User Activity – mxHero Help Center

Reports › User Activity is the audit log of the Admin Dashboard. It records who changed what and when: rules, accounts, domains, security settings, users and roles, sign-ins, and malware releases. Use it for security reviews, compliance audits, and to find out who changed a setting.

Before you begin

You need an Owner or Administrator role in the Admin Dashboard.
Events are kept for one year.

What is recorded

Group	Events
Accounts	Add account, Update account, Delete account
Copy Policies	Copy Policy created, updated, deleted
Datasets	Dataset created, updated, deleted
Domains	Create domain, Update domain, Delete domain
Filter policies	Filter policy created, updated, deleted
Groups	Group deleted
Malware	Threat ignored
Organizations	Update organization
Rules	Rule created, updated, deleted, enabled, disabled
Security	Update security
Security Definitions	Create Security Definition, Security definition updated, Delete Security Definition
Security Policies	Create Security Policy, Update Security Policy, Security policy deleted
Sources	Add source, Update source, Delete source (directory sync sources)
Storages	Add storage account, Re-authorize storage account, Delete storage account, Update storage account
Template Definitions	Create Template Definition, Update Template Definition, Template definition deleted
Template Policies	Create Template Policy, Update Template Policy, Delete Template Policy
Users	Create user, Update user, Delete user, Login, Password reset, Role updated
Variables	Create Variable, Update Variable, Delete Variable

Changes made by the platform or by mxHERO on your behalf, for example during onboarding, show mxHERO as the user. Sensitive values, such as a SAML certificate, are hidden as ***.

View activity

Open Reports › User Activity.

The list shows USER, ACTION, AFFECTED (the object changed, for example "With name Invoices rule", or the sign-in method for a login) and DATE, newest first.
Click Show More to load older events.

Note: Until you run a search, the list isn't limited to the default dates. Use the filters to look at a specific period.

Filter activity

Click Filters to expand the panel.
Optionally enter a User (the dashboard user's email address).
Set From Date, Time, To Date and Time. All four are required. The default is the last 7 days.
Tick the events you want. Tick a group name to select all its events. Leave all unticked to include every event.
Click Search.

The panel header shows how many filters are selected.

See event details

Click Details on any row.

Event details with user, action, date, client IP, user agent, session ID and event ID

Field	Meaning
USER	Who made the change
ACTION	What they did
DATE	When the request was received
CLIENT IP	The IP address the change came from
USER AGENT	The browser and operating system
SESSION ID	A hashed identifier of the sign-in session (`unauthenticated` if there was none). Use it to group all actions from one session.
EVENT ID	The event's unique identifier

For changes, the details also show the values before and after the change. For logins, they show the method: password, Google, Microsoft (Office) or SAML. Use the copy icons to copy the session and event IDs.

Download

Click Download at the top of the page to download the activity.

Common uses

Question	How to answer it
Who changed this rule?	Filter on Rules events and look for the rule name in AFFECTED. Open Details to compare before and after.
Who signed in last week, and how?	Filter on Login for the period. The details show the sign-in method and IP address.
Was a malware detection released?	Filter on Threat ignored. See Malware Detection.
Who changed a user's role?	Filter on Role updated. See Users and Roles.
Was a storage account re-authorized or replaced?	Filter on Storages. Adding a new account and re-authorizing an existing one are separate events.

Troubleshooting

Symptom	Cause	Fix
Search does nothing	A required date or time is empty	Fill in all four date and time fields.
An event is missing	It's older than one year, or it's an action the log doesn't record (for example viewing a page)	Only the events listed above are recorded.
USER shows mxHERO	The change was made by the platform or by mxHERO on your behalf	Contact support if you don't expect it, quoting the EVENT ID.
An IP address you don't recognize	The change came from an unfamiliar network	Check the user and session ID. If you suspect misuse, reset the user's password, review Settings › Security, and contact support.