Skip to main content
Sumo Logic

Audit App Dashboards

The Sumo Logic Audit App includes Dashboards that give you an overview of your Sumo Logic account's audit events, including user login activity, admin activity, and details on scheduled searches.

Account Management Overview

audit_app_overview_700x503.png

User Operation Trend. Displays the number and type of user events performed in a stacked column chart on a timeline for the last week.

Role Operation Trend. Shows the number and type of role events performed in a column chart on a timeline for the last week.

Access Key Operation Trend. Displays the number and type of access key events performed in a stacked column chart on a timeline for the last week.

Admin Activities Over Time. Shows the number and type of admin activity events performed in a stacked column chart on a timeline for the last week.

Admin Activities by User Over Time. Displays the number and type of admin activity events performed by user in a stacked column chart on a timeline for the last week.

Recent Admin Activities. Shows an aggregation table of recent admin activity events with columns for the time, user, action, class, target, and status of the event, for the last 24 hours.

Geolocation of Admin Activities. Performs a geo lookup query and displays the location and number of admin activity events on a map of the world for the last 24 hours.

User Activity - Login and Credentials

audit_app_login_700x406.png

Last Successful Login (UTC). Displays an aggregation table of the last successful login per user, including the host and UTC event time for the last 24 hours.

Logged-In User Locations. Performs a geo lookup query and displays the location and number of logged-in users on a map of the world for the last 24 hours.

Successful User Login Attempts. Counts the number of successful user login attempt events and displays them in a column chart on a timeline of days for the last week.

Password Modification Attempts. Counts the number of password modification attempt events and displays them in a column chart on a timeline of days for the last month.

Password Reset Attempts. Counts the number of password reset attempt events and displays them in a column chart on a timeline of days for the last month.

User Activity - Scheduled Search

audit_app_scheduled_search_700x340.png

Scheduled Search Started. Counts the number of successfully started scheduled searches events and displays them in a column chart on a timeline for the last 24 hours.

Scheduled Search Completed. Counts the number of scheduled searches completed in either start or failure events and displays them in a stacked column chart on a timeline for the last 24 hours.

Distinct Users Executing Scheduled Searches. Counts the number of distinct users executing scheduled searches and displays them in a column chart on a timeline for the last 24 hours.

Scheduled Search Operations. Displays the overall scheduled search operation events in an area chart on a timeline for the last week.

Finished with Errors. Counts the number of scheduled searches that finished with errors and displays the number in a single value chart for the last 24 hours.

Timed-out. Counts the number of scheduled searches that have timed out and displays them in a single value chart for the last 24 hours.

Skipped. Counts the number of scheduled searches that were skipped and displays them as a single value chart for the last 24 hours.

Suspended. Counts the number of scheduled searches that were suspended and displays them as a single value chart for the last 24 hours.

Recent Scheduled Search Errors. Displays scheduled search errors in an aggregation table with information on the search time, name, search ID, user, action, and status for the last hour.

Top 10 Scheduled Searches with Errors. Shows the top 10 scheduled searches with errors, including the search name, ID, user, and count for the last 24 hours.

Suspended Searches. Displays scheduled searches that have been suspended with information on the time, name, ID, and user for the last 24 hours.