Audit logs provide a record of changes and usage that help to keep your Slack Enterprise organisation secure and protect against misuse. You can view audit logs directly in Slack, export them as a CSV and use the Audit Logs API to create custom monitoring tools.
View audit logs
From your desktop, click your organisation name in the sidebar.
Select Tools & settings from the menu, then click Organisation settings.
Click Security in the left sidebar and select Audit logs.
Click Filter at the top of the list to filter entries by Date range, Acting user, Affects (either user, workspace or organisation) or Events.
To export audit logs, click Export in the top right-hand corner of the page and select Export CSV or Export JSON.
Note: If Slackbot has taken action on behalf of a user (such as creating or editing a canvas), you’ll see acting_agent: Slackbot in the detailed audit log entry or the Audit Logs API output.
Export search query logs
The org primary owner and roles admins can create and assign a custom role (which must include the Access search query logs and Read audit logs permissions) that has permission to export a list of search query logs. When you export search query logs, you can sort the list of completed searches by member, search term and date range.
From your desktop, click your organisation name in the sidebar.
Select Tools & settings from the menu, then click Organisation settings.
Click Security in the left sidebar and select Audit logs.
Click Export in the top right-hand corner, then select Export search queries.
Customise your search query export and click Export.
Note: Search query log exports will only contain results from the last 90 days.
Monitor anomaly events
Anomaly events can surface potentially suspicious user and app activity in your organisation. Use the audit logs or the Audit Logs API to monitor anomaly events and help to determine whether the activity is expected.
From your desktop, click your organisation name in the sidebar.
Select Tools & settings from the menu, then click Organisation settings.
Click Security in the left sidebar and select Audit logs.
Click the Security detections tab.
Tip: To manually sign members out, click the three dots icon next to an anomaly audit log entry and select Sign out of Slack. If you like, you can also configure an automatic anomaly event response.
Use the Audit Logs API
Enterprise organisations can use the Audit Logs API to programmatically monitor audit events in Slack. You can use the Audit Logs API to:
Send data to a security information and event management (SIEM) tool.
Watch out for potential security issues or malicious attempts to access your org.
Build custom apps for better insight into how your company uses Slack.
Note: The availability of audit log data prior to upgrading to an Enterprise subscription depends on your previous subscription. To learn more about audit logs, contact our Support team.
