The Log tab is the audit trail of operator actions
A record of who approved a change, who flagged one suspect, who rebuilt the baseline or changed the configuration.
File-integrity monitoring is only trustworthy if the reviewers are accountable too.
Every state-changing action (approve, suspect, baseline update, config change) is written to this audit log with the timestamp, the admin user and a description.
It answers "who signed off on this change, and when".
¶ How to use it
- Search by user or action to reconstruct a review.
- During an incident, use it to establish the human decisions taken around a change.
- Provide it as evidence of separation of duties for compliance audits.
The audit log is separate from the Check runs history: runs record what the scanner did, the Log records what the operators did.