> ## Documentation Index
> Fetch the complete documentation index at: https://help.propops.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Viewing Logs & Security Reports

> Step-by-step guide to finding and reading each log type available to administrators in PropOps Web.

PropOps Web surfaces its audit and security logs in several places across the admin panel. This guide walks through each view, what it shows, and how to filter or export the data you need.

<Note>
  All log views require a staff-level account with the appropriate API permission. If a section is missing for your account, contact your PropOps administrator to check your assigned permissions.
</Note>

***

## Activity Log

The Activity Log is the primary audit trail. It shows every event recorded in `user_activity_log` — login events, page views, admin actions, guard page outcomes, and more.

**Required permission:** `api.admin.activity_log.view`

<Steps>
  <Step title="Open the admin panel">
    Navigate to your PropOps admin panel. The URL is typically `/admin` relative to your installation root.
  </Step>

  <Step title="Go to the Activity Log">
    In the admin navigation, find **Security** or **Logs** and select **Activity Log**.
  </Step>

  <Step title="Choose a time range">
    Use the **Time range** filter at the top of the page to narrow results. The available options are:

    * **Last 24 hours** (default)
    * **Last 7 days**
    * **Last 30 days**
    * **Last 90 days**
    * **All time**
  </Step>

  <Step title="Filter by activity type">
    Use the **Activity type** dropdown to focus on a specific event category. Useful filters include:

    * `failed_login` — see all failed authentication attempts
    * `guard_ip_pin_verified` — see all successful IP location verifications
    * `staff_user_status_change` — see all account status changes made by staff
    * `403_access_denied` — see all unauthorised access attempts
  </Step>

  <Step title="Search">
    The search box matches against decrypted name, email address, IP address, and the `activity_details` JSON content. Use it to look up a specific user or IP address.
  </Step>

  <Step title="Filter by job">
    To see all activity associated with a specific job, enter the job UUID in the job filter field. The log will show every page view, note, and change linked to that job.
  </Step>
</Steps>

### Reading the activity log

Each row in the log shows:

| Column            | What it means                                                                    |
| ----------------- | -------------------------------------------------------------------------------- |
| **User**          | The name and avatar of the account that triggered the event                      |
| **Activity type** | Machine-readable event category (see [Audit Log Reference](/security/audit-log)) |
| **IP address**    | Decrypted source IP — stored encrypted in the database                           |
| **Details**       | Parsed JSON context for the event (names, URLs, action outcomes, etc.)           |
| **Time**          | UTC timestamp of the event                                                       |

<Tip>
  Use the **Activity type breakdown** panel (if visible) to see a count of each event type in the current filter window. This quickly highlights unusual spikes such as a surge in `failed_login` or `403_access_denied` events.
</Tip>

***

## Security Dashboard

The Security Dashboard gives a high-level overview of your installation's security posture, including login anomalies, breach detections, file integrity status, and API usage trends.

**Required permission:** `api.admin.security_report.manage`

<Steps>
  <Step title="Open the admin panel">
    Navigate to your PropOps admin panel.
  </Step>

  <Step title="Go to the Security Dashboard">
    In the admin navigation, select **Security**. The dashboard is typically the default view within the security section.
  </Step>

  <Step title="Select a time range">
    The dashboard time range defaults to the last 30 days. Use the selector to switch to 24 hours, 7 days, or 90 days depending on the investigation window you need.
  </Step>
</Steps>

### What the Security Dashboard shows

<AccordionGroup>
  <Accordion title="Failed login attempts">
    A total count for the selected period, plus a breakdown of:

    * **Suspicious IPs** — addresses with 5 or more failed attempts in the last hour
    * **Targeted accounts** — individual accounts with more than 5 failed attempts in 24 hours
    * **Multi-account spray attacks** — IPs that have attempted 3 or more different accounts in 24 hours

    If any of these thresholds are exceeded, the dashboard raises an alert. These metrics are sourced from the `login_attempts` table and do not require decryption.
  </Accordion>

  <Accordion title="File integrity alerts">
    A count of unresolved file integrity violations from the `system_security_alerts` table. All file integrity violations are treated as critical.

    Each violation shows:

    * The affected file path
    * When the change was detected
    * Whether the alert has been resolved

    To resolve an alert, select the alert row and click **Resolve**. This writes a `security_alert_resolved` entry to the activity log with your identity and timestamp.
  </Accordion>

  <Accordion title="Password breach monitoring">
    A count of accounts where a password breach was detected in the last 7 days. PropOps checks passwords against the HaveIBeenPwned database using a privacy-preserving k-anonymity method.

    When a breach is detected, the affected account's sessions are immediately invalidated and a password-reset email is sent. You can also view affected accounts in **Admin → Security → Password Breaches**.
  </Accordion>

  <Accordion title="API usage">
    This week vs last week comparison for total API requests. A significant increase can indicate automated abuse, a misconfigured integration, or a spike in legitimate usage.

    The panel also shows the top endpoints by request volume so you can identify which parts of the platform are being used most heavily.
  </Accordion>

  <Accordion title="Active sessions">
    A total count of currently valid sessions across all users. Cross-reference this with the time of day and expected user population to spot anomalies.
  </Accordion>
</AccordionGroup>

***

## Password breach monitoring

A dedicated view of all accounts where a password breach has been detected.

**Required permission:** `api.admin.security_report.manage` (same as Security Dashboard)

<Steps>
  <Step title="Open the admin panel">
    Navigate to your PropOps admin panel.
  </Step>

  <Step title="Go to Password Breaches">
    In the admin navigation, select **Security → Password Breaches**.
  </Step>

  <Step title="Review affected accounts">
    Each row shows the affected account and the date the breach was detected. Accounts are automatically locked out and sent a reset email — this view lets you confirm the remediation happened and follow up where needed.
  </Step>
</Steps>

***

## Per-user login history

You can view the login history and recent activity for any individual user directly from their account record.

<Steps>
  <Step title="Open the admin panel">
    Navigate to your PropOps admin panel.
  </Step>

  <Step title="Go to Users">
    Select **Users** in the admin navigation and locate the user you want to inspect.
  </Step>

  <Step title="Open the user record">
    Click on the user to open their full account record.
  </Step>

  <Step title="View the activity timeline">
    The user record includes an activity timeline sourced from `user_activity_log`, showing their login history, failed attempts, and recent actions. Each entry is colour-coded:

    * **Green** — successful login
    * **Blue** — logout
    * **Red** — failed login
    * **Grey** — other activity
  </Step>
</Steps>

***

## Session management

Administrators can view and revoke active sessions for any user.

<Steps>
  <Step title="Open the admin panel">
    Navigate to **Admin → Users** and open the user record.
  </Step>

  <Step title="Open session management">
    Within the user record, find the **Sessions** section. This lists all currently active sessions with device type, last-seen time, and approximate location.
  </Step>

  <Step title="Revoke a session">
    Click **Revoke** next to any session to immediately invalidate it. The user will be signed out on that device. The revocation is logged to `user_activity_log` with your identity as the acting staff member.
  </Step>

  <Step title="Terminate all sessions">
    To sign a user out of all devices at once, use the **Terminate all sessions** option. This is recorded as a `staff_session_terminate` event in the activity log.
  </Step>
</Steps>

You can also manage your **own** active sessions from your profile without needing admin panel access:

<Steps>
  <Step title="Open your profile">
    Select your name or avatar in the top navigation bar.
  </Step>

  <Step title="Find Active Sessions">
    Locate the **Active Sessions** or **Sessions** panel in your profile security settings.
  </Step>

  <Step title="Revoke a session">
    Select **Revoke** next to any session you do not recognise or no longer need.
  </Step>
</Steps>

***

## File integrity monitoring log

The file integrity monitor runs automatically every hour and records any unexpected application file changes.

<Steps>
  <Step title="Open the Security Dashboard">
    Navigate to **Admin → Security**. Unresolved file integrity alerts are shown prominently on the dashboard.
  </Step>

  <Step title="Review violations">
    Each violation entry shows the affected file, the detected change, and when the check ran. Review the file in question to determine whether the change was an authorised deployment or unauthorised modification.
  </Step>

  <Step title="Resolve or escalate">
    If the change was authorised (e.g. a deployment you made), click **Resolve** to clear the alert. If the source of the change is unknown, escalate to your security team immediately — this may constitute a data breach under UK GDPR Article 33.
  </Step>
</Steps>

<Warning>
  All file integrity violations are treated as critical regardless of the `severity` value stored in the database. Do not dismiss alerts without first investigating the affected file.
</Warning>

***

## API usage statistics

Detailed API usage logs are available separately from the security dashboard and are useful for tracking integration health or investigating unusual traffic patterns.

**Required permission:** Staff access to the admin panel.

<Steps>
  <Step title="Open the admin panel">
    Navigate to **Admin → Settings** or **Admin → API** depending on your panel layout.
  </Step>

  <Step title="View API statistics">
    The API usage view shows per-endpoint request counts, average response times, error rate, and recent usage trends. Data is sourced from `api_endpoint_usage_logs`.
  </Step>
</Steps>

***

## Related pages

<CardGroup cols={2}>
  <Card title="Audit Log Reference" icon="clipboard-list" href="/security/audit-log">
    Complete reference of every event type, log table, and encrypted field.
  </Card>

  <Card title="GDPR & Data Privacy" icon="shield-check" href="/security/gdpr">
    How PropOps supports UK GDPR compliance, including data retention and subject access requests.
  </Card>

  <Card title="Authentication" icon="key" href="/security/authentication">
    Guard pages, session management, and re-authentication flows.
  </Card>

  <Card title="Security Overview" icon="lock" href="/security/overview">
    Platform-wide security controls including encryption, headers, and monitoring.
  </Card>
</CardGroup>