The console keeps two audit records: what people did in the console, and what your endpoints did to their own settings. Both are hash chained, so the console can tell you whether either has been edited. Use them to answer “who disabled that account” or “why is this laptop’s password policy different”, and as evidence for an auditor.
Both are on Settings > Audit logs, on two tabs: Console actions and Endpoint changes. Every plan includes the audit log, including Home Lab.
Who can read them
Section titled “Who can read them”Reading either record needs audit:read. Among the built-in roles, the Owner,
Support Manager, Field Technician, and Support Rep hold it. The Accounting role
does not. Anyone without it sees You do not have permission to read the audit
log. Ask an owner for the audit:read permission.
The audit log is read only. Nobody can edit or delete an entry from the console.
The two records
Section titled “The two records”| Tab | Records | Kept |
|---|---|---|
| Console actions | Every action taken in the console by an owner or a technician, actions the system took on its own, and changes an agent reported from an endpoint. | Not pruned. |
| Endpoint changes | Every setting an endpoint applied, reverted, or corrected on itself, with what it was before. | Pruned after your compliance retention period. |
They are kept apart on purpose. A question about a person is answered by Console actions, and a question about an endpoint by Endpoint changes. A merged list would hold both answers and make each harder to find.
Neither record includes Outpost’s own internal records, which belong to Outpost.
How the hash chain works
Section titled “How the hash chain works”Each entry carries a hash of the entry before it. Editing, inserting, or removing an entry anywhere in the chain changes every hash after it, so the break can be found. Each tab checks its chain when it opens and shows the result at the top:
| Shown | Meaning |
|---|---|
| Chain verified, followed by the number of entries | Every entry is intact. |
| Chain verified from checkpoint followed by an entry number and count | Older entries were removed by retention pruning, and everything from that checkpoint on is intact. The page adds Older entries were removed by retention pruning below that checkpoint. |
| Chain broken at entry followed by an entry number | The record was changed outside the console at that entry. Treat it as a security incident. |
Search console actions
Section titled “Search console actions”The Console actions tab lists entries with When, Person, Action, Target, and From.
- Find by target matches the exact id of an endpoint, client, person, or profile. Paste the id from the page of whatever you are investigating.
- The filters narrow by Source, Person, Action, Target type, and Recorded date. Source is Console, System, or Agent, and on the MSP plan also MSP technician (your team working inside a client), Client portal (a client’s portal user), and Public link (someone using a quote, project, or pay link). The From chips above the list set it in one step.
- The saved views are Last 7 days, which is the default, Last 24 hours, Endpoint events, and Everything. You can save your own views. They are private to you.
- Endpoint event and Only actions that changed access or permissions narrow the entries already on the page, not the whole log. Widen the dates to reach further back.
Select an endpoint event’s action to see its details, including its severity and the record the agent reported.
Export console actions
Section titled “Export console actions”On Console actions, select Export CSV or Export JSON. The file holds the entries in the dates and Source you chose. Other filters do not narrow it. The JSON file carries each entry’s hash and the hash of the entry before it, so an auditor can check the chain without the console.
Search endpoint changes
Section titled “Search endpoint changes”The Endpoint changes tab lists entries with When, Endpoint, Setting, Change, Outcome, and Actor.
- Find by setting matches a setting’s catalog key exactly, such as
password.min_length. Copy the key from the profile or from Effective config. - The saved views are Last 7 days, Last 24 hours, Changes that failed, Drift corrections, and Everything.
Select a setting to see the policy the endpoint was applying when it made the change.
Related
Section titled “Related”Content is licensed CC BY 4.0. Code samples are MIT. Outpost and the Outpost mark are trademarks of Outpost Business Solutions, PBC and are not covered by either license.