Prove who did what and when — audit log, session list, CSV

What it is for

For an audit, data protection or a dispute you need to show who did what and when. The console has two lists for this: the audit log with every security-relevant action (sign-ins, blocks, script runs, changes to settings …) and the session list with every remote session. Both can be searched, filtered and exported as a CSV file.

What you need

• Audit log: Cloud with a plan that includes the audit log, or your own relay. Free has no audit log. Your console account needs at least the role Supervisor.
• Session list: any console account that can see the access.

How to do it

Audit log

1. In the console: Settings (bottom left) → Security & access › Audit log.
2. Search the search field for actor, action, access, device or detail. Below the column headers you filter single columns.
3. CSV downloads all hits of the current search and filters — not just the visible page.
4. Verify chain checks whether anyone has changed or deleted entries.

Quick way: Ctrl+K opens "find everything"; its entry "Search the audit log for …" takes you straight into the filtered list.

Session list

1. Open Support › Sessions.
2. At the top choose Active, Finished or All, then search or filter in the columns Tenant, Device, Client IP and Start.
3. CSV downloads the whole filtered set of hits.

You also find the sessions of a single device in the device: Devices → open the device → Sessions.

How you know it worked

• Verify chain reports "Audit chain intact — no tampering detected."
• The CSV file contains exactly the rows of your search, even across many pages.

Good to know

• Tamper-evident: each audit log entry is cryptographically linked to the previous one. Changing or deleting an entry breaks the chain — Verify chain shows where. The log is read-only.
• Who was in control: the session list shows access, device, the viewer's address (Client IP), start, duration and status — but not the technician's name, and the audit log does not record the start of a session. Today you only get the technician per session through the ticket integration: session events with the technician go out by webhook (G19) or as a work note into your PSA (G16).
• What a program did: actions through an API token appear in the audit log under the token's name (G19).
• Scope: every account only sees the accesses it is enabled for.
• Deleting an access: a complete deletion also removes its audit log rows; a closing entry records count and period, and the chain stays verifiable (G23).
• What does not exist: a full export of all data of an access or a ready-made disclosure under Art. 15 GDPR. There is no dedicated way for this yet — write to info@browserdesk.de.
• Session recordings: G18.

If it does not work