Audit Log
The answer to “who changed what, and when?” lives at Console → WAF → [domain] → Activity: every user, system and API operation on this domain is recorded there.
What gets logged?
Section titled “What gets logged?”Every write operation on your domain creates an audit entry:
- Settings changes (maintenance mode, speed/optimization, proxy, log forwarding, TLS, cache)
- Rule operations (create, edit, delete, reorder)
- IP lists and manually added/removed IP bans (failban)
- Origin server additions/removals/status changes
- Protection mode changes and auto-protection triggers
- Custom page operations
Each entry has an actor:
| Actor | Meaning |
|---|---|
| User | An account acting through the console (with its email) |
| API | A change made with an API key — logged with the key’s name |
| System | Automated operations (health checks, auto-protection, cron) |
| Node | Edge-server-originated operations |
Filtering
Section titled “Filtering”Narrow the records with the Filters panel at the top of the page:
- Date range — from/to
- Actor type — User / System / API / Node
- Status —
success,failed,denied - Source — Panel / API / System
- Actor name — user email or API key name
- Action — multi-select by operation type
Apply runs the filters, Reset clears them. Page size can be 20/50/100/200 records.
Entry detail
Section titled “Entry detail”The table shows date, actor, action, source and status columns. Clicking a row opens the detail panel:
- The operation’s old and new values as a JSON comparison (e.g.
"enabled": false→"enabled": true) - The actor’s IP address (only for user operations — infrastructure details are redacted for system/API/node entries)
- The affected resource and timestamp
Related pages
Section titled “Related pages”WebhooksDeliver events to your own systems in real time.