---
title: "Audit Logs"
description: "Enable Audit Log streaming to your SIEM (Datadog, Splunk, S3, etc.) and review the last 30 days for unexpected activity on Saturday's team."
canonical_url: "https://vercel.com/academy/optimize-your-vercel-account/audit-logs"
md_url: "https://vercel.com/academy/optimize-your-vercel-account/audit-logs.md"
docset_id: "vercel-academy"
doc_version: "1.0"
last_updated: "2026-07-22T06:32:57.151Z"
content_type: "lesson"
course: "optimize-your-vercel-account"
course_title: "Optimize Your Vercel Account"
prerequisites:  []
---

<agent-instructions>
Vercel Academy — structured learning, not reference docs.
Lessons are sequenced.
Adapt commands to the human's actual environment (OS, package manager, shell, editor) — detect from project context or ask, don't assume.
The lesson shows one path; if the human's project diverges, adapt concepts to their setup.
Preserve the learning goal over literal steps.
Quizzes are pedagogical — engage, don't spoil.
Quiz answers are included for your reference.
</agent-instructions>

# Audit Logs

# Audit Logs

\*\*Note: Plan tier\*\*

Audit Logs are an Enterprise feature. Hobby and Pro teams have the Activity Log (covered in Lesson 2.4), which is the free version with less metadata and no streaming.

The Activity Log we looked at in Lesson 2.4 is fine for ad-hoc review. Audit Logs are what you point compliance auditors at. They include metadata the Activity Log doesn't (IP addresses, user agents, before-and-after state for changed objects), and they're streamable to a SIEM, which is the part most security questionnaires actually care about.

Saturday probably isn't running a SOC 2 audit right now. But the cost of turning streaming on is one configuration; the cost of not having logs when you finally need them is much higher. Set it up the day you're on Enterprise. Confirm the destination is healthy on the day before your auditor calls.

\*\*Note: What are Audit Logs?\*\*

The compliance-grade record of team activity: who did what, from where, with
the metadata an auditor expects. Unlike the free Activity Log, Audit Logs
can stream continuously to a SIEM like Datadog or Splunk.

## Outcome

Audit Logs from Saturday's team are streaming to your chosen destination (Datadog, Splunk, S3, or HTTP endpoint). You've spot-checked the last 30 days for anything that doesn't match expected activity.

## Hands-on exercise 6.2

Two halves: set up the stream, then read the historical data.

**Requirements:**

1. Open Team Settings > Security & Privacy > **Audit Log**
2. Click **Configure**
3. Pick a destination based on what your security team already runs:
   - **Datadog**: most common for teams already on Datadog for observability
   - **Splunk**: common for security-heavy orgs
   - **AWS S3** or **Google Cloud Storage**: for raw, immutable archive
   - **Custom HTTPS endpoint**: for in-house SIEMs or pipelines
4. Follow the destination-specific setup wizard. Most require an API token or endpoint URL.
5. Trigger a test action in Vercel (change a setting, deploy a project, anything that produces an audit event) and confirm it appears in your destination within a few minutes.
6. Once streaming is verified, return to the Audit Log page and review the **last 30 days** of events. Look for anything you don't recognize.

**Implementation hints:**

- The Vercel-side configuration is per-team: one destination setup covers every project. Retention and filtering happen on the destination side, not in Vercel.
- Audit logs are visible to team Owners only, so this whole lesson assumes you're one.
- Don't pick "Custom HTTPS endpoint" unless you really want to. The pre-built integrations handle retries, deduplication, and schema; the custom path is on you for all of that.
- For the historical review, pay attention to:
  - User removals you didn't approve
  - Settings changes outside business hours (could be legitimate, worth a quick check)
  - Env var changes on production
  - Firewall rule changes
  - Anyone signing in from an unusual country
- Audit Logs include the user agent and IP for each action. If you're investigating something, those are the fields you want.

## Try It

After the integration is set up, change a setting that will produce a clear log entry: update the production domain alias, toggle a feature flag in Project Settings, or rotate a non-sensitive env var.

Within a few minutes, the event should appear in your destination. If you're streaming to Datadog, search for it in the Logs view filtered by `source:vercel`:

```
2026-05-27T15:42:11Z  source=vercel  action=project.alias.update
  actor=eve@saturday.example  ip=203.0.113.42
  team=saturday  project=saturday
  before={"alias":"saturday.example"}
  after={"alias":"shop.saturday.example"}
```

That's the level of detail Audit Logs give you that the Activity Log doesn't. The `before`/`after` state, the actor's IP, the user agent (truncated in the example): all there.

In the Vercel UI, open Team Settings > Audit Log and filter to the last 30 days. Scroll through. For a small team you should recognize every event. For a large team you'll need to filter (by user, by action type, by project) to make the review tractable. Note anything that doesn't look right.

## Done-When

- [ ] Audit Log integration is configured and the test event arrived at your destination
- [ ] Streaming has been running for at least an hour with no error indicators
- [ ] You've reviewed the last 30 days of events in either the Vercel UI or your SIEM
- [ ] Any events you didn't recognize have been investigated

## Troubleshooting

**Events are showing up in Vercel but not in my destination.**

The most common cause is a credential issue: expired token, wrong endpoint URL, IAM role with insufficient permissions. Check the integration's status on the Audit Log page and your destination's own ingestion logs. Expired tokens fail quietly on the sender side.

**The destination is receiving events but they're delayed by 30+ minutes.**

Some destinations buffer for throughput. Datadog and Splunk should be near-real-time. S3 and GCS deliver in batches, sometimes every 15 minutes. Custom endpoints depend on your implementation. Check the destination's own ingestion lag metrics.

**I see actions I didn't take personally.**

Integrations, deploy hooks, and platform-side jobs produce events alongside human ones. They're normal, and you should expect a baseline level of them. They're worth excluding from your alerting rules so they don't trigger false positives.

## Solution

The configuration:

```
Team Settings > Audit Log
  Destination:      [Datadog | Splunk | S3 | GCS | Custom HTTPS]
  Status:           Healthy
  Test event:       confirmed at the destination
```

Once you have this, the work isn't "set it and forget it." You should:

- Add an alerting rule for high-risk events: env var changes on production, firewall rule deletes, member removals
- Add an alerting rule for sign-ins from unusual geographies (especially relevant if you have a small, geographically concentrated team)
- Make audit log review a monthly habit. Even a 10-minute scan catches things that would otherwise go unnoticed for quarters.

Up next: we tighten down previews even further with Trusted IPs and Password Protection.


---

[Full course index](/academy/llms.txt) · [Sitemap](/academy/sitemap.md)