Security logs
The team and system activity logs: what they record and where to find them.
ScanSuite keeps two activity logs: a team's log records what happened inside that team, and the system log records what happened to the installation as a whole. Passwords, keys and other secrets never appear in either.
The team log
A team's log is on the Teams page, on the Activity tab. Only team admins see it. It lists who did what, and when, in that team, newest first.
Pick a Topic to narrow the list, or type a person or a word into Find a person or word. The latest 50 entries are shown; Show older loads more. What each topic holds:
| Topic | What is recorded |
|---|---|
| People and access | Members added, removed, and their role or status changed; accounts created; passwords set through a link and reset; accounts deactivated and activated. For single sign-on: members linked to provider accounts, group mappings saved, people who joined through a directory group or whom the directory updated or removed, sign-outs by the provider, and password sign-ins while single sign-on is required. |
| Automation | Service accounts created and changed (including deactivated and activated); API tokens created and revoked. |
| Scanning | Allowed targets changed; the Team SSH key and the server account saved or removed; a discovered credential approved as the server account; scans stopped; reports downloaded; scans exported to CSV; the nightly retention clean-up when it deleted scans. |
| AI | The team's AI choice and its models changed; the monthly token budget set; AI used through a provider; one of the team's models tested. |
| Secrets and settings | Integrations changed (the names of the fields, never their values); new versions of stored secrets saved and old ones revoked; every use of a stored secret by a scan; stored secrets re-encrypted under a new key. |
| Products and findings | Products created, renamed, deleted, or their owner or criticality changed; finding status changes; assets added, changed or deleted; discovered credentials revealed or exported. |
The name of whoever acted is kept as it was at the time, so entries still read correctly after an account is renamed or deleted. The name of the person acted on is shown as it is now.
A person's own SSH key and Git repository API key on My account are personal, not team settings: saving or removing them is not recorded in either log.
The system log
The system log is in System Settings, on the Security tab, in the Activity card. Only system administrators see it. It records what concerns the installation rather than work inside a team. The latest 100 entries are shown; Show older loads more. Its topics differ from the team log's:
| Topic | What is recorded |
|---|---|
| Teams and system | Teams created, renamed, their status and limits changed, deletions scheduled and cancelled, teams deleted; the Nessus scanner saved and tested, Nessus capacity, the Git service and the default interface language set; single sign-on saved and tested, and single sign-on required or no longer required. |
| People and access | Accounts created and members added or changed by system administrators, including a system administrator adding themselves to a team; system administrators added and removed, including a grant from the command line. |
| AI | The system AI saved, which covers its task routing, connections and models; the system AI tested; a single system model tested; the LLM price table updated. |
| Secrets and settings | Old versions of stored secrets revoked. |
A change to a team's limits shows up here at once, which makes it the quickest way to find out who changed them: pick Teams and system and type the team's name.
Neither log can be exported from the interface. Container and service logs stay on the server; how to read them is described in Troubleshooting.
Last reviewed 2026-10-19