Audit logs
Filter and read the immutable audit trail of logins, passwords, 2FA, administrative actions and access to Law 5651 records, and use it in incident reviews.
The Audit Logs page shows the append-only record of security and administrative events. Records cannot be updated or deleted; they remain even if the user is deleted.
What is recorded
| Group | Example events |
|---|---|
| Login | auth.login.success, auth.login.failure (reason: unknown account, wrong password, lockout …), auth.register |
| Sessions | auth.logout_all, user.sessions.revoke, auth.refresh.reuse_detected (suspected theft) |
| Password and 2FA | auth.password.change, user.password.reset, auth.mfa.enroll, auth.mfa.disable, user.mfa.reset |
| Administration | customer.*, bayi.*, package.*, settings.*, translation.*, seo.*, session.terminate |
| Reseller credit | bayi.credit.movement, bayi.credit.rate_update, bayi.package.sale |
| Login page | portal_config.publish, portal_config.rollback, portal_experiment.start / stop |
| Law 5651 access | log5651.list, log5651.view, exports, official request and legal hold actions |
| Devices | Router file downloads, login page setup |
Secrets such as passwords, tokens, codes and API keys are never written; email, phone and ID numbers are masked. For changes, the names of changed fields are written, not the values. Failed authorization attempts (401/403) and read-only screens are not recorded.
Filter
- Quick filters: common event groups with one click.
- Actor: a user ID or email; Role: administrator, reseller or customer.
- Action: an exact event name or a prefix ending in
*(auth.login.*,log5651.*). - Target type and Target ID.
- From / To: Istanbul days, end day included.
Opening a row shows Request ID, Browser and Details. The request ID is for matching with application logs.
Incident review
| Question | Filter |
|---|---|
| Is an account being brute-forced? | Action auth.login.failure, last 7 days; look at target and IP |
| Could a session have been stolen? | Action auth.refresh.reuse_detected |
| Who reset 2FA? | Action user.mfa.reset |
| A customer's Law 5651 exports | Actor = the customer, action log5651.* |
| When did a package price change? | Action package.update (old and new price in the details) |
Telling team members apart
Because a customer account has a single panel login today, actions appear under the account. When the team members feature (coming soon) arrives, individual people will be distinguished.