Viewing Audited Events
To help administrators keep track of various events, Security for Bitbucket (version 3.20.0 and later) places certain entries in Bitbucket’s Audit Log.
Accessing the Audit Log
From the Administration panel, choose Audit Log:
![](../../__attachments/14769586665/Screen%20Shot%202022-05-23%20at%2010.58.38%20AM.png?inst-v=dd2e15ff-a066-4891-84cc-df8425dc8a25)
This brings up the “Advanced audit log” page:
![](../../__attachments/14769586665/Screen%20Shot%202022-05-23%20at%2011.02.06%20AM.png?inst-v=dd2e15ff-a066-4891-84cc-df8425dc8a25)
From here, click on the + More button. A new Categories drop-down will appear. From that, select “Soteri Security for Bitbucket”:
![](../../__attachments/14769586665/Screen%20Shot%202022-05-23%20at%2011.05.11%20AM.png?inst-v=dd2e15ff-a066-4891-84cc-df8425dc8a25)
and then click on the Apply button. The events can then be seen:
![](../../__attachments/14769586665/Screen%20Shot%202022-05-23%20at%2011.08.13%20AM.png?inst-v=dd2e15ff-a066-4891-84cc-df8425dc8a25)
Clicking on a given event’s arrow will expand the event, revealing more details:
![](../../__attachments/14769586665/Screen%20Shot%202022-05-23%20at%2011.11.08%20AM.png?inst-v=dd2e15ff-a066-4891-84cc-df8425dc8a25)
Viewing audited events via a REST call
Events which affect a particular repository may be viewed via a REST call like this:
curl -u admin https://{bitbucket.server}/rest/audit/latest/projects/{projectKey}/repos/{repoSlug}/events
where
admin
is your Bitbucket admin user (you’ll be prompted for a password),bitbucket.server
is the URL of your Bitbucket server,projectKey
is the project containing the repository, andrepoSlug
is the repository slug whose events we want to fetch.
Audited Events
The following events are currently recorded in the Audit Log:
Changes in the Global Hook status or mode
Built-in rule toggles
Custom rule creation, deletion, changes, or toggles
Findings being marked or unmarked as reviewed
Per-repository settings toggles
Individual or group access changes to the Global Settings
Changes to
soteri-security.yml
on the default branch of a repositorySkipping the Soteri security hook by way of the specialized commit message
**skip-soteri-security-check**