Skip to content
FortressFlag Docs

Export the audit log

Every state change in FortressFlag lands in an append-only audit log: who did it, what changed (with before and after values), when, and from where. When an incident review asks “what changed at 14:32?” or an auditor asks “show me who touched production in March”, this is the screen — and the export — that answers.

You’ll need to be an Admin or Owner; the log names your teammates and traces their actions, so it’s the team’s oversight surface, not its day-to-day one.

Browse and filter

Section titled “Browse and filter”

Open Admin → Audit. The newest events are on top, and the filters cut the list down to the question you’re actually asking: by member, by action, by the resource touched, by time. Combine them — changes to this flag, by this person, this week — and the answer is usually a screen, not a search.

A few things you’ll notice in the entries:

  • Toggles show before and after, so “who turned it off” and “what was it before” are the same lookup.
  • Applied production proposals name both people — proposer and approver.
  • Some entries have a machine as the actor: changes made by your identity provider through provisioning are attributed to the provisioning token, not to a person. That’s accurate — that’s who did it.

Export as CSV

Section titled “Export as CSV”

The CSV export takes your current filters with it — filter first, then export, and the file contains exactly what you were looking at. From there it’s spreadsheet territory: attach it to the incident review, hand it to the auditor, archive it with the quarter’s records.

What makes it trustworthy

Section titled “What makes it trustworthy”

The log is append-only: entries are written by the system as changes happen, and there’s no edit or delete — not in the dashboard, not for Admins, not for us. What it says happened, happened.

Where to next

Section titled “Where to next”