Best Practices
Recommendations for getting the most out of the Platform Audit page during rollout, governance reviews, and day-to-day operations.
Use the Report Date as a fixed anchor
The Report Date is the end of the timeframe window, not the start. When investigating a specific incident, set the Report Date to the day after the event you are looking into and then choose the timeframe that gives you the right amount of context (Week for a localized review, Month for a longer trend).
If you change the Report Date while keeping the Timeframe constant, both the cards and the chart slide together: they always represent the same window.
Match the timeframe to the question
| Question | Suggested timeframe |
|---|---|
| Did this user take any actions yesterday? | Week |
| Who has been most active this month? | Month |
| Is platform usage trending up or down? | Quarter or Year |
| Are there spikes in delete activity around a release? | Week, anchored to the day after the release |
A smaller timeframe gives finer chart bars (daily) at the cost of less historical context; a larger timeframe summarizes more history but coarsens the chart to weekly, monthly, or quarterly bars.
Separate user activity from automation early
When trying to understand human adoption, enable the Hide Qualytics toggle so automated scheduled activity is removed from both the chart and the log. The Active users metric ignores internal users in both modes, but the other cards and the chart segments are easier to read with automation hidden.
When investigating an operational anomaly (a runaway loop, a misconfigured schedule, an unexpected backfill), leave the toggle off so the Automated chart segment is visible alongside user activity.
Filter by actor or action before exporting
The CSV export is page-scoped: it exports only the rows currently visible on the page. To export a focused dataset, narrow the log with the filters first (specific users, specific actions) and pick a page size that fits the population. Each export is a point-in-time snapshot. For full retrospective analysis, prefer the API.
Cross-reference with entity history
The Audit page is a workspace-wide log. When you spot something suspicious, drill into the affected entity (datastore, check, anomaly) and use its dedicated History tab to see the per-entity change record with full before/after values. The Audit page tells you who, when, and what kind of action; the entity history tells you exactly which fields changed.
Use the chart as a leading indicator
The stacked bar chart makes step-changes in activity easy to spot at a glance:
- Tall user bars clustered on a few days suggest concentrated rollout activity (training, onboarding, bulk imports).
- Tall automated bars spread evenly across the window indicate steady scheduled workloads.
- Empty days between bars in a Week or Month view often signal weekends or quiet periods.
Pair a glance at the chart with a click into the corresponding day in the log when an unusually tall bar warrants explanation.
Schedule regular reviews
For governance, schedule a recurring review of the Audit page: for example, the first business day of each month with the Timeframe set to Month and the Report Date set to the prior month's end. Export the relevant pages for the audit trail you maintain outside of Qualytics, and document any unexpected actor or action concentrations in your change-management notes.