View the DLP audit trail

View the audit trail to track all administration actions performed on the DLP service. Each action — creation, modification, deletion of DLP rules, DLP policies, DLP detectors, ruleset publication and user management — is recorded with the user, timestamp and action details.

Permissions

info

This action requires the following DLP (Data Loss Prevention) role:

• viewer

Console

Console

1 / 3In the DLP console, click Audit Logs in the side menu.

1 / 3

1. In the DLP console, click Audit Logs in the sidebar.

Filtering events

Use the available filters to refine the search:

• Action: filter by action type — rule_create, rule_update, rule_delete, ruleset_publish, ruleset_rollback, detector_create, detector_update, detector_delete, policy_create, policy_update, policy_delete, user_create, user_update, user_delete, user_password_reset;
• Time range: filter by time period.

Event details

Each event displays:

• the user who performed the action;
• the action type;
• the action target (rule, detector, policy, user, ruleset);
• the target name;
• the action details;
• the timestamp.

API

The GET /api/v1/audit request queries the audit trail.

Query parameters

Parameter	Description
action	Filter by action type
time_start	Start date of the period (ISO 8601)
time_end	End date of the period (ISO 8601)

Response example

{
  "entries": [
    {
      "id": "audit-001",
      "user_name": "admin",
      "action": "rule_create",
      "event": "Created rule block-aws-keys",
      "target_type": "rule",
      "target_name": "block-aws-keys",
      "details": "Platform: mistral-platform, Action: block",
      "created_at": "2026-08-27T10:00:00Z"
    },
    {
      "id": "audit-002",
      "user_name": "admin",
      "action": "ruleset_publish",
      "event": "Published ruleset v3",
      "target_type": "ruleset",
      "target_name": "v3",
      "details": "Description: Added AWS key blocking rule",
      "created_at": "2026-08-27T10:30:00Z"
    }
  ],
  "total": 2
}