---
title: "Auditing secrets"
canonical: "https://support.appfire.com/space/SECC/477725973/Auditing%20secrets"
format: markdown
---
> Macro (aura-html)

> ℹ️ [DECember 2023]  We have released an improved version with enhanced security of Security and Encryption for Confluence Cloud. Check out the [next steps for administrators](https://appfire.atlassian.net/wiki/spaces/SECC/pages/477727589).

## <span style="color: #172b4d">Overview</span>

<span style="color: #172b4d">Audit logs show chronological events around secrets in the space, who interacted and made changes to the secrets.</span>

<span style="color: #172b4d">You can use the audit logs</span>

- <span style="color: #172b4d">to run audit reports</span>
- <span style="color: #172b4d">review access to secrets</span>
- <span style="color: #172b4d">find out any unintended access</span>
- <span style="color: #172b4d">detect suspicious activities</span>
- <span style="color: #172b4d">provide supporting evidence of your organization's security compliance</span>

<span style="color: #172b4d">The audit logs page shows event records of all secrets within the space.</span>

![image](media://f0552e63-4cff-440f-9ee0-523eadc9206d)

> ℹ️ <span style="color: #172b4d">Records are kept for 90 days and cannot be deleted. Only the space administrators are able to see audit logs.</span>

## <span style="color: #172b4d">Accessing audit logs</span>

On the Confluence left-hand sidebar under **Apps**

- choose **Secret Administrator **(1)

![image](media://95a17304-2e1a-4c21-843f-3977c35e5261)

- <span style="color: #172b4d">select the </span><span style="color: #172b4d">**Audit logs**</span><span style="color: #172b4d"> tab (2)</span>

> 📝 You need space administrator permission to see the **Audit logs** tab.

- <span style="color: #172b4d">a table of audit information is displayed</span>

> ✅ <span style="color: #172b4d">Use the input box at the top of the audit table information to filter by secret name or secret ID (3)</span>

## Audit log details

The following items are available for each row in the audit logs.

| Item | Description |
| --- | --- |
| **Date** | The date and time (in your current timezone) the event took place. |
| **User** | The Confluence user who performed the event. |
| **Change** | The type of event.<br>The event type can be one of the following<br>- **Created**
- **Modified**
- **Deleted**
- **Restored **(see [Restoring deleted secrets](https://appfire.atlassian.net/wiki/spaces/SECC/pages/477725994))
- **Purged** (permanently deleted, cannot be restored)
- **Decrypted** (successful access to the secret)
- **Attempted** (failed access to the secret, typically due to insufficient permissions) |
| **Item affected** | Name of the secret (and its ID). |
| **Origin** | The page location where the event was performed.<br>When marked as "**-**", the event was performed in the main secrets page or administration pages (available from the sidebar). |
| **Version** | The version of the secret when the event took place. |