Viewing Audited Events | Soteri Documentation

To help administrators keep track of various events, Security for Jira Cloud has an audit log. Due to Atlassian policies, we cannot write to the Atlassian audit log.

Audit log entries are retained for 90 days.

Accessing the audit log

From the Soteri settings page, click on Audit Log in the top right of the page.

Screenshot 2026-07-01 at 4.12.27 PM-20260701-211241.png

Viewing events

The audit log page shows events ordered from most to least recent.

The “Show more” column on the right can be clicked to show the details of individual events, including the Atlassian user ID of the author. (Events with no associated user, such as scans starting and completing, use “System” as the author)

Screenshot 2025-12-10 at 12.29.26 PM-20251210-182938.png

The search boxes at the top of the page can be used to filter events by a substring of the Atlassian user ID, event type, or event details (which are stored as JSON). Click the search icon or press enter in one of the search boxes to filter. For example, the above event matches each of these filters:

Screenshot 2025-12-10 at 12.32.40 PM-20251210-183309.png

Screenshot 2025-12-10 at 12.33.49 PM-20251210-183403.png

Screenshot 2025-12-10 at 12.34.25 PM-20251210-183440.png

Exporting events

The export button on the top right exports events matching the current filters as a CSV file.

Who can view the audit log?

The audit log is available to Jira administrators, plus any users and groups granted access under App Access on the Soteri settings page.

The audit log covers the entire instance. In order to ensure traceability, it is not filtered to particular spaces like the Dashboard. As such, an App Administrator will be able to see every event recorded for the instance, including events for spaces they cannot browse in Jira.

Audit events record identifiers and metadata only. This includes things like:

space and work item IDs and keys
finding counts
rule names
timestamps
author names
links to Soteri pages

They never include scanned content or the matched text of a finding. Viewing the text content of findings themselves still requires Read permission on the space.

Grant App Access only to people you trust with instance-wide visibility into scanning activity.

List of audited events

Event type	Detail fields
`Scheduled space scan` `Could not access space`	`spaceId` ID of the scanned space.
`Finished space scan`	`spaceId` ID of the scanned space. `findingsCount` The number of findings in the space.
`Error while running space scan`	`spaceId` ID of the scanned space. `errorMessage` Error encountered during the scan.
`Reviewed a false positive` `Deleted a reviewed false positive`	`spaceId` ID of the space the finding is reviewed in. `scope` reviewed at space or fine grained scope scope. `ruleName` The name of the rule which the finding is for. `work itemId` (Only for fine grained scope) The work item ID the reviewed finding is present in. `fieldName` (Only for fine grained scope) The name of the field the reviewed finding is present in `commentId` (Only for fine grained scope) The comment ID the reviewed finding is present in. `reasonCategory` The reason category selected by the reviewer, if supplied. `reasonNotes` The reason notes added by the reviewer, if supplied.
`Added globally reviewed false positives`	`uploadedCount` Number of false positives uploaded `addedCount` Number of newly added false positives
`Deleted globally reviewed false positives`	`uploadedCount` Number of false positives uploaded `deletedCount` Number of deleted false positives
`Updated instance settings`	`autoScan` Whether automatic scanning is enabled. `deduplicateExports` Whether findings are deduplicated in exports. `includePlaintextInExports` Whether exported findings include the finding in plaintext.
`Create custom rule` `Update custom rule` `Delete custom rule`	`name` Name of the custom rule. `id` ID of the custom rule. `regexp` The regex for the custom rule. `enabled` Whether the custom rule is enabled (only for update).
`Toggled built-in rule`	`name` Name of the built-in rule. `enabled` Whether the custom rule is enabled.
`Updated app access configuration`	`Added` Users and groups that have been given access to the app. `Removed` Users and groups whose access to the app has been revoked.

Event type

Detail fields

Scheduled space scan

Could not access space

spaceId ID of the scanned space.

Finished space scan

spaceId ID of the scanned space.

findingsCount The number of findings in the space.

Error while running space scan

spaceId ID of the scanned space.

errorMessage Error encountered during the scan.

Reviewed a false positive

Deleted a reviewed false positive

spaceId ID of the space the finding is reviewed in.

scope reviewed at space or fine grained scope scope.

ruleName The name of the rule which the finding is for.

work itemId (Only for fine grained scope) The work item ID the reviewed finding is present in.

fieldName (Only for fine grained scope) The name of the field the reviewed finding is present in

commentId (Only for fine grained scope) The comment ID the reviewed finding is present in.

reasonCategory The reason category selected by the reviewer, if supplied.

reasonNotes The reason notes added by the reviewer, if supplied.

Added globally reviewed false positives

uploadedCount Number of false positives uploaded

addedCount Number of newly added false positives

Deleted globally reviewed false positives

uploadedCount Number of false positives uploaded

deletedCount Number of deleted false positives

Updated instance settings

autoScan Whether automatic scanning is enabled.

deduplicateExports Whether findings are deduplicated in exports.

includePlaintextInExports Whether exported findings include the finding in plaintext.

Create custom rule

Update custom rule

Delete custom rule

name Name of the custom rule.

id ID of the custom rule.

regexp The regex for the custom rule.

enabled Whether the custom rule is enabled (only for update).

Toggled built-in rule

name Name of the built-in rule.

enabled Whether the custom rule is enabled.

Updated app access configuration

Added Users and groups that have been given access to the app.

Removed Users and groups whose access to the app has been revoked.