Skip to main content
Each row of the Audit Log is one tool call: the moment an agent added a note, updated a ticket, reset a password, ran a script, or read something from your PSA, RMM, or Microsoft 365. Open it from Activity → Audit log in the dashboard; the Executions tab beside it lists the runs those calls belong to. Use it when you want to know “did one of my agents do this?” — a ticket that changed status, a note nobody remembers writing, a user that was disabled. Search the ticket number or the user’s name and the log shows which agent acted, when, with what input, and what came back.
The log covers triggered agents, scheduled agents, and chat agents at once, and is scoped to your tenant. What you see follows your workflow access: an admin sees every agent; a user or viewer sees the agents they created or that were shared with them. It keeps 30 days of history.

​
What each row shows

Click a row to expand it. The expanded view shows the exact input the agent sent to the tool, a summary of what the tool returned (the first 400 characters), the tool’s internal name, and an Open run link to the full execution trace — every thought, tool call, message, and complete tool result of that run.

​
Finding an action

  • Search matches the ticket number, user, device, or any other value in the tool’s input, as well as the tool and agent names. Type a ticket number to see everything any agent did on that ticket.
  • All tools narrows the log to one tool, with the number of calls in the last 30 days next to each.
  • All agents narrows it to one agent.
  • Errors shows only calls that failed.
Rows load 50 at a time, newest first. Use Load older actions at the bottom to page back through the 30-day window.

​
Ask Neo Support

The Neo Support Agent reads the same log. Ask it “did one of my agents touch ticket 48213?” or “who disabled this user last week?” and it searches the Audit Log for you, names the agent and the tool, and can open the run’s full trace. It answers under your own access: it shows the same agents you would see on the page, and a person with no dashboard account is told to ask an administrator for one.

​
Read it through the API

The log is also available on the public API, for your own scripts or reporting: The window is always the last 30 days. An API key with no acting user reads every agent; a call made on behalf of a dashboard user follows that user’s workflow access, exactly as the page does. Full parameters and response schemas are under Endpoints in the API reference.
Tool inputs are shown as the agent sent them, with two exceptions applied when the step is recorded. Fields named password or secure are masked whole. A password written inside a script is replaced by ***REDACTED-SECRET*** in the three places a PowerShell account-creation or password-reset step puts one: the literal given to ConvertTo-SecureString, the value of a -Password style parameter, and a password assigned to a variable. The rest of the script stays readable, the script still runs, and technician approval still shows you the real one. A password written some other way into a script can still be stored. Everything else is stored as sent, so treat tool inputs as internal data. Loading a Neo skill shows as “Skill loaded” rather than the skill’s content, here and in the run trace.