Viewing the audit trail in Platform Manager
The audit trail records every data change made in SC//Reliant™ Platform Manager (RPM). This page covers reviewing those records interactively in RPM. For an introduction to the audit trail and the structure of an audit record, see Using the audit trail.
Accessing the audit trail
To open the audit trail, select Site administration → Audit Trail in the RPM left navigation. It opens to today's changes.
Reading the audit trail
Each row represents a single field-level change, so one action, such as creating a user or updating a node group, can produce a group of rows that share the same date, user, and item. RPM renders the same data your Elasticsearch index holds, and maps each column to a field in the record schema.
| Column | Description | Field in the record schema |
|---|---|---|
| Date | The date and time of the change, in your local time zone (for example, CDT). | created_at, which RPM converts from UTC |
| User | The user account that made the change. | author |
| Item | The object that changed, for example a user, a node group, or a shell info record. The item is typically a link, so you can go straight to the affected object. | item_type and item_name |
| Field | The property or attribute of the item that changed, for example role, node_group_properties, or my_rvc_version. | one entry from the fields array |
| Current | The value of the field after the change. | the positionally matching entry from the current array |
| Previous | The value of the field before the change. -- means the field had no prior value, which is typical for a new record. | the positionally matching entry from the previous array |
For example, changing a user's role produces one row on the role field, with Current Role: Manager and Previous Role: Editor. Creating a record, such as shell info for a user, produces one row per field, each with Previous --.
Searching and filtering
The controls at the top of the page narrow the records shown.
| Control | Description |
|---|---|
| Search | Filters the records by a text term, matching the user, item, field, and values. |
| Date | Selects the timeframe to display, defaulting to Today. Click the control to open a picker with two ways to set it. Under Quick select, choose a direction (Last or Next), enter a number, choose a unit (hours, days, weeks, months, years), and click Apply, for example the last 15 hours. Under Commonly used, pick a preset range: Today, Yesterday, This week, Week to date, This month, Month to date, This year, or Year to date. The arrows at the top of the picker step the selected timeframe backward and forward. |
| Refresh | Reloads the table with the most recent records matching the current search and date selection. |
Click the Date, User, Item, or Field column header to sort by that column, ascending or descending.
When to use a SIEM instead
RPM suits interactive review. If you need standing alerts on high-risk changes, dashboards over change activity, or audit history alongside your other security telemetry, ingest the records into your own platform. For more information, see Integrating the audit trail with a SIEM.
Related documentation
- Using the audit trail: what the audit trail records, and the audit record schema.
- Integrating the audit trail with a SIEM: ingesting audit records into a third-party platform.