Audit log

Auditing is always on and cannot be disabled. Every AI call (home page, search commands, MCP, alert action, scheduled jobs) writes one event to index=_internal sourcetype=copilot:audit: user, action, index, engine and model, masking mode, tool calls, latency, success, failure or refusal, token usage, rating. Events never contain raw logs, prompts or model output.

Dashboard

One SPL aggregates time buckets (5 min, 1 h or 1 d by window), by action, by outcome, by user, and P50 and P95 latency. Below is the event list, filterable by time, action, user, index, outcome and rating. An event's detail shows via (ui, search_command, mcp, alert_action, tick) and the error code.

Usage cards show tokens this month, estimated cost (only with prices in [usage] token_prices) and monthly budget progress. Crossing monthly_token_budget sends one alert through the channels, once per month.

Thumbs-down review

Thumbs-down only lists rated-down calls with Mark reviewed, Ignore and Undo per row. Review state is itself an audit event (feedback_reviewed); nothing in the KV store changes. The conversation behind a rating replays from Smart query history; the matching solution in the library is demoted automatically.

Forwarding

[audit_sinks] forwards the same metadata events to syslog (tcp:// or tls://, no UDP) or a webhook. A failure logs audit_sink_failed and never blocks a request. Configured under Audit forwarding in Settings.

Querying with SPL

index=_internal sourcetype=copilot:audit operation=investigate
| stats avg(latency_ms) p95(latency_ms) count by engine model

Field names match the dashboard: operation, user, engine, model, masking_mode, tool_calls, latency_ms, refused, error, prompt_tokens, completion_tokens, total_tokens, via, index.