# Auditing

**Auditing** logs, stores and exposes all significant activity happening on Data Platform — so you can meet compliance obligations, enforce internal governance, and provide transparency to your stakeholders.

Every create, update, delete and administrative action performed on a resource is recorded as an audit event. Events are retained and can be filtered, browsed and reviewed by authorized users.

?> **Initial release.** Auditing is being rolled out progressively. Additional services and audit event types will be added in upcoming releases — the lists on this page will be kept up to date as coverage expands.

- [Access levels](#access-levels)
- [Project-level auditing](#project-level-auditing)
- [Organization-level auditing](#organization-level-auditing)
- [Roles](#roles)
- [Filters](#filters)

---

## Access levels

Auditing is exposed at **two levels**:

| Level | Where | What it contains |
| :--- | :--- | :--- |
| **Project** | Control Center → Auditing (inside a Project) | Events scoped to a single Project: Connectors, Lakehouse Manager, Data Processing Engine, Analytics Manager and project IAM activity |
| **Organization** | Organization Settings → Auditing | Events scoped to the organization itself. Currently covers organization IAM and member management. Coverage for billing, quotas and similar organization-level activity is coming in a future release |

!> Organization-level audit events **do not** include activity that happened inside a Project. To review project activity, open the corresponding Project and use its own Auditing page.

---

## Project-level auditing

In the [Control Center](/en/product/cc/index.md) of any Project, open the **Auditing** tab to see every significant event that happened inside that Project.

![Project-level auditing page](picts/project-audit.png)

Each event is displayed with the following columns, in order:

| Column | Description |
| :--- | :--- |
| **Time** | When the action occurred |
| **User** | User or service account that performed the action |
| **Action** | The operation performed (create, update, delete, etc.) |
| **Resource** | The specific resource acted upon (e.g. a table, workflow, dashboard) |
| **Service** | The service the event comes from (Connectors, Lakehouse Manager, DPE, Analytics Manager, IAM) |

You can [filter](#filters) by service, resource type and a custom time window, and switch to the [organization-level](#organization-level-auditing) view at any time from the same page.

### Event details

Click the **info icon** at the end of any row to open the event detail panel. From there, two views are available:

- **Event details** — the full payload of the event: actor, action, target resource, timestamps and any metadata recorded with the event.

  ![Event details view](picts/event-details.png)

- **Comparison** — a side-by-side diff of the resource *before* and *after* the action, so you can see exactly what changed.

  ![Event comparison view](picts/event-comparison.png)

---

## Organization-level auditing

From **Organization Settings**, open the **Auditing** tab to see organization-level activity.

![Organization-level auditing page](picts/organization-audit.png)

Currently tracked at the organization level:

- Organization IAM (roles, policies, authentication providers)
- Member management (invitations, removals, role assignments)

Coming in upcoming releases:

- Billing activity
- Quotas
- Other organization-level settings

The organization-level view is scoped strictly to organization-level resources. For Project-internal activity, open the Project and use its own Auditing page.

---

## Roles

Auditing access is gated by two dedicated roles. The same two role names exist at **both levels** (organization and Project):

| Role | Capabilities |
| :--- | :--- |
| **Audit Trail Admin** | Full management of auditing: view all events and configure audit settings at the scope of the role (organization or Project) |
| **Audit Trail Viewer** | Read-only access: view audit events at the scope of the role (organization or Project) |

A user needs the organization-level role to see the organization Auditing page, and the project-level role to see a Project's Auditing page. Assign them the same way as any other role from the [Users, Roles & Groups](/en/product/iam/users/index.md) page.

---

## Filters

### Services (project level)

At the Project level, events can be filtered by service:

- **Connectors**
- **Lakehouse Manager**
- **Data Processing Engine**
- **Analytics Manager**
- **Identity Access Manager**

### Resources

Once a service is selected, the resource filter exposes the resource types available for that service. The full list of audited resource types is:

| Category | Resource types |
| :--- | :--- |
| Lakehouse Manager & Connectors | Source, Table, Attribute, Rule, Dataset, Virtual Attribute, View, Policy Tag, Policy Tag Binding |
| Data Processing Engine & Analytics Manager | Query, Dashboard, Repository, Workflow, Action, Environment, Notebook, Application |
| Identity Access Manager | Role, Service Account, User, Group |

### Time window

Every audit view lets you scope events to a specific time window. You can pick one of the preset ranges or define your own:

- **Today**
- **Yesterday**
- **Last 1 hour**
- **Last 6 hours**
- **Last 24 hours**
- **Last 7 days**
- **Last 30 days**
- **Custom** — pick exact **From** and **To** dates and times on the calendar, with a selectable timezone.

---

### Need help? 🆘

> At any step, you can ask for support by reaching out to us on the Data Platform Channel within the [Discord Server](https://discord.com/channels/850031577277792286/1163465539981672559). You can also find a step-by-step guide in the [support](/en/support/index.md) section.