audit-logs

9 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Audit logs availability and retention

Audit logs are available exclusively to Enterprise plan customers. Some logs used internally by Expo are immediately available upon subscription, while other types of logs start being collected after the subscription is activated. Audit logs are stored for 1.5 years. If an account is deleted, its audit logs are deleted after 90 days.

Audit logs are immutable

Audit logs can only be created and never modified or deleted. They serve as a source of truth to help monitor events and debug issues occurring within accounts.

Access audit logs location

To access audit logs, go to Account settings or Organization settings, then select Audit logs. The URL is https://expo.dev/accounts/[account]/settings/audit-logs.

Audit log entry fields

Audit log entries include the following fields: Actor (the account actor that performed the particular action), Entity Type (the object that was modified with one of the modification types: CREATE, UPDATE, DELETE), Action Type (the type of modification: CREATE, UPDATE, DELETE), Message (contains information based on the Action), and Created At (when the particular action was performed).

Audit log entities tracked

The following entities are currently tracked in audit logs: Account, Account subscription, Android App Credentials, Android Keystore, App Store Connect API key, Apple Device, Apple Distribution Certificate, Apple Provisioning Profile, Apple Team, EAS Hosting Alias, EAS Hosting Custom Domain, EAS Hosting Deployment, EAS Update Branch, EAS Update Channel, Google Service Account key, iOS App Credentials, LogRocket Organization, LogRocket Project, Organization SSO Configuration, Project, User Invitation, User Permission, Workflow, and Workflow Revision.

Export audit logs procedure

To export audit logs: (1) In the sidebar menu under Account/Organization settings, click Audit logs. (2) Click the Export button in the top-right corner of the audit logs page. (3) Select your desired time range. Export is available with a time range of up to 30 days. (4) The audit logs will be exported as a file for download. The exported file includes all fields shown on the Audit logs page except for the Message field.

Audit logs export API availability

There is no API available for programmatic export of audit logs. Export is currently only available through the Expo website.

Permission monitoring use case

Audit logs can track user invitations and permission changes within an organization. For example, if a compromised employee account invites an attacker and changes their permission to Admin, audit logs would record which employee account performed these actions. Since audit logs are immutable, the attacker cannot delete this recorded history, allowing other organization members to review the logs, identify the compromised account, and take corrective action.

Access history use case

Audit logs track when access to Apple teams and devices is granted and removed, providing historical record keeping. While the Expo team's settings only show devices currently registered to an account, audit logs allow viewing of historical modifications to Apple teams and devices, which is useful for investigating internal security incidents.

Give your agent this brain