Audit log

Auditing is always on and cannot be disabled. Every AI call (home page, search commands, MCP, alert action, scheduled jobs) writes one event to index=_internal sourcetype=copilot:audit: user, action, index, engine and model, masking mode, tool calls, latency, success / failure / refusal, token usage, rating. Never raw logs, prompts or model output.

Dashboard

One SPL aggregates time buckets (5 min / 1 h / 1 d by window), by action, by outcome, by user, P50 / P95 latency; below is the event list, filterable by time / action / user / index / outcome / rating. An event's detail shows via (ui / search_command / mcp / alert_action / tick) and the error code.

Usage cards: tokens this month, estimated cost (only with prices in [usage] token_prices), monthly budget progress. Crossing monthly_token_budget sends one alert through the channels, once per month.

Reviewing thumbs-down

"Thumbs-down only" lists rated-down calls with "Mark reviewed" / "Ignore" / "Undo" per row. Review state is itself an audit event (feedback_reviewed), nothing in the KV store changes. The conversation behind a rating replays from Smart query history; the matching solution in the library is demoted automatically.

Forwarding

[audit_sinks] forwards the same metadata events to syslog (tcp:// / tls://, no UDP) or a webhook; a failure logs audit_sink_failed and never blocks a request. Configured under "Audit forwarding" in Settings.

Querying with SPL

index=_internal sourcetype=copilot:audit operation=investigate
| stats avg(latency_ms) p95(latency_ms) count by engine model

Field names match the dashboard (operation / user / engine / model / masking_mode / tool_calls / latency_ms / refused / error / prompt_tokens / completion_tokens / total_tokens / via / index).