How to Review System Access Logs

Note: the Settings landing page card for this used to be called "Suspicious Behavior" — that name and its old URL slug (?tab=suspicious-behavior) are stale leftovers from a rename; the real, current tab is "System Access Logs." An old bookmark or link to the stale slug still opens this tab (unknown tabs silently fall back to the first one), it just won't update the address bar.

Review sign-ins, session activity, and security events across your organization — this is a read-only log; you can't act on an entry directly from here.

Before you start

The Manage Access Rules right.

Steps

1. Go to Settings → System Security → System Access Logs.
2. Four stat tiles summarize the last 24 hours: Total Events, Blocked Requests, Suspicious Events, Unique IPs.
3. Filter with From/To dates, Event Type (sign-ins, password changes, blocks, role changes, and more), Status, Severity, IP Address, Member ID, or toggle Suspicious only.
4. Click a row to open its detail — IP, country, city, user agent, request path, and a raw JSON details block if present. This dialog is read-only; there's no force-logout or block-this-IP action here.
5. Use Export CSV to download the currently filtered view, or Refresh to reload.

If you see something suspicious

This screen won't let you act on it directly — go to Access Blocks to block the IP or country, or review Detection Rules (below) to see whether an automated rule should be catching it going forward.