Who did what, when, where and how

2025-01-15 14:30:25 UTC
User: john.silva@company.com
IP: 203.0.113.45
Action: EXPORTED_CONTACTS
Details: 1,500 contacts exported to CSV
Status: Success

✅ LOGIN_SUCCESS
├─ User: maria@company.com
├─ IP: 198.51.100.20
├─ Device: Chrome/Windows
└─ Time: 2025-01-15 09:00:00

❌ LOGIN_FAILED
├─ User: hacker@evil.com
├─ IP: 192.0.2.100
├─ Reason: Invalid password
├─ Attempts: 5
└─ Time: 2025-01-15 03:45:12

🚪 LOGOUT
└─ User: john@company.com

📝 CONTACT_CREATED
├─ Who: agent@company.com
├─ Contact: John Silva (#12345)
└─ Source: Manual import

✏️ CONTACT_UPDATED
├─ Who: agent@company.com
├─ Contact: John Silva (#12345)
├─ Changed: phone, email, plan
└─ Before: plan=Free
└─ After: plan=Premium

🗑️ CONTACT_DELETED
├─ Who: admin@company.com
├─ Contact: Maria Santos (#12340)
├─ Reason: GDPR deletion request
└─ Permanent: Yes

⚙️ SETTINGS_CHANGED
├─ Who: admin@company.com
├─ Section: SLA Policies
├─ Action: Created new policy "VIP"
└─ Details: FRT=5min, RT=2hours

🔐 PERMISSIONS_CHANGED
├─ Who: admin@company.com
├─ User: newagent@company.com
├─ Action: Promoted to administrator
└─ Previous role: Agent

🔌 INTEGRATION_ENABLED
├─ Who: admin@company.com
├─ Integration: OpenAI
└─ Configured: API Key, Model GPT-4

📤 DATA_EXPORTED
├─ Who: manager@company.com
├─ Type: Contacts CSV
├─ Records: 5,000 contacts
├─ Fields: name, email, phone, plan
├─ IP: 203.0.113.50
└─ Reason: Monthly report

📤 REPORT_DOWNLOADED
├─ Who: director@company.com
├─ Report: Conversations (Jan 2025)
├─ Format: PDF
└─ Size: 2.5 MB

📅 Period:
├─ Last 24 hours
├─ Last 7 days
├─ Last 30 days
└─ Custom date range

👤 User:
└─ john@company.com

🎯 Action Type:
├─ Authentication
├─ Data Changes
├─ Exports
└─ Settings

🌐 IP Address:
└─ 203.0.113.0/24

✅ Status:
├─ Success
├─ Failed
└─ Pending

Last 30 days:

🔐 Failed Logins: 45
├─ Same IP (192.0.2.100): 30 attempts
└─ ⚠️ Action: IP blocked

📤 Data Exports: 12
├─ Average: 2,500 records/export
└─ Who: Manager team (authorized)

⚙️ Setting Changes: 8
├─ Who: 2 administrators
└─ Reviewed: All compliant

🚨 Multiple failed logins
→ Possible brute force attack

🚨 Export of large volumes
→ Possible data exfiltration

🚨 Access outside business hours
→ Possible compromise

🚨 Privilege changes
→ Possible privilege escalation

🚨 Mass deletions
→ Possible sabotage