Admin > Activity Log records everything that happens in the account: who did it, to what, and whether it was a person or an API key.
Before you start
An admin role.
The Activity Log
The event set: Account events by default.
Severity: info, notice, warning or critical.
Actor Type: user for a person, api_key for an agent or script, and others such as installer and system.
Source: where it came from: web for the console, cli for the
hvcommand line, and others.Search.
The severity of each event. Warnings, such as a role change or MFA being turned off, are worth a look.
Actor Type: whether a person or an API key did it.
The ⋮ menu opens the event's full details.
Each row also shows the Actor, the Target Type and Target ID. The footer shows how many events match.
Find out what an agent did
Set Actor Type to api_key.
Search for the key.
Look for
automation.shell.executedfor the commands it ran, and the approval events around them.
To see what came through the hv CLI rather than the console, set Source to cli.
Other common questions
Who connected to this system? Search for the system and look for
system.connect_opened.Who changed a setting or role? Set Severity to warning. Changes such as
user.role_changed,user.mfa_disabledandcapability_policy.updatedappear there.Was this recording reviewed? Search for the recording. You should see
recording.started,recording.stoppedandrecording.approved.
NOTE: Checking warning events once a week is a quick way to catch changes nobody told you about.
How much automation is logged
How much detail automation leaves in the log depends on Action Log Level in Admin > Account Settings, and on the Automation action log setting of the installation key a system used. An API key can raise the level but never lower it. Detail records each screenshot and click; lower levels summarise. Check the level before relying on the log to say exactly what an agent did.