Audit log
A record of sign-ins, queries, model calls, and settings changes with operator, time, index, action, outcome, and token use. Filter, export, and forward to a SIEM.
The audit log shows the events the gateway writes to the .rst_copilot_audit index. It is under Platform health > Audit log, is available in every edition, and only administrators can view it. Turn auditing on in Settings; until then the page shows Auditing is off.
Call overview
For 1 hour, 24 hours, or 7 days, the overview shows calls, failures, and Latency P50 / P95, with the call volume and a breakdown By action below.
Filter and export events
Filter the events by Action, Outcome, User (exact match), and Index. Export CSV exports the filtered set.
Select View details on a row to see latency, model and token use, a digest of the masked content sent to the model, and the full JSON, which you can copy.
Actions
| Action | Source |
|---|---|
| Sign in, Sign out | Sign-in page and account menu |
| Generate query, Run query, Explain, Explain a result, Explain a log, Feedback | Ask AI |
| Investigate, Investigate an alert, Triage, Bulk triage | Alerts, Triage |
| Detection rule, Generate a detection rule, Detection rule copilot | Detection rules |
| Baseline run | Baseline checks |
| Platform checkup, Checkup readout | Platform health |
| Field dictionary, Kibana hand-off, Incident report, Operations report | The matching pages |
| Content pack applied, Content pack rolled back, Release staged | Online update |
Forward to a SIEM
Events can also go to syslog (RFC 5424) and a webhook (POST JSON), configured in Settings. Forwarding requires an Enterprise license. Because events carry the operator, index names, and question text, the webhook host must be in RST_AUDIT_WEBHOOK_ALLOWLIST, and loopback and link-local addresses are always refused.
Retention
By default the audit index keeps every event. With RST_ILM_BOOTSTRAP=1, the gateway creates an ILM policy at startup, and RST_AUDIT_RETENTION_DAYS sets the retention, 180 days by default.
License
What each license tier includes, how to get a trial, online and offline activation, and what each license state means.
Outbound channels
Push reports and high-severity alerts to Feishu, DingTalk, WeCom, Teams, Slack, or email. Destinations, periods and alert threshold, mail server; failed deliveries retry and can be resent.