> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tiro.ooo/llms.txt
> Use this file to discover all available pages before exploring further.
# Audit Logs and SIEM Integration
> How organization admins review permission history and audit logs, export them to CSV, and stream audit events to a corporate SIEM. For Enterprise organizations.
export const PlanGateCard = ({plan, page, lang = "ko", children}) => {
const BADGE = {
pro: {
ko: "Pro+",
en: "Pro+",
ja: "Pro+"
},
team: {
ko: "팀 플랜",
en: "Team Plan",
ja: "チームプラン"
},
enterprise: {
ko: "엔터프라이즈",
en: "Enterprise",
ja: "エンタープライズ"
}
};
const COPY = {
pro: {
ko: {
lead: "이 기능은 Pro 플랜 이상에 포함되어 있어요.",
tail: "지금 쓰는 워크스페이스에서 바로 업그레이드할 수 있어요.",
cta: "플랜 업그레이드하기"
},
en: {
lead: "This feature is included in Pro plans and above.",
tail: "You can upgrade right from your workspace.",
cta: "Upgrade your plan"
},
ja: {
lead: "この機能はProプラン以上でご利用いただけます。",
tail: "ワークスペースからすぐにアップグレードできます。",
cta: "プランをアップグレード"
}
},
team: {
ko: {
lead: "이 기능은 함께 쓰는 워크스페이스에서 진가가 나와요.",
tail: "팀원을 초대하면 바로 시작할 수 있어요.",
cta: "팀원 초대하기"
},
en: {
lead: "This feature shines in a shared workspace.",
tail: "Invite your teammates to get started.",
cta: "Invite teammates"
},
ja: {
lead: "この機能はチームで使うワークスペースで真価を発揮します。",
tail: "メンバーを招待してすぐに始められます。",
cta: "メンバーを招待"
}
},
enterprise: {
ko: {
lead: "이 기능은 엔터프라이즈 플랜에서 제공돼요.",
tail: "조직에 필요한 보안 구성을 영업팀이 함께 설계해 드려요.",
cta: "도입 문의하기"
},
en: {
lead: "This feature is available on the Enterprise plan.",
tail: "Our sales team will help design the security setup your organization needs.",
cta: "Contact sales"
},
ja: {
lead: "この機能はエンタープライズプランでご利用いただけます。",
tail: "組織に必要なセキュリティ構成を営業チームがご支援します。",
cta: "導入のお問い合わせ"
}
}
};
const HREF = {
pro: "https://tiro.ooo/" + lang + "/n?utm_source=docs&utm_medium=plan_callout&utm_campaign=plan_upsell_pro&utm_content=" + page + "#settings/plans",
team: "https://tiro.ooo/" + lang + "/n?utm_source=docs&utm_medium=plan_callout&utm_campaign=plan_upsell_team&utm_content=" + page + "#settings/plans",
enterprise: "https://relate.so/forms/yr14ayb1s9zdkuru?utm_source=docs&utm_medium=plan_callout&utm_campaign=plan_upsell_enterprise&utm_content=" + page
};
const copy = COPY[plan][lang];
return
;
};
export const PlanBadge = ({plan, lang = "ko"}) =>
{({
pro: {
ko: "Pro+",
en: "Pro+",
ja: "Pro+"
},
team: {
ko: "팀 플랜",
en: "Team Plan",
ja: "チームプラン"
},
enterprise: {
ko: "엔터프라이즈",
en: "Enterprise",
ja: "エンタープライズ"
}
})[plan][lang]}
;
Available to the **Admin** role in Enterprise organizations only.
Tiro records the key administrative actions taken in your organization as audit events. An organization admin reviews these records and exports them to a CSV file from the **\[Audit]** menu on the **\[Organization]** screen. If your company runs a SIEM, you can receive the same events there in real time.
The **\[Permission history]** tab opens for any organization admin. Exporting audit logs and access logs to a file, and forwarding events to a SIEM, are turned on by Tiro to match your organization's contract, so the tab may stay locked when you open it. Contact your account manager or [partners@theplato.io](mailto:partners@theplato.io) if you need them.
## What gets recorded?
Tiro records only the actions that need evidence of who did what, and when. That covers roles granted to members, changed, and revoked, along with an organization admin viewing or exporting audit logs.
A single record holds the time it occurred, the action type, whether it succeeded, the acting user, the target organization, how the role changed, and the IP address and browser information behind the request. Times are in UTC.
Viewing or exporting audit logs is itself recorded as an audit event, so you can see who took the logs as well.
## Review permission history
The **\[Permission history]** tab under the **\[Audit]** menu shows role grants, changes, and revocations for organization members over a date range you pick.
1. Open your profile at the top left, then go to **\[Settings]** → **\[Organization Settings]** → **\[Organization]**.
2. Open the **\[Audit]** menu on the left and select the **\[Permission history]** tab.
3. Pick a date range to see the member, the roles before and after, who performed the change, and when.
Records for members who have left show a deleted user in place of a name.
## Export audit logs to CSV
For longer periods, or when you need a file to keep, create and download a log file from the **\[Audit logs]** tab. Files aren't ready instantly; they're prepared in the background after you request one.
Press the button for creating a log file at the right of the **\[Audit logs]** tab. You pick the period and the conditions inside that dialog.
Choose a date range, and narrow the scope by action type if you need only certain actions. Then choose a download reason: customer request, incident investigation, legal audit, internal operations, or periodic review, or write your own if none of them fits. The reason is stored with the audit record.
Download the CSV file when the status in the request history below shows it's ready. The request history also shows when it was requested, the period, who requested it, the status, the record count, and the expiry time. Something that just happened can be missing for a moment while the record settles.
If the period you picked holds too many records, creating the file can fail. Split the period and request it again. If it failed because the period reaches into long-term storage, ask your account manager to restore it.
## Export access logs
The **\[Access logs]** tab covers the requests organization members send to Tiro servers. Each record holds the request time, the user, the source IP, browser information, the request path, and the response code. Access logs run at a far higher volume than audit logs, so they're enabled separately based on your organization's contract.
Exporting works the same way as audit logs. Pick a period, request the log file, and download it once it's ready. Access logs have no action type filter, so you specify only the period.
## Stream events to your SIEM
If your company runs a SIEM such as Splunk, Microsoft Sentinel, or Elastic, you can receive your organization's audit events there in real time. Tiro builds each event as JSON and sends it to an HTTPS endpoint your company designates.
Only events from data your organization owns are forwarded, so records from other organizations are never mixed in. Whether access logs are included is decided separately. The forwarding scope covers only what you agreed on, and it never widens on its own when new event types appear.
Failed deliveries retry automatically for a set period. For outages longer than that, we agree on the reprocessing procedure and its cost with you while setting up the integration.
### Request an integration
Email [partners@theplato.io](mailto:partners@theplato.io) about a SIEM integration. Your contact sends you the request form.
Give your contact details, the SIEM product you use, the HTTPS endpoint that receives the logs, the kinds of data you want, and the credentials for that endpoint. Anything else to settle together, such as firewall allowlists or your target go-live date, goes in the form as well.
Before delivery is switched on, we send one test event. Together we check the action type, the organization, and the receive time of the event that landed in your SIEM.
Once your side confirms receipt, delivery is switched on. After go-live we keep watching the failure rate and latency, and if anything looks wrong we turn delivery off immediately and rotate the credentials.
The request form includes the credentials for your receiving endpoint. Issue a value that is used only for this integration and that you can rotate whenever you need to. We move what you send into our internal secret store and delete it from the form response.
SIEM delivery is the real-time path, while the CSV export on the audit log screen reads the retained originals. Both paths handle the same events but run independently, so you can always export from the screen again even when SIEM delivery has a problem.
## Frequently asked questions
### How long can I download a log file I created?
Each row in the request history shows its own expiry time. Past that time the file can't be downloaded again, so just create it again with the same conditions. How long the original audit events are retained is set by your organization's contract, so tell your account manager if you have a retention period you're required to meet.
### Can I see who opened a note?
The records covered by the current screen and by SIEM delivery are permission changes and the history of viewing and exporting logs. Let your account manager know if you need note view records.
### Can regular members see audit logs?
No. The **\[Organization]** screen itself opens only for organization **Admin** users. Workspace admins and regular members don't see the menu at all.
***
**Related pages**: [Organization Security](/en/guide/privacy/enterprise-security) · [Enterprise plan](/en/guide/workspace/enterprise) · [Workspace roles](/en/guide/workspace/roles)