Search for "Target" (Affected User) in Organization Audit Logs

XMLWordPrintable

    • 1

      Summary:
      Ability to search/filter Audit Logs by "Target" (Affected User) in ALQL and Audit Log UI

      Description:
      Currently, the Cloud Audit Log (ALQL) allows filtering by actor, activity, and other metadata, but it does not provide a dedicated field or free-text search to filter by the Target (the affected user or object of the action).

      Admins frequently need to identify all actions performed on a specific user account (e.g., when a specific account was deactivated, when its permissions were changed, or when it was removed from a site).

      While some "Expected Results" in related tickets (like ACCESS-2642) mention seeing the target in the results, this request specifically asks for the searchability of that target.

      User Story:
      As an Organization Admin, I need to be able to search the audit log for a specific username or account ID as the target of an activity, so that I can quickly audit the lifecycle and security changes of that specific account without manually scrolling through thousands of "Deactivated account" events.

      Proposed Solution:

      • Add a target or affected_user filter to ALQL (e.g., target = "username" or target.id = "account-id").
      • Add a "Target" filter dropdown/search box in the Audit Log UI at admin.atlassian.com.
      • Ensure free-text search (if restored) indexes the target/affected user field.

              Assignee:
              Unassigned
              Reporter:
              Fernando Muñoz
              Votes:
              2 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated: