Audit log
A record of every query, model call, offense write-back and settings change: who, when, which source, what, outcome, token usage. Filter, export, forward (QRadar itself included).
The audit log reads the events written to the audit table in copilot.db once audit is enabled in Settings. A tab of Platform health, in every edition; admins see everything, analysts their own.
Overview
Window 1 h / 24 h / 7 d. Three cards: calls, failures, P50 / P95 latency; below, the call curve and the action donut.
Events
Filters: action, outcome (success / failure), user (exact), source (events / flows). "Export CSV" takes the current filter result.
Recorded actions:
| Action | From |
|---|---|
| Generate query / execute query / explain result / explain log | Ask AI; the execute event carries the full AQL as run (after the whitelist append) |
| Investigate / batch triage / incident report | Offenses, Triage |
| Offense action | Note / close / assign written to QRadar, with offense id, action and operator. QRadar only records the token's authorized service; who clicked is here |
| Generate detection rule | Rule copilot |
| Platform checkup / interpretation | Platform health |
| Console link / report | The respective pages |
| Content pack applied / rolled back / release staged | Online update |
| Settings change | Settings |
| Feedback | 👍 / 👎 in Ask AI |
Event detail
"View details": time, user, action, source, outcome, latency, model and token usage, a summary of the masked content sent to the model, and the full JSON (copyable).
Forwarding to a SIEM
Events can be forwarded to syslog (RFC 5424) and a webhook (POST JSON) at the same time, configured in Settings. The syslog target can be QRadar itself: create a Syslog log source for it and every query and offense action from the gateway becomes a searchable, rule-able event in QRadar. Webhook targets must be within RST_AUDIT_WEBHOOK_ALLOWLIST: events carry the operator, the AQL and the original question.
Retention
RST_AUDIT_RETENTION_DAYS (180 by default) sets retention, with automatic pruning from copilot.db; backups in Upgrade and backup.
Activation
Which capabilities need a licence, how to get a trial, online and offline activation, licence states, upgrade notes.
Notifications
Push reports and high-severity offenses to Feishu, DingTalk, WeCom, Teams, Slack or email: destinations, periods and alert threshold, mail server; failed deliveries retry and can be resent.