Audit Search

brewlytics records who did what, to what, and when as a per-resource audit trail — every model execution, functional publish, task run, login, and credential use is logged. Audit Search, in the admin console, gathers those trails into one place instead of leaving them scattered across separate resource pages.

What’s Audited

Audit Search is a tabbed view across five resource types, each tracking its own set of verbs:

• Functionals — Search, Execute, Create, Read, Update, Delete
• Models — Search, Execute, Create, Read, Update, Delete
• Tasks — Execute, Create, Read, Update, Delete
• Profiles — Login, Logout, Merge, Delete
• CV_Auth — Execute (a credential resolved and decrypted at run time), Create, Read, Update, Delete

Within a tab, a row of verb pills lets you narrow to one verb — or pick All to see every verb for that resource together, most recent first. Audit Search lives in the admin console, so it’s available to admins rather than every user.

Searching & Filtering

A shared filter bar sits above every tab:

• Actor — narrow results to a specific profile, picked from a live search.
• Date range — an inclusive since/until window, set from quick presets or a custom calendar pick down to the minute. The until bound is what lets you bracket a specific incident window — “only what happened between these two points” — rather than just an open-ended “everything since.”
• Job id — filter to the audit trail tied to one execution.
• Clear — appears once any filter is active, to reset the bar in one step.

Each verb also exposes facets specific to what’s meaningful for it — for example, a model Execute tab facets by run state and task id, while a functional Execute tab facets by the model it ran in; a Login tab facets by source IP; a CV_Auth Execute tab facets by credential type and the functional or model that used it; and Create/Read/Update/Delete verbs on Models, Functionals, and Tasks (plus Profiles’ Merge/Delete) facet by the specific resource instance, picked from a search. CV_Auth’s own Create/Read/Update/Delete verbs don’t have a matching facet. Results are listed newest first.

Drilling into an Entry

Rather than opening a separate detail view, each row expands its context inline and links onward to the resource itself:

• The actor’s avatar and name link to that profile’s admin page.
• Verb-specific detail sits next to the verb chip — an Execute row shows, where applicable, a duration, a status badge, and the job id; a failed functional execution shows its error message inline.
• Any resource the entry touched — the model, functional, or task involved — links to that resource’s own page (the model’s Build canvas, the functional’s reference page, the task’s admin detail), so you can go from “this ran” straight to what actually ran.
• Create/Read/Update/Delete rows show the affected resource’s full URN — linked out to that resource for models, functionals, and tasks. CV_Auth CRUD rows show the credential’s URN as plain text instead, since there’s no per-credential detail page to link to.

Audit Search is also reachable programmatically: each resource’s audit collection is queryable through its own /audits/search endpoint — see the relevant tag (models, functionals, tasks, profiles, auths) on the API Reference page.