The audit log is the record of who did what in your organisation. This page lists what is written to it, area by area, with example action names you can type into the Action filter. The list is not exhaustive: a module adds its own actions, and Hermetry records many kinds of actions in total. How to read, export and verify the log is in Audit log .
What every row holds
Time, actor (member, API key, system or service), the person acted for when someone acted on another’s behalf, the action, its severity, the resource type and id, safe metadata, and the address and browser. Secrets, passwords, tokens, keys, note texts and attribute values are never written. High and critical rows also fire the audit.high_risk webhook.
Sign-in and accounts
Event Example actions Sign-in, sign-out, failed sign-in auth.login, auth.logout, auth.login_failedUnusual sign-in auth.login_anomalyLockout and security lock auth.account_locked, auth.account_security_locked, auth.account_security_unlocked, auth.account_unlocked_by_adminSecond factor auth.otp_verified, auth.totp_enabled, auth.totp_disabled, auth.recovery_code_used, auth.second_factor_failed, auth.second_factor_blocked, auth.two_factor_reset_by_adminPasswords auth.password_changed, auth.password_reset, auth.forgot_password, auth.password_change_forcedRegistration and verification auth.register, auth.email_verifiedSAML sign-in and just-in-time provisioning the SSO Activity of SAML SSO
Members, roles and access
Event Example actions Member added, changed, suspended, removed tenant_member.created, tenant_member.changed, tenant_member.suspended, tenant_member.deletedOwnership transfer tenant_member.ownership_transferredInvitations tenant_invitation.accepted and othersRefused permission permission.deniedAccess policy decisions per the policy log mode; see Access policies
Organisation, settings and data
Event Example actions Settings changed (the key, never a secret value) tenant_setting.changed, setting.created, setting.deletedOrganisation updated, deletion requested tenant.deletion_requested, tenant.country_changedDomains tenant_domain.verified, tenant_domain.suspendedData export tenant_export.requestedAudit log itself audit_log.anonymized, audit_log.purged
API keys and webhooks
Event Example actions Keys created, rotated, deleted, changed api_key.created, api_key.rotated, api_key.deletedFailed verification, unusual use, throttling api_key.verify.failed, api_key.anomaly.detected, api_key.throttledWebhooks webhook.created, webhook.deleted, webhook.secret_rotated, webhook.test_sent
Devices and profiles
Event Example actions Device created, changed, disabled, deleted, quarantined, activated iot_device.device.created, iot_device.device.updated, iot_device.device.disabled, iot_device.device.deleted, iot_device.device.quarantined, iot_device.device.activatedCredentials set, rotated, renewed, revoked iot_device.credential.set, iot_device.credential.rotated, iot_device.credential.renewed, iot_device.credential.revokedAttributes written or deleted (keys, not values) iot_device.attributes.saved, iot_device.attributes.deletedGateway children iot_device.child.created, iot_device.child.refusedProfiles (the changed fields) and provisioning keys iot_device_profile.profile.updated, iot_device_profile.provisioning.key_rotated, iot_device_profile.provisioning.key_revokedClaiming and release iot_provisioning.device.claimed, iot_provisioning.device.released, iot_provisioning.device.released_by_device, iot_provisioning.claim_window.openedCertificates iot_pki.certificate.revoked, iot_pki.certificate.renewal_requested, iot_pki.recovery.requested, iot_pki.recovery.approvedDevice settings iot_device_settings.job.created, iot_device_settings.section.changedEndpoints and polling iot_gateway.endpoint.created, iot_gateway.endpoint.updated, iot_gateway.endpoint.testedBlocked device logins iot_gateway.auth_blocked
The device page’s Log tab shows the rows of one device.
Commands, firmware and remote access
Event Example actions Commands sent and cancelled; catalog changes iot_rpc.request.created, iot_rpc.request.cancelled, iot_rpc.command.created, iot_rpc.command.deletedFirmware packages, assignments, signing keys, settings iot_ota.assignment.created, iot_ota.assignment.removed, iot_ota.package.revoked, iot_ota.key.revoked, iot_ota.settings.changedRouter panel sessions iot_remote_access.session.opened, iot_remote_access.session.closed
Alarms and rules
Event Example actions Acknowledge and clear by a person (never the note) iot_alarm.alarm.acknowledged, iot_alarm.alarm.clearedManual resolve of a critical alarm iot_alarm.alarm.resolved_manuallyDevice mutes iot_alarm.mute.created, iot_alarm.mute.deletedAlarm rule changes one row per saved version Rules cards iot_rules.rule.created, iot_rules.rule.deleted
Flows, sites, cameras, LoRaWAN
Event Example actions Flows created, deployed, rolled back; scripts changed; root flows bound automation.flow.created, automation.flow.deployed, automation.flow.rolled_back, automation.script.changed, automation.root.boundConnections with certificate checks switched off automation.config.tls_verify_disabledSites and assets, placement, relations iot_asset.asset.created, iot_asset.asset.moved, iot_asset.device.placed, iot_asset.relation.createdCameras iot_camera.camera.created, iot_camera.camera.live_enabled, iot_camera.camera.live_disabledLoRaWAN iot_lorawan.device.created, iot_lorawan.device.key_revealed, iot_lorawan.device.key_rotated, iot_lorawan.device.approved, iot_lorawan.gateway.credential_rotated
Event Example actions AI firewall incidents and modes ai_firewall.incident_status_changed, ai_firewall.action_mode_changedEmergency access by Hermetry operators marked on every row the access touches; see Regions and data residency
Tips
Filter by part of a name: iot_device.credential finds every credential change; auth.login finds sign-ins and failures.
Filter by Severity High and Critical for a daily review.
Forward high-risk rows with the audit.high_risk webhook to your own security monitoring.
