Read and filter your audit log

The Activity page is a complete record of what has happened on your account: sign ins, failed sign ins, check ins, vault changes, uploads, downloads, security changes and billing events, each with the time and the address it came from.

Filtering

• Categories across the top group events into sign in and security, account, vaults, files and billing, with a count beside each.
• Event type narrows to a single kind of event, for example only failed sign ins.
• Search matches the detail text and the address, so you can find every event from one address, or every event mentioning one vault or file name.
• From and to restrict to a date range.
• Reset clears everything and returns to the full list.

Times are in your timezone

Every timestamp is rendered in the timezone set on your profile, not the timezone of the device you are reading from. Each row shows how long ago it was, with the exact date and time underneath. Set your timezone under Profile if the times look wrong.

Exporting

Export CSV downloads the events matching your current filters, not just the page on screen, so filtering first and exporting second gives you exactly the subset you want. The file opens directly in Excel, Numbers or Sheets, and the timezone used is named in the first column heading.

What is worth looking at

Certain entries are highlighted because they are worth a second look:

• Failed sign in attempt from an address you do not recognise.
• Password changed or Email address changed that you did not do.
• Two factor authentication disabled, which no attacker should ever be able to reach.
• Backup code used, if it was not you using it.
• Vault paused that you did not pause. This is the quiet one, and it is the reason to read this page occasionally.

If something looks wrong

Change your password, which signs out every other session immediately, then turn on two factor authentication, then check that every vault is still armed with the interval you expect.