How-to Guides
Review Audit Logs
How to access and review system audit logs for compliance and investigation
How to Review Audit Logs
This guide shows you how to access and review the audit log system in IronCase.
Audit log access may be restricted based on your role. Supervisors and compliance officers typically have full access.
Accessing Audit Logs
- Go to Audit in the navigation
- You'll see a chronological list of all system actions
- Each entry shows:
- Timestamp
- User who performed the action
- Action type
- Resource affected
- IP address
- User agent (browser/device info)
Filtering Audit Logs
Use the filters to narrow your search:
By Action Type
- create - New records created
- read - Records accessed/viewed
- update - Records modified
- delete - Records removed
- login - User authentication events
- export - Data exports
By Resource Type
- Cases
- Evidence
- Persons
- Warrants
- Approvals
- Users
By Date Range
Select a start and end date to view activity within a specific period.
By User
Filter to see actions performed by a specific user.
Exporting Audit Logs
For compliance reporting:
- Apply your desired filters
- Click Export
- Select format (CSV or PDF)
- The export includes all filtered records with full details
Understanding Audit Entries
Each audit entry contains:
| Field | Description |
|---|---|
| Timestamp | Exact date/time (UTC) |
| User | Who performed the action |
| Action | What was done (create, read, update, delete) |
| Resource | What was affected (case, evidence, etc.) |
| Resource ID | Unique identifier of the affected record |
| Details | Specific changes or context |
| IP Address | Origin of the request |
| User Agent | Browser/device information |
Common Use Cases
Investigating Unauthorized Access
- Filter by resource type and date range
- Look for unusual read patterns
- Check IP addresses for anomalies
Compliance Audits
- Export logs for the audit period
- Filter by sensitive resource types (warrants, PII)
- Verify all access was authorized
Tracking Case Activity
- Filter by resource type "case" and specific case ID
- View all actions taken on that case
- Verify proper procedures were followed