What is the audit log feature?

The audit log feature inside Fliplet Studio will enable you to view logs related to your Fliplet account and apps. Note: Audit log data is retained for one year. To preserve data beyond this timeframe, please export your data to a CSV file.

Why use the audit log feature

Logs record actions to provide you with the information required to check or diagnose activity within your apps.

How to use the audit log feature

The log feature is available for organization admins and any user with the app publisher role.

This feature is accessible from three different places within Fliplet, depending on your role.

  1. Home screen > Organization dashboard > Audit log
    This is only available to organization admins

  2. Edit app > Publish > Update your live app > Audit log
    This is available to app publishers
    Note: this will only show audit logs related to that specific app

  3. Home screen > My apps > {any app} > More > Audit log
    This is available to app publishers
    Note: this will only show audit logs related to that specific app

This article will cover:

  1. Features
  2. Use cases
    1. Security
    2. Feature utilization
    3. Behavior analysis 
  3. Full examples
    1. Which emails have been sent and what’s their status?
    2. Which push notifications have been sent and what’s their status?
    3. Who has recently logged in?
    4. Who has added/removed 2-factor authentication from their account?
    5. What files have been uploaded, moved, or deleted?
    6. What apps have been recently published and by who?
  4. Audit log dictionary

Features

The audit log feature consists of a table of data that can be filtered and exported if required.

The columns of data presented are:

  1. Date – when the activity occurred
  2. Category – what part of the system the activity occurred
    This could be Apps/Integrations, App Actions, or Fliplet Studio/Viewer
  3. Log type – what type of activity occurred
  4. App name – where the activity occurred
  5. User – who the activity related to or was caused by
    This could be a Studio user or an app user for app and app action logs
  6. Data – details relating to the activity
    This is presented in its original form as a JSON object

The functionalities available within the feature are:

  1. Date range – filter for logs from a specific time period
    e.g. only see logs from the last 30 days, or select a custom date range
  2. Column sorting – arrange the values in ascending or descending order
    e.g. for the timestamp field, you could sort to see the oldest or newest logs first
  3. Column filtering – search each individual column by typing in some text
    e.g. enter a user’s email address into the “User” column to see only logs relating to them
  4. Pagination – increase or decrease the number of results shown on a single page
  5. Export to CSV – download the data in .csv format
    e.g. to do further analysis in Excel

Use cases

Below are some example questions that could be answered by using this feature

Security

  1. Who has been added/removed from an organization
  2. Who has been added/removed from an app
  3. Who has logged into apps 
  4. Who has logged into Studio
  5. Who has altered their profile (e.g. changed email address, password, etc)
  6. Who has added/removed settings (e.g. 2-factor authentication)

Feature utilization

  1. Who has been sent emails from Studio
  2. Who has been sent emails by an app
  3. Have emails been sent successfully
  4. Who has been sent SMS
  5. Have SMS been sent successfully
  6. Data source read activity
  7. Data source write activity
  8. What files have been uploaded, downloaded, or deleted

Behavior analysis

  1. What has a user been doing recently (e.g. screens viewed, devices used)
  2. What has a particular device been doing
  3. What has a particular IP address been doing
  4. What app builds have recently been requested
  5. What apps have been recently published and by who
  6. What apps have been recently updated and by who
  7. What push notifications have been sent
  8. Have push notifications been sent successfully

Full examples

Note: these examples are written assuming you are accessing the audit log feature from the organization dashboard. The instructions are exactly the same if accessing app-specific audit logs, however, these will only show data for that particular app by default, therefore there is no possibility to filter the ‘app’ column for any other values.

Which emails have been sent and what’s their status?

There are 3 log types that indicate an email has been triggered

  1. email.dataSourceHook
    Automated emails are sent when something changes in a data source
  2. email.communicate 
    Configured and sent via our Communicate JS API
  3. email.validate
    Sent when someone creates a new account

And 5 log types that describe the status of an email

  1. email.bounced
    An email was bounced back and could not be delivered yet to the recipient
  2. email.complaint
    A complaint was received when attempting to deliver the email
  3. email.delayed
    An email was delayed and could not be delivered yet to the recipient
  4. email.delivered
    An email was successfully delivered to the target recipient
  5. email.rejected
    An email was not delivered due to the recipient’s server rejecting the email

How to assess which emails have been sent and their status

  1. Type “email” into the ‘log type’ column
    This will show you results for all of the above log types (both emails triggered and email statuses)
    If you know the particular type of email trigger that you want to find, copy and paste the exact log type from above instead
  2. Add any other filters that are relevant
  3. If you want to find emails to a particular person, type part or all of their email address into the ‘data’ column
  4. If you want to find emails related to a particular app, type part or all of the app name into the ‘app’ column
  5. If you are looking at a specific time period, select a date range using the date filter above the table
  6. To look at all the logs related to a particular email, copy the ‘messageId’ in the ‘data’ column
  7. Remove any filters in the other columns
  8. Paste the ‘messageId’ into the data column

Which push notifications have been sent and what’s their status?

There is only one log type for push notifications – this includes all the information regarding what has been sent and their status

  1. pushNotification.send

How to assess which push notifications have been sent and their status

  1. Type “pushnotification” into the ‘log type’ column filter
  2. If you are looking for push notifications related to a specific app, type the app name into the ‘app’ column
  3. If you are looking at a specific time period, select a date range using the date filter above the table
  4. If you know the text that was included in the push notification message, type this into the ‘data’ column filter
  5. To see how many push notifications were successful, look for the word “success” in the data column. The number proceeding this tells you the number of push notifications that were successfully delivered. 
    To more easily find this use Ctrl + F (or ⌘ + F on a Mac) and search for the term “success”
  6. To see how many push notifications were not successful, look for the word “failure” in the data column. The number proceeding this tells you the number of push notifications that failed to be delivered. 
    To more easily find this use Ctrl + F (or ⌘ + F on a Mac) and search for the term “failure”
  7. To get more information about why push notifications failed to be delivered, look for the word “​​error” in the data column. The text proceeding this should describe a reason for the failure. Note: each failed push notification will have its own error message.
    To more easily find this use Ctrl + F (or ⌘ + F on a Mac) and search for the term “error”

Who has recently logged in?

There is one log type that captures all login attempts

  1. user.login

There are three further log types that will also be triggered if a user’s login attempt matches the below criteria

  1. user.login.failed
    A user was unable to login 
  2. user.login.first
    User logs in for the first time
  3. user.login.sso
    A user logged in using single sign on (SSO)

How to assess who has recently logged in

  1. Type “login” into the ‘log type’ column, this will show you all logins and attempts
    If you would like to only see a particular type of login, copy and paste the relevant log type from above instead
  2. Add any other filters that are relevant
  3. If you would like to see logins for a particular user, type all or part of their email address into the ‘User’ column filter
  4. If you would like to see logins for a particular time period, select a date range using the date filter above the table
  5. If you are looking for logins related to a specific app, type the app name into the ‘app’ column
  6. To calculate the number of logins that have occurred, check the total number of entries at the bottom of the table

Who has added/removed 2-factor authentication from their account?

There are two log types that describe a user adding or removing two-factor authentication (2FA) from their account

  1. user.twofactor.add
  2. user.twofactor.remove

There is one additional log type that describes if an org admin removes two-factor authentication on behalf of a user

  1. organization.user.twofactor.remove

How to assess who has added/removed 2-factor authentication from their account

  1. Type “twofactor” into the ‘log type’ column
  2. This will show you results for all three of the above log types
  3. If you would like to only see a particular type, copy and paste the exact log type from above instead
  4. Add any other filters that are relevant
  5. If you would like to see only for a particular user, type all or part of their email address into the ‘User’ column filter
  6. If you would like to see for a particular time period, select a date range using the date filter above the table
  7. If you are looking only for a specific app, type the app name into the ‘app’ column
  8. To see the type of two-factor authentication that was added or removed, look for the value after “type” in the ‘data’ column

What files have been uploaded, moved, or deleted?

There are four log types that relate to media files

  1. mediaFile.create
    A media file was added (uploaded)
  2. mediaFile.remove
    A media file was moved to the trash (deleted)
  3. mediaFile.restore
    A media file was restored (returned from the trash)
  4. mediaFile.update
    A media file was updated (e.g. moved to a new folder)

How to assess what files have been uploaded, moved, or deleted

  1. Type “mediaFile” into the ‘log type’ column
  2. This will show you results for all four of the above log types
  3. If you would like to only see a particular type, copy and paste the exact log type from above instead
  4. Add any other filters that are relevant
  5. If you would like to see file actions from a particular user, type all or part of their email address into the ‘User’ column filter
  6. If you would like to see for a particular time period, select a date range using the date filter above the table
  7. If you are looking only for a specific app, type the app name into the ‘app’ column
  8. To see the file within Fliplet Studio, copy the “mediaFileId” in the ‘data’ column
  9. Go to File Manager in the top navigation bar
  10. Paste the “mediaFileId” into the search field in the top right corner

What apps have been recently published and by who?

There are four primary log types that relate to publishing, depending on the channel and whether an app has been published before

  1. app.publish.web.create
    An app was launched on web
  2. app.submission.build
    An app build was requested for the Apple or Google app store
  3. app.submission.report
    See the status of an app build once it has completed (this is required to check if it was successful or not)
  4. app.publish
    An in-app update was published

How to assess what apps have been recently publish and by who

  1. Determine which type of publish you would like to check
  2. To find information for a web app being published for the first time (or if it has since been unpublished), type “app.publish.web.create” into the ‘log type’ column filter
  3. To find information for an Apple or Android app being published for the first time, type “app.submission.build” into the ‘log type’ column filter
  4. To find information about either a web, Apple, or Android app that has already been published and is being updated, type “app.publish” into the ‘log type’ column filter
  5. Add any other filters that are relevant
  6. If you know the particular user that published the app, type all or part of their email address into the ‘data’ column filter
  7. If you would like to see for a particular time period, select a date range using the date filter above the table
  8. If you are looking for a specific app, type the app name into the ‘app’ column
  9. To see the user that published (or updated) the app, look for the email address after “_userEmail” in the ‘data’ column
  10. If you are looking at the log type “app.submission.build”, this only tells you that the app build has been submitted to the app store
  11. To find out if that build was successful, copy the number after “appSubmissionId” in the ‘data’ column
  12. Clear all of your column filters
  13. Paste the “appSubmissionId” into the ‘data’ column filter
  14. Find the log of type “app.submission.report” that is now displayed
  15. To determine the status of the build, look at the value after “status” in the ‘data’ column – this indicates if the build failed or was a success

Audit log dictionary

For a full explanation of all log types, click here.

Related Articles

Was this article helpful?
YesNo