Skip to main content

​
Overview

Audit Logging is accessed at Dashboard → Audit Logs. It provides a tamper-evident audit trail of all user actions and system events across your organization — from both the Aitrium Portal (web application) and AitriumOS Desktop (native application). Audit logs support:
  • Compliance reporting — Exportable records with reason-for-change tracking
  • Security monitoring — Visibility into authentication events, access changes, and credential operations
  • Operational traceability — End-to-end tracking of data workflows, submissions, and integration activity

​
Audit Log Table

The log table displays events in reverse chronological order (newest first):
ColumnDescription
TimestampWhen the event occurred, displayed in your local timezone
ActionHuman-readable description of what was done
CategoryColor-coded badge indicating the event domain (see Event Taxonomy)
ResourceType of resource affected (e.g., User, Site, Integration)
UserDisplay name and email of the actor who performed the action
SourceWhere the action originated (see Source Applications)
All columns are sortable — click a column header to toggle sort direction. Results are paginated at 50 per page. Audit log table showing timestamped events with category badges

​
Source Applications

Every audit event records where the action originated. The Source column shows one of two values:
SourceApplicationDescription
aitrium-webAitrium PortalActions performed in the web application — user management, project configuration, credential management, and authentication
aitrium-desktopAitriumOS DesktopActions performed in the desktop application — clinical data tool execution, data transfers, QA submissions, and local credential management

​
Event Taxonomy

Audit events are classified by category (the domain of the action) and action (the specific operation performed). The system enforces strict validation — each action is only valid within its designated category or categories.

​
Categories and Actions

Authentication lifecycle events from both Portal and Desktop.
ActionDescriptionSource
LOGINSuccessful user loginPortal, Desktop
LOGOUTUser logout or session endPortal, Desktop
LOGIN_FAILEDFailed login attemptPortal, Desktop
SSO_INITIATEDSingle sign-on flow startedPortal, Desktop
SSO_COMPLETEDSSO authentication completed successfullyDesktop
SSO_FAILEDSSO authentication failedPortal, Desktop
PASSWORD_RESET_REQUESTPassword reset email requestedPortal, Desktop
PASSWORD_RESET_COMPLETEPassword reset completed successfullyPortal
PASSWORD_RESET_FAILEDPassword reset attempt failedPortal, Desktop
EMAIL_VERIFICATION_SENTEmail verification link sent during registrationPortal
EMAIL_VERIFICATION_COMPLETEEmail address verifiedPortal
User lifecycle and permission management events, primarily from the Portal.
ActionDescriptionSource
REGISTERNew user account created (via invitation or self-service)Portal
REGISTER_FAILEDUser registration failedPortal
UPDATE_PROFILEUser profile updated (role, site, or status change)Portal
DEACTIVATEUser account deactivatedPortal
REACTIVATEPreviously deactivated user account restoredPortal
INVITATION_SENTUser invitation sent or refreshedPortal
INVITATION_FAILEDUser invitation failed to sendPortal
INVITATION_VERIFIEDInvitation link verified during registrationPortal
INVITATION_VERIFICATION_FAILEDInvitation verification failed (expired or invalid)Portal
GRANT_ACCESSAccess granted to a user (role or site assignment)Portal
REVOKE_ACCESSAccess revoked from a user (invitation revoked or permission removed)Portal
Clinical data access and processing events. Portal handles project/protocol-level actions; Desktop handles data tool execution.
ActionDescriptionSource
CREATEClinical resource created (e.g., project, dataset)Portal
READClinical data accessed or viewed (e.g., DICOM dataset analysis)Desktop
UPDATEClinical resource updatedPortal
DELETEClinical resource deletedPortal
EXPORTClinical data exportedPortal
IMPORTClinical data importedPortal
PUBLISHProtocol or clinical resource publishedPortal
UNPUBLISHProtocol or clinical resource unpublishedPortal
SHAREClinical data sharedPortal
ARCHIVEClinical data archivedPortal
RESTOREArchived clinical data restoredPortal
ANONYMIZEDICOM data de-identified (severity: Critical)Desktop
VALIDATEData validated against policy or DICOM standards (severity: Medium)Desktop
TOKENIZEPatient identifiers tokenized (severity: High)Desktop
REDACTSensitive data redacted from documents (severity: High)Desktop
Data transfer and quality assurance events from the Desktop application’s contribution workflows.
ActionDescriptionSource
QA_SUBMITQA metrics submitted for a contributionDesktop
QA_EVALUATEQA evaluation triggered against a policyDesktop
TRANSFER_COMPLETEData transfer workflow completed successfullyDesktop
TRANSFER_FAILEDData transfer workflow failedDesktop
DATA_TRANSFER_COMPLETEDIntegration-level data transfer completed (e.g., SFTP upload)Desktop
DATA_TRANSFER_FAILEDIntegration-level data transfer failedDesktop
Integration synchronization and execution events.
ActionDescriptionSource
API_CALLExternal API call madePortal
WEBHOOK_TRIGGEREDWebhook event triggeredPortal
SYNC_COMPLETEDIntegration sync completed (e.g., platform contribution sync)Desktop
Credential and integration access management from both Portal and Desktop.
ActionDescriptionSource
ACCESSCredential accessedPortal
CREATECredential group created, or users added to credential groupPortal
UPDATECredentials updated (SFTP config, connection status, etc.)Portal, Desktop
DELETECredential group deleted, or user removed from credential groupPortal, Desktop
ROTATECredentials rotatedPortal
TEST_CONNECTIONIntegration connection test performedDesktop
Policy management and compliance-related events.
ActionDescriptionSource
UPDATE_CHECKPolicy update check performedPortal
DOWNLOADPolicy downloaded to Desktop for local evaluationDesktop
VALIDATEPolicy validation performedPortal
EXPORTPolicy or compliance report exportedPortal
Configuration changes to system settings, sites, and integration infrastructure.
ActionDescriptionSource
CONFIG_UPDATESystem configuration changedPortal
SYSTEM_UPDATESystem-level update appliedPortal
MAINTENANCEMaintenance operation performedPortal
INTEGRATION_ENABLEDIntegration enabled for organizationPortal
INTEGRATION_DISABLEDIntegration disabled for organizationPortal
API_KEY_GENERATEDAPI key generatedPortal
API_KEY_REVOKEDAPI key revokedPortal
WEBHOOK_CONFIGUREDWebhook endpoint configuredPortal
UPDATEConfiguration resource updated (e.g., site external ID, label mapping)Portal, Desktop
System-level events and application lifecycle.
ActionDescriptionSource
DOWNLOAD_APPLICATIONAitriumOS Desktop application downloadedPortal
HEALTH_CHECKSystem health check performedPortal

​
Resource Types

Each audit event references the type of resource affected:
Resource TypeDescription
UserUser accounts and profiles
SiteResearch sites
ProjectClinical research projects
ProtocolClinical protocols
IntegrationExternal system integrations
Credential GroupIntegration credential groups
Data PolicyData compliance policies
RoleUser role assignments
OrganizationOrganization records
Site ContributionData submissions to a project from a site
Data Tool RunExecution of a clinical data tool (Desktop)
DocumentFiles and documents
Audit LogAudit log export records

​
Filtering Audit Logs

​
Filter Presets

Quick-access presets surface common views with one click:
PresetWhat It Shows
Auth FailuresFailed login and SSO attempts (LOGIN_FAILED, SSO_FAILED)
Identity AccessUser management and permission changes (all IDENTITY_ACCESS events)
Clinical DataData access and modification events (all CLINICAL_DATA events)
Integration AccessIntegration execution and credential events (INTEGRATION and CREDENTIAL categories)
Policy CompliancePolicy-related actions (all POLICY_COMPLIANCE events)
Filter preset buttons for quick access to common audit views

​
Quick Date Filters

  • Today — Events from the current day
  • Last 7 Days — Events from the past week

​
Advanced Filters

Click More Options to access the full set of filters:
FilterDescription
Action CategoriesMulti-select from the 9 event categories
Event TypesFilter by specific actions (e.g., LOGIN_FAILED, INVITATION_SENT, ANONYMIZE)
Resource TypesFilter by affected resource type
Integration OperationsFilter by specific integration operation names
Date RangeCustom from/to date picker
SearchFull-text search across action, category, resource, email, and event details
Active filters display as badges with a total count indicator. Click Reset to clear all filters. Advanced filter panel with multi-select dropdowns and date range picker

​
Viewing Log Details

Click View Details on any row to open the detail dialog, which displays:
  • Actor — Who performed the action (display name and email)
  • Action Details — Structured grid of event properties as label/value pairs
  • Request Information — Source application, timestamp, and request context
  • Additional Metadata — Full event context in JSON format (scrollable for large entries)
Audit log detail dialog showing actor, action details, and metadata

​
Exporting Audit Logs

Export filtered audit logs as a CSV file for compliance reporting or offline analysis.
  1. Apply your desired filters (presets, date range, or advanced filters)
  2. Click Export
  3. Review the export dialog, which shows:
    • Total rows that will be exported
    • Active filters applied to the export
  4. Confirm to download the CSV file
Export dialog showing row count and active filter summary

​
Export Details

PropertyValue
FormatCSV
File nameaudit-logs-export-{timestamp}.csv
Row limit50,000 rows per export
Included columnsEvent time (UTC), recorded time (UTC), actor email and display name, action, category, outcome, target resource type and display name, target user (if applicable), source app, authentication method, reason for change, change reference, details summary
Excluded dataIP addresses, authentication tokens, raw internal IDs, API keys, passwords, and other sensitive fields are automatically excluded
If your filtered results exceed 50,000 rows, narrow your filters (e.g., reduce the date range or add category filters) and export in batches.