Use the global audit log

Global Audit Log (/dashboard/super-admin/global-audit-log) is the cross-domain investigation view for users, IPs, correlation identifiers, and platform events.

Search with the most specific known identifier. Apply event, actor, environment, and time filters before exporting or escalating.

tip

A correlation ID is usually safer and more precise than a person’s name. Preserve it in the incident record so another reviewer can reproduce the investigation.

Do not use audit search for curiosity or general user browsing. Every investigation should have a documented operational or security purpose.