Skip to main content
Enterprise feature. Audit Logs are only available to workspaces on the Enterprise plan.
Audit Logs give security and compliance teams a tamper-evident, time-ordered record of every significant action that occurs in your Dust workspace. Every log entry answers: who did what, to which resource, from where, and when. A key capability is the ability to distinguish between actions taken by human users and actions taken by AI agents, making it possible to attribute data access, tool executions, and configuration changes to their true originator.

​
Accessing Audit Logs

Audit Logs are available to workspace admins only. Navigate to: Admin > People & Security > Audit Logs The UI provides full-text search, time-range filtering, and CSV export.
Accessing the Audit Logs viewer itself generates an audit_log.viewed event.

​
Log Entry Structure

Each event contains the following fields:

​
Actor Types

For agent.executed and tool.executed events, the actor reflects the identity that initiated the action (user or API key). Whether the action was AI-driven is captured in the event’s metadata.actor_type, metadata.initiating_user_id, and metadata.initiating_user_email fields.

​
Export and SIEM Integration

Audit Logs can be exported as CSV from the admin UI. Continuous streaming to a SIEM is supported for log stream destinations such as Datadog, Splunk, AWS S3, GCP GCS, and any custom HTTPS endpoint.

​
IP Allowlist

If your SIEM or log stream endpoint restricts inbound traffic by IP, allowlist the following addresses. WorkOS delivery IPs (used to deliver audit log events to your log stream endpoint):
For the canonical and up-to-date list, refer to the WorkOS IP allowlist documentation.