their own events. Admins and owners can also see the whole organization.
Steps
- In the left rail, open Audit. The page title is Audit Log.
- If you are an admin or owner, choose the scope with the switch: Mine or Organization. With Organization, use the All users drop-down to look at one person.
- Narrow the list:
- Type a space ID in Filter by space ID….
- Open All actions and pick one action, for example Credential Added, Tool Call, HTTP Request, or Run Started.
- Open All statuses and pick Allowed, Blocked, or Error. To find calls the network policy stopped, pick Blocked.
- Read the table. The columns are Time, Count, Action, User, Space, Resource, Details, and Status. Click a row to open its details in a side panel. Events that repeat are grouped in one row: click the count (for example
×3) to list each occurrence. - To look further back, click Load older.
The list updates by itself. The header shows Live and “Refreshes every 15s”.
To keep a copy in your own cloud, an admin sends the log to S3, GCS or Azure: organization menu, Organization settings, then Auditing.
What you should see
- A table of events and the Live indicator.
- If nothing has happened yet: “No audit events yet”. If your filters match nothing but older history exists: “No audit events in this range”, with a prompt to load older events.
- After a change you make, for example adding a credential, a new row with that action after the next refresh.
Next
Approve a blocked domain: found a Blocked call your agent needs? Allow it in one click.