Audit
A record of every login, query, model call and settings change: who, when, which index, what, outcome, tokens. Filter, export, forward.
Audit reads the events written to .rst_copilot_audit once audit is enabled in Settings. In the tabs of Platform health; every edition; administrators see everything, analysts their own.
Overview
Window 1 h / 24 h / 7 d. Three cards: calls, failures, latency P50 / P95; below, the call-volume curve and the action mix donut.
Events
Filters: action, outcome (success / failure), user (exact), index. "Export CSV" takes the filtered set.
Recorded actions:
| Action | From |
|---|---|
| Generate query / execute / explain / explain result / explain log | Smart query |
| Alert investigation / triage / batch triage | Live alerts, Batch triage |
| Generate detection rule | Detection rules |
| Baseline run / platform check-up / check-up read | Baseline, Platform health |
| Field dictionary / Kibana link / incident report / report | The matching pages |
| Content pack apply / rollback / release staged | Online update |
| Feedback | 👍 / 👎 in Smart query |
Event details
"View details": time, user, action, index, outcome, latency, model and token use, a digest of the masked content sent to the model, and the full JSON (copyable).
Forwarding to a SIEM
Events can also go to syslog (RFC 5424) and a webhook (POST JSON), configured in Settings. Webhook targets must be in RST_AUDIT_WEBHOOK_ALLOWLIST: the events carry the operator, index names and question text.
Retention
The audit index grows without bound by default. RST_ILM_BOOTSTRAP=1 makes the gateway create an ILM policy on start; RST_AUDIT_RETENTION_DAYS (180 default) sets the retention.
Activation
Which capabilities need a licence, how to get a trial, online and offline activation, licence states, upgrade notes.
Notifications
Push reports and high-severity alerts to Feishu, DingTalk, WeCom, Teams, Slack or email: destinations, periods and alert threshold, mail server; failed deliveries retry and can be resent.