Enterprise workspaces record an audit log of administrative and access events: sign-ins, role changes, taxonomy edits, exports and report views.
Getting the events out
- SIEM: stream to Splunk, Sentinel, Elastic or any syslog / HTTPS collector.
- Webhooks: subscribe to events (user added, threshold crossed, device stopped reporting).
- API: pull the audit log on a schedule.