The [Permission history] tab opens for any organization admin. Exporting audit logs and access logs to a file, and forwarding events to a SIEM, are turned on by Tiro to match your organization’s contract, so the tab may stay locked when you open it. Contact your account manager or partners@theplato.io if you need them.
What gets recorded?
Tiro records only the actions that need evidence of who did what, and when. That covers roles granted to members, changed, and revoked, along with an organization admin viewing or exporting audit logs. A single record holds the time it occurred, the action type, whether it succeeded, the acting user, the target organization, how the role changed, and the IP address and browser information behind the request. Times are in UTC.Review permission history
The [Permission history] tab under the [Audit] menu shows role grants, changes, and revocations for organization members over a date range you pick.- Open your profile at the top left, then go to [Settings] → [Organization Settings] → [Organization].
- Open the [Audit] menu on the left and select the [Permission history] tab.
- Pick a date range to see the member, the roles before and after, who performed the change, and when.
Export audit logs to CSV
For longer periods, or when you need a file to keep, create and download a log file from the [Audit logs] tab. Files aren’t ready instantly; they’re prepared in the background after you request one.1
Open the creation dialog
Press the button for creating a log file at the right of the [Audit logs] tab. You pick the period and the conditions inside that dialog.
2
Set the period and conditions
Choose a date range, and narrow the scope by action type if you need only certain actions. Then choose a download reason: customer request, incident investigation, legal audit, internal operations, or periodic review, or write your own if none of them fits. The reason is stored with the audit record.
3
Download once it's ready
Download the CSV file when the status in the request history below shows it’s ready. The request history also shows when it was requested, the period, who requested it, the status, the record count, and the expiry time. Something that just happened can be missing for a moment while the record settles.
Export access logs
The [Access logs] tab covers the requests organization members send to Tiro servers. Each record holds the request time, the user, the source IP, browser information, the request path, and the response code. Access logs run at a far higher volume than audit logs, so they’re enabled separately based on your organization’s contract. Exporting works the same way as audit logs. Pick a period, request the log file, and download it once it’s ready. Access logs have no action type filter, so you specify only the period.Stream events to your SIEM
If your company runs a SIEM such as Splunk, Microsoft Sentinel, or Elastic, you can receive your organization’s audit events there in real time. Tiro builds each event as JSON and sends it to an HTTPS endpoint your company designates. Only events from data your organization owns are forwarded, so records from other organizations are never mixed in. Whether access logs are included is decided separately. The forwarding scope covers only what you agreed on, and it never widens on its own when new event types appear. Failed deliveries retry automatically for a set period. For outages longer than that, we agree on the reprocessing procedure and its cost with you while setting up the integration.Request an integration
1
Ask for the request form
Email partners@theplato.io about a SIEM integration. Your contact sends you the request form.
2
Fill in the form
Give your contact details, the SIEM product you use, the HTTPS endpoint that receives the logs, the kinds of data you want, and the credentials for that endpoint. Anything else to settle together, such as firewall allowlists or your target go-live date, goes in the form as well.
3
Verify a test event
Before delivery is switched on, we send one test event. Together we check the action type, the organization, and the receive time of the event that landed in your SIEM.
4
Turn it on
Once your side confirms receipt, delivery is switched on. After go-live we keep watching the failure rate and latency, and if anything looks wrong we turn delivery off immediately and rotate the credentials.
SIEM delivery is the real-time path, while the CSV export on the audit log screen reads the retained originals. Both paths handle the same events but run independently, so you can always export from the screen again even when SIEM delivery has a problem.
Frequently asked questions
How long can I download a log file I created?
Each row in the request history shows its own expiry time. Past that time the file can’t be downloaded again, so just create it again with the same conditions. How long the original audit events are retained is set by your organization’s contract, so tell your account manager if you have a retention period you’re required to meet.Can I see who opened a note?
The records covered by the current screen and by SIEM delivery are permission changes and the history of viewing and exporting logs. Let your account manager know if you need note view records.Can regular members see audit logs?
No. The [Organization] screen itself opens only for organization Admin users. Workspace admins and regular members don’t see the menu at all.Related pages: Organization Security · Enterprise plan · Workspace roles