New article
Recently updated
Using the audit trail report
Who is this article for?
Administrators who want to review user activities within Hub
Admin Console access is required
The audit trail report is a chronological log of significant user actions taken within Ideagen Hub organisation.
This article explains what the Hub audit trail report records, how to access and export it, and the meaning of each event type.
Generating the report
To generate the audit trail report:
Access the Admin Console.
Select Security Center.
Click Compliance.
Click Create report.
- Enter the Date from and Date to.
Note
To manage the amount of data, each report is limited to 12 months of information. For compliance or investigation purposes, we recommend downloading reports regularly and retaining them according to your organisation's data retention policy.
- Click Create report.
You will see a message letting you know that the report is being created. The time it takes to generate the report may vary depending on the amount of data to be retrieved.
Viewing the report
Once the report is ready, you'll get a notification in your Notifications inbox.
To view the report:
- Open the Notifications inbox (Bell icon).
- Click the report card.
The report will be opened in a new browser tab in PDF format. You can save the report if required.
Navigating the report
Every row in the report contains four columns, described below.
Column |
Description |
|---|---|
Event Type |
The category of action that took place. May be one of the following values:
|
Performed At (UTC) |
The exact date and time the action occurred, always recorded in Coordinated Universal Time (UTC), sorted in ascending order. Note: If your organisation is in a different timezone, you will need to convert these times locally. For example, UTC+8 (Malaysia/Singapore) is 8 hours ahead of the times shown. |
Performed By |
The username of the person or system that triggered the action. |
Details |
A full description of what changed, including all relevant field values at the time of the event. |
Event Type column
Login Success
Records a successful authentication into Ideagen Hub. The Details column will show the Authentication Type, which will be either:
Internal - User logged in with their Ideagen Hub username and password or email and password.
External - User logged in with their corporate identity provider.
Login Failed
Records an unsuccessful login attempt. The Details column will indicate the reason:
Invalid Email/Username - No account was found matching what was entered. The Performed By column will show Unknown because the system could not identify the user.
Invalid Password - A recognised account was found but the password entered was incorrect. The Performed By column will show the username that was attempted.
Note
Multiple consecutive Login Failed events from Unknown may indicate someone attempting to access the system with unrecognized credentials.
Repeated failures from a known username may indicate a forgotten password or a potential account security concern.
User Created
Records the creation of a new user account.
The Details column shows a complete snapshot of the user's profile at creation, including username, display name, role, authentication type, timezone, language, and if a welcome email was sent.
Fields with no value recorded will appear as (). Key fields to look out for include:
Roles - the Hub permission level assigned to the user (e.g. User, Support, TenantAdministrator).
Active - Whether the account was active (true) or inactive (false) at the time.
Protected - If true, the account is protected from being deleted.
Welcome Email - Shows the last time a welcome email was sent to this user, or
()if none was ever sent (typically for inactive accounts or if your organisation has turned off automatic welcome emails)
User Updated
Records any change made to an existing user's profile.
The Details column describes only what changed, for example:
name, email address, job title, or role change will list the old value and the new value.
consent status change will show the previous consent state and the updated state, along with the date the consent was recorded.
product instance assignment or removal will name the product and instance affected.
welcome email resend will show the previous and updated trigger timestamps.
Example
This tells you the user's consent status moved from not consented to consented, and when:
Consent changed from Last Consent Date: () to Last Consent Date: 28 Apr 2026 6:07:34 AM for cindy.chong@example.com
Example
This tells you a specific product instance was assigned to the user:
pleasereview:Product Instance 1 assigned to testuser@example.com
User Deleted
Records the permanent deletion of a user account.
The Details column shows a full snapshot of the user's profile at deletion, allowing you to review the account's state before removal.
Fields with no value recorded will appear as (). Key fields to look out for include:
Roles - the Hub permission level assigned to the user (e.g. User, Support, TenantAdministrator).
Active - Whether the account was active (true) or inactive (false) at the time.
Protected - If true, the account is protected from being deleted.
Welcome Email - Shows the last time a welcome email was sent to this user, or
()if none was ever sent (typically for inactive accounts or if your organisation has turned off automatic welcome emails)
Common patterns
We've outlined some common patterns you may spot in the audit trail report to help you get the most out of it.
Events performed by sysadmin
Actions performed by sysadmin@ideagen.com are Ideagen Hub's platform-level operations.
These are usually triggered as a result of an automated process.
Bulk consent resets
You may notice several User Updated events for consent changes by sysadmin@ideagen.com, all sharing the same timestamp.
This indicates a platform-level consent reset, usually due to an update in Ideagen Hub's consent policy.
Welcome Email sent
When a Welcome Email is sent in bulk, automatically or manually, a User Updated event is logged for each recipient.
Each event records a new Welcome Email trigger timestamp and appears within seconds of each other, such as during an initial migration to Ideagen Hub.