Audit logs

Audit logs are a record of all actions taken in Oblique. They’re enabled by default and can’t be disabled. Audit logs are stored for 31 days.

Caution

Audit logs record actions performed in Oblique and changes synced from your integrations. Changes Oblique makes automatically, such as expiry or attribute-based group membership changes, don’t appear in these logs. These do appear in the access change timeline.

Actions taken in an integration

When an action is taken outside Oblique through an integration, the audit event records the integration it was taken in as the author. For example, a change to an Okta integration such as importing a new user or updating user attribute lists the Okta integration as the author.

An integration is the target only of events about the integration itself, such as adding, updating, or removing it. When an integration reports an account, the event targets that account and the user it’s matched to, not the integration. To find everything an integration’s sync changed, filter by the integration as the Author.

Actions taken through a client

When someone takes an action in Oblique using a client, the audit log records the user as the author and the client they used:

• When a reviewer approves or closes a request from Slack, the Slack integration is recorded as the client.
• When a user makes a change through the MCP server, the MCP server is recorded as the client.
• When an admin makes a change using Terraform, the Terraform provider is recorded as the client.

Events

Target	Action	Description
User	CREATE	A user was imported.
User	UPDATE	A user’s metadata was updated, or the user was restored, by an integration.
User	DELETE	A user was deleted by an integration.
UserProfile	UPDATE	A user’s profile was edited.
UserAttribute	CREATE	A user attribute was imported from an integration.
UserAttribute	UPDATE	A user attribute was updated by an integration.
UserAttribute	DELETE	A user attribute was deleted by an integration.
CoreAttributeConfig	CREATE	The source integration for a core attribute was set.
CoreAttributeConfig	UPDATE	The source integration for a core attribute was changed.
Team	CREATE	A team group was created.
Team	UPDATE	A team group was edited, or Terraform started managing it.
Team	DELETE	A team group was deleted.
TeamMember	CREATE	A user was added to the team group.
TeamMember	DELETE	A user was removed from the team group.
TeamOwner	CREATE	A user or group was added as an owner of the team group.
TeamOwner	DELETE	An owner was removed from the team group.
Group	CREATE	An attribute-based group or reporting group was created.
Group	UPDATE	An attribute-based group or reporting group was edited, or Terraform started managing it.
Group	DELETE	An attribute-based group or reporting group was deleted.
GroupOwner	CREATE	A user or group was added as an owner of an attribute-based group or reporting group.
GroupOwner	DELETE	An owner was removed from an attribute-based group or reporting group.
Resource	CREATE	A resource was imported.
Resource	UPDATE	A resource was updated by an integration, or its sync mode was changed.
Resource	DELETE	A resource was deleted by an integration, or the integration with that resource was removed.
ResourceOwner	CREATE	A user or group was added as an owner of a resource.
ResourceOwner	DELETE	An owner was removed from a resource.
Entitlement	CREATE	An entitlement was created.
Entitlement	UPDATE	An entitlement was edited.
Entitlement	DELETE	An entitlement was revoked.
Request	CREATE	A request was created.
Request	UPDATE	A request was approved, applied, or closed, or its reviewers or auto-apply settings were edited.
AccessReview	CREATE	An access review was started.
AccessReview	UPDATE	A review’s scope was confirmed, or the review was completed or re-opened.
AccessReview	DELETE	A review was deleted.
AccessReviewApp	CREATE	An app was added to a review’s scope.
AccessReviewApp	UPDATE	A review captured an app’s accounts when the scope was confirmed.
AccessReviewApp	DELETE	An app was removed from a review’s scope.
AccessReviewAccount	CREATE	An account was captured or manually added to an app in a review.
AccessReviewAccount	UPDATE	An account in a review was captured again or marked as remediated.
AccessReviewAccount	DELETE	An account was removed from an app in a review.
AccessReviewDecision	UPDATE	A decision was recorded, changed, or cleared for an account in a review, including any notes.
AccessReviewScreenshot	CREATE	A screenshot was attached to an app in a review.
AccessReviewScreenshot	UPDATE	Accounts from a screenshot were added to an app in a review.
AccessReviewScreenshot	DELETE	A screenshot was removed from an app in a review.
AccessReviewRemediationEvidence	CREATE	Remediation evidence was added for an app in a review.
AccessReviewRemediationEvidence	DELETE	Remediation evidence was removed from an app in a review.
AccessScreenshot	CREATE	An image upload for an access screenshot or remediation evidence started.
AccessScreenshot	UPDATE	An image finished uploading.
AccessScreenshot	DELETE	An image was deleted.
Integration	CREATE	An integration was added.
Integration	UPDATE	An integration’s settings were edited, including approvals from Slack, or it was reconnected with new credentials.
Integration	DELETE	An integration was removed.
IntegrationOwner	CREATE	A user or group was added as an owner of an integration.
IntegrationOwner	DELETE	An owner was removed from an integration.
IntegrationInstallLink	CREATE	An install link was created.
IntegrationInstallLink	DELETE	An install link was used to add an integration.
IntegrationAccount	CREATE	An account was imported from an integration, including the user it was matched to.
IntegrationAccount	UPDATE	An account’s details were updated by an integration, or it was matched to or unmatched from a user.
IntegrationAccount	DELETE	An account was deleted by an integration.
ServiceAccount	CREATE	An API key was created.
ServiceAccount	DELETE	An API key was revoked.
Admin	CREATE	An admin was added.
Admin	UPDATE	An admin was edited, or Terraform started managing it.
Admin	DELETE	An admin was removed.
Owner	UPDATE	The organization owner was changed.
RecommendationGroup	UPDATE	A recommendation was ignored.

Note

Connecting or disconnecting an MCP client to Oblique’s MCP server isn’t recorded in Oblique audit logs. Because authentication uses OAuth 2.0 through your identity provider, those events should be available in your identity provider’s logs.

View logs

You must be an admin to view audit logs.

Navigate to the Logs page.

The system displays the most recent logs by default, including information about the actor, action, and target. Select an event to open its details, including a one-line summary of the action and an API diff of the values for the affected target.

View authentication logs

Oblique’s audit logs are a record of all actions taken in Oblique or synced to Oblique, including authorization changes. Oblique doesn’t track when a user authenticates, fails to authenticate, or otherwise uses their access.

For Okta resources, you can see authentication events in Okta’s admin system log. From an Okta resource’s detail page, select More in the header, then View logs in Okta. Okta opens with the system log filtered to that resource.