From 2e1f8ddda3ee898f7d1913a5d7f9e0a317471057 Mon Sep 17 00:00:00 2001 From: "mintlify[bot]" <109931778+mintlify[bot]@users.noreply.github.com> Date: Thu, 16 Jul 2026 22:07:32 +0000 Subject: [PATCH 1/3] docs: note CLI command in audit log action column and exports --- security-and-compliance/audit-logs.mdx | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/security-and-compliance/audit-logs.mdx b/security-and-compliance/audit-logs.mdx index f8b9b06f..34bc1dbb 100644 --- a/security-and-compliance/audit-logs.mdx +++ b/security-and-compliance/audit-logs.mdx @@ -26,10 +26,14 @@ The audit log table includes: - **Method:** the HTTP method, such as `POST`, `PATCH`, `PUT`, or `DELETE`. - **Status:** the HTTP response status code returned by Porter. - **Resource:** the Porter resource associated with the request, such as an application, cluster, datastore, environment group, project, cloud account, API token, integration, or user. -- **Action:** a human-readable action name. Hover over the action to view the underlying request path. +- **Action:** a human-readable action name. For requests made by the Porter CLI, the Action column shows the specific command that ran, such as `porter kubectl`, `porter helm`, `porter app run`, `porter logs`, `porter datastore connect`, or `porter update`. Requests without a reported command fall back to the generic action name. Hover over the action to view the underlying request path and, when available, the CLI command. Porter preserves readable actor names for deleted users and revoked API tokens so older entries remain useful during investigations. + + The originating CLI command is captured for new entries only. Audit log entries recorded before this feature shipped continue to display the generic action name. + + ## Filter audit logs Audit logs are available for the last 30 days. Use the **Date range** filter to choose a preset, such as the last hour, last 24 hours, last 7 days, or last 30 days, or select a custom date and time range. @@ -60,6 +64,8 @@ Filters, search, date range, and pagination are stored in the page URL. Copy the If audit log export is enabled for your project, the **Export** button appears above the table. Exports use the current date range and supported table filters, including actor, method, action, status code, resource type, application, cluster, and search. +Exports include the originating CLI command alongside the standard columns, so you can trace which command triggered each request in your compliance reviews. + You can download matching entries as: - `.csv` From 7672cfb3ea650c4fa3e0731a667dc765147bc3d2 Mon Sep 17 00:00:00 2001 From: "mintlify[bot]" <109931778+mintlify[bot]@users.noreply.github.com> Date: Fri, 17 Jul 2026 15:59:16 +0000 Subject: [PATCH 2/3] docs: mention terminal icon marking CLI command rows in audit logs --- security-and-compliance/audit-logs.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security-and-compliance/audit-logs.mdx b/security-and-compliance/audit-logs.mdx index 34bc1dbb..66f03f79 100644 --- a/security-and-compliance/audit-logs.mdx +++ b/security-and-compliance/audit-logs.mdx @@ -26,7 +26,7 @@ The audit log table includes: - **Method:** the HTTP method, such as `POST`, `PATCH`, `PUT`, or `DELETE`. - **Status:** the HTTP response status code returned by Porter. - **Resource:** the Porter resource associated with the request, such as an application, cluster, datastore, environment group, project, cloud account, API token, integration, or user. -- **Action:** a human-readable action name. For requests made by the Porter CLI, the Action column shows the specific command that ran, such as `porter kubectl`, `porter helm`, `porter app run`, `porter logs`, `porter datastore connect`, or `porter update`. Requests without a reported command fall back to the generic action name. Hover over the action to view the underlying request path and, when available, the CLI command. +- **Action:** a human-readable action name. For requests made by the Porter CLI, the Action column shows the specific command that ran, such as `porter kubectl`, `porter helm`, `porter app run`, `porter logs`, `porter datastore connect`, or `porter update`. A terminal icon marks rows that carry a reported CLI command so you can scan for them quickly. Requests without a reported command fall back to the generic action name. Hover over the action to view the CLI command, the generic action, and the underlying request path. Porter preserves readable actor names for deleted users and revoked API tokens so older entries remain useful during investigations. From bd53a31ccb67645ad611674154520b12be3554f7 Mon Sep 17 00:00:00 2001 From: "mintlify[bot]" <109931778+mintlify[bot]@users.noreply.github.com> Date: Fri, 17 Jul 2026 16:02:27 +0000 Subject: [PATCH 3/3] docs: note audit log search matches reported CLI command --- security-and-compliance/audit-logs.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security-and-compliance/audit-logs.mdx b/security-and-compliance/audit-logs.mdx index 66f03f79..5773dff9 100644 --- a/security-and-compliance/audit-logs.mdx +++ b/security-and-compliance/audit-logs.mdx @@ -52,7 +52,7 @@ You can filter by: Most filters support include and exclude modes. For example, you can include only `DELETE` requests or exclude a noisy application while reviewing the rest of the project. -Use the search field to search across matching audit entries. Search can match request paths, user email addresses, API token names, application names, and cluster names. +Use the search field to search across matching audit entries. Search can match request paths, user email addresses, API token names, application names, cluster names, and the reported Porter CLI command. For example, type `kubectl` to surface entries triggered by `porter kubectl`. The volume chart above the table shows activity over the selected range. Select part of the chart to narrow the table to that time window.