How can we help?

Reviewing audit activity helps Enterprise administrators investigate relevant events, understand operational changes, and identify activity that may require further attention. An effective investigation should focus on the specific event or business operation rather than reviewing unrelated records. How to investigate an event Step 1: Identify the issue. Determine what happened or what activity requires review. Examples include an unexpected configuration change, a failed operation, or a suspected unauthorized action. Step 2: Establish the relevant timeframe. Identify the approximate date and time of the event. Include the timezone when documenting the incident. Step 3: Identify the affected workspace. Confirm which Enterprise workspace or business environment is involved. Step 4: Review the available audit information. Use the relevant governance or audit functionality available to your authorized account. Step 5: Identify related events. Look for records associated with the same operation, resource, or timeframe. Step 6: Review the recorded actor. Where actor information is available, determine whether the event was associated with a human user, system component, or another recorded source. Step 7: Examine the event outcome. Identify whether the record indicates success, failure, rejection, or another relevant result. Step 8: Compare with execution history. If the issue involves an automation, AI Employee, workflow, or business process, review the corresponding execution information. Step 9: Check external dependencies. If an integration was involved, verify the outcome in the external service where appropriate. Step 10: Document the findings. Record the relevant evidence, observations, and any corrective actions. What if I cannot find the event? Possible explanations include: 1. The wrong workspace was selected. 2. The timeframe is incorrect. 3. The event is recorded in a different operational history. 4. Your account lacks permission to access the relevant records. 5. The event type is not included in the available audit coverage. 6. The record is outside the applicable retention period. Do not assume that the absence of a visible record proves that an activity did not occur. Can I investigate an incident using only audit logs? Not always. A complete investigation may require execution results, user access information, integration details, and records from external systems. Should I modify the configuration during an investigation? Avoid unnecessary changes before collecting relevant evidence. Configuration changes may alter the environment and make the original problem more difficult to reproduce. When should I contact Polyosync Support? Contact Support when relevant records are inaccessible, an event cannot be explained, or a suspected platform issue requires further investigation. Provide the affected workspace, approximate timestamp, event description, and any non-sensitive diagnostic information. Recommended approach Investigate events systematically using the available audit information and related operational records. Avoid drawing conclusions from isolated events without reviewing their surrounding context.