Tagging Audit Records

Overview

Tags classify audit records for filtering, review, or investigation workflows.

Suggested tags

• reviewed
• suspicious
• false-positive
• resolved
• needs-follow-up
• finance-review
• security-review

How to use it

1. Open Activity Log.
2. Select a record.
3. Apply a tag.
4. Filter by tag later.
5. Remove tags when they are no longer accurate.

Example

Failed-login events from a blocked IP are tagged as resolved after review.

Common mistake

Do not create ten different tags with the same meaning. Keep tag naming consistent.

Screenshot