Skip to main content
PropOps Web surfaces its audit and security logs in several places across the admin panel. This guide walks through each view, what it shows, and how to filter or export the data you need.
All log views require a staff-level account with the appropriate API permission. If a section is missing for your account, contact your PropOps administrator to check your assigned permissions.

​
Activity Log

The Activity Log is the primary audit trail. It shows every event recorded in user_activity_log — login events, page views, admin actions, guard page outcomes, and more. Required permission: api.admin.activity_log.view
1

Open the admin panel

Navigate to your PropOps admin panel. The URL is typically /admin relative to your installation root.
2

Go to the Activity Log

In the admin navigation, find Security or Logs and select Activity Log.
3

Choose a time range

Use the Time range filter at the top of the page to narrow results. The available options are:
  • Last 24 hours (default)
  • Last 7 days
  • Last 30 days
  • Last 90 days
  • All time
4

Filter by activity type

Use the Activity type dropdown to focus on a specific event category. Useful filters include:
  • failed_login — see all failed authentication attempts
  • guard_ip_pin_verified — see all successful IP location verifications
  • staff_user_status_change — see all account status changes made by staff
  • 403_access_denied — see all unauthorised access attempts
5

Search

The search box matches against decrypted name, email address, IP address, and the activity_details JSON content. Use it to look up a specific user or IP address.
6

Filter by job

To see all activity associated with a specific job, enter the job UUID in the job filter field. The log will show every page view, note, and change linked to that job.

​
Reading the activity log

Each row in the log shows:
ColumnWhat it means
UserThe name and avatar of the account that triggered the event
Activity typeMachine-readable event category (see Audit Log Reference)
IP addressDecrypted source IP — stored encrypted in the database
DetailsParsed JSON context for the event (names, URLs, action outcomes, etc.)
TimeUTC timestamp of the event
Use the Activity type breakdown panel (if visible) to see a count of each event type in the current filter window. This quickly highlights unusual spikes such as a surge in failed_login or 403_access_denied events.

​
Security Dashboard

The Security Dashboard gives a high-level overview of your installation’s security posture, including login anomalies, breach detections, file integrity status, and API usage trends. Required permission: api.admin.security_report.manage
1

Open the admin panel

Navigate to your PropOps admin panel.
2

Go to the Security Dashboard

In the admin navigation, select Security. The dashboard is typically the default view within the security section.
3

Select a time range

The dashboard time range defaults to the last 30 days. Use the selector to switch to 24 hours, 7 days, or 90 days depending on the investigation window you need.

​
What the Security Dashboard shows

A total count for the selected period, plus a breakdown of:
  • Suspicious IPs — addresses with 5 or more failed attempts in the last hour
  • Targeted accounts — individual accounts with more than 5 failed attempts in 24 hours
  • Multi-account spray attacks — IPs that have attempted 3 or more different accounts in 24 hours
If any of these thresholds are exceeded, the dashboard raises an alert. These metrics are sourced from the login_attempts table and do not require decryption.
A count of unresolved file integrity violations from the system_security_alerts table. All file integrity violations are treated as critical.Each violation shows:
  • The affected file path
  • When the change was detected
  • Whether the alert has been resolved
To resolve an alert, select the alert row and click Resolve. This writes a security_alert_resolved entry to the activity log with your identity and timestamp.
A count of accounts where a password breach was detected in the last 7 days. PropOps checks passwords against the HaveIBeenPwned database using a privacy-preserving k-anonymity method.When a breach is detected, the affected account’s sessions are immediately invalidated and a password-reset email is sent. You can also view affected accounts in Admin → Security → Password Breaches.
This week vs last week comparison for total API requests. A significant increase can indicate automated abuse, a misconfigured integration, or a spike in legitimate usage.The panel also shows the top endpoints by request volume so you can identify which parts of the platform are being used most heavily.
A total count of currently valid sessions across all users. Cross-reference this with the time of day and expected user population to spot anomalies.

​
Password Breach Monitoring

A dedicated view of all accounts where a password breach has been detected. Required permission: api.admin.security_report.manage (same as Security Dashboard)
1

Open the admin panel

Navigate to your PropOps admin panel.
2

Go to Password Breaches

In the admin navigation, select Security → Password Breaches.
3

Review affected accounts

Each row shows the affected account and the date the breach was detected. Accounts are automatically locked out and sent a reset email — this view lets you confirm the remediation happened and follow up where needed.

​
Per-user login history

You can view the login history and recent activity for any individual user directly from their account record.
1

Open the admin panel

Navigate to your PropOps admin panel.
2

Go to Users

Select Users in the admin navigation and locate the user you want to inspect.
3

Open the user record

Click on the user to open their full account record.
4

View the activity timeline

The user record includes an activity timeline sourced from user_activity_log, showing their login history, failed attempts, and recent actions. Each entry is colour-coded:
  • Green — successful login
  • Blue — logout
  • Red — failed login
  • Grey — other activity

​
Session management

Administrators can view and revoke active sessions for any user.
1

Open the admin panel

Navigate to Admin → Users and open the user record.
2

Open session management

Within the user record, find the Sessions section. This lists all currently active sessions with device type, last-seen time, and approximate location.
3

Revoke a session

Click Revoke next to any session to immediately invalidate it. The user will be signed out on that device. The revocation is logged to user_activity_log with your identity as the acting staff member.
4

Terminate all sessions

To sign a user out of all devices at once, use the Terminate all sessions option. This is recorded as a staff_session_terminate event in the activity log.
You can also manage your own active sessions from your profile without needing admin panel access:
1

Open your profile

Select your name or avatar in the top navigation bar.
2

Find Active Sessions

Locate the Active Sessions or Sessions panel in your profile security settings.
3

Revoke a session

Select Revoke next to any session you do not recognise or no longer need.

​
File integrity monitoring log

The file integrity monitor runs automatically every hour and records any unexpected application file changes.
1

Open the Security Dashboard

Navigate to Admin → Security. Unresolved file integrity alerts are shown prominently on the dashboard.
2

Review violations

Each violation entry shows the affected file, the detected change, and when the check ran. Review the file in question to determine whether the change was an authorised deployment or unauthorised modification.
3

Resolve or escalate

If the change was authorised (e.g. a deployment you made), click Resolve to clear the alert. If the source of the change is unknown, escalate to your security team immediately — this may constitute a data breach under UK GDPR Article 33.
All file integrity violations are treated as critical regardless of the severity value stored in the database. Do not dismiss alerts without first investigating the affected file.

​
API Usage Statistics

Detailed API usage logs are available separately from the security dashboard and are useful for tracking integration health or investigating unusual traffic patterns. Required permission: Staff access to the admin panel.
1

Open the admin panel

Navigate to Admin → Settings or Admin → API depending on your panel layout.
2

View API statistics

The API usage view shows per-endpoint request counts, average response times, error rate, and recent usage trends. Data is sourced from api_endpoint_usage_logs.

Audit Log Reference

Complete reference of every event type, log table, and encrypted field.

GDPR & Data Privacy

How PropOps supports UK GDPR compliance, including data retention and subject access requests.

Authentication

Guard pages, session management, and re-authentication flows.

Security Overview

Platform-wide security controls including encryption, headers, and monitoring.