The Audit Log provides a comprehensive, timestamped record of all key activities occurring within the tenant. It is a critical tool for monitoring changes, troubleshooting issues, and ensuring compliance by giving administrators visibility into who did what and when.

Note: Audit logs are retained for a duration of 30 days.

Audit log events are categorized into the following areas:

  • Approval management
  • Cases
  • Case related tables
  • Connections
  • Dashboards
  • Global variables
  • Runners
  • Self-service apps
  • Tables
  • Tenant admin settings
  • Tenant user management
  • Users
  • Workflows
  • Workspace management

For a complete list of Audit Log events, see this section.

The audit logs do not track changes to data or content, such as workflow action updates, workflow executions, modifications to table records, or changes to cases.

​
Audit Log Table Content

Each log entry includes the following information:

  • Category – The general type of activity: Setting updates, System configuration, or User actions.
  • Action – The specific action that occurred.
  • Parameters – Key data relevant to the action, such as the affected username, Workflow name, or API endpoint.
  • Details – Additional context or information about the action.
  • Workspace – The name of the workspace where the action took place.
  • Done by – The email address of the user who initiated the action.
  • Date and Time – When the action was performed.

​
Categories and Events

​
External Audit Log Integration

Blink supports native audit log streaming to external SIEM systems, allowing organizations to integrate Blink audit data into tools like Splunk or Elasticsearch. This feature gives security teams greater visibility and control by centralizing audit logs for compliance, monitoring, and incident response without the need for manual exports. Tenant admins can configure their SIEM endpoint directly in Blink, test the connection, and begin streaming audit logs in real time.

1

Navigate to the 'Audit Log Settings' page

In the top right-corner of the Audit Log page, select the icon

2

Enter the Required Parameters

  1. Enable audit log streaming:

    • When enabled, audit logs will be delivered to your specified external destination in real time.
    • Disabling this will stop all log delivery and deactivate the form below.

  2. URL:

    • The destination URL for your external logging service.
      This must be a reachable HTTPS endpoint that supports log ingestion.

  3. Authentication Token:

    • A token or API Key used to authenticate requests to your external logging endpoint. This is required for secure delivery of audit logs.

  4. Destination Type- Select the type of destination where logs will be sent:

    • Splunk HEC
    • HTTP (Bearer Auth)
    • Elasticsearch
3

Optional-Test Connection

You can verify that Blink is successfully connected to your selected SIEM platform by clicking the ‘Test Connection’ button.