Audit Viewer

Section	Description
Feature Area	Troubleshooting / IT and Integrations
Navigation	Admin → Troubleshooting → Audit Viewer
Alt Navigation	Menu → IT and Integrations → Audit Viewer
Primary Function	Monitor, filter, and review all admin configuration change events across the Genesys Cloud organization
Typical Use Cases	Compliance auditing, change management, security review, troubleshooting unexpected configuration changes

The Audit Viewer enables administrators to filter and view events that Genesys Cloud generates based on service actions for administrative functions. It provides two modes: a full-page viewer with detailed filtering and a mini footer viewer accessible from any admin page.

---

Study Notes

Topic	Explanation
Audit Viewer	Tool that logs and displays admin-level configuration events across the org
Full-Page Viewer	Main audit interface with complete filtering and event detail — opened from Admin or Menu
Mini Viewer (Footer)	Lightweight version available at the bottom of any admin page; less detail than full viewer
Event	A logged action triggered by a user or an upstream service/API
Entity	The object being acted upon (e.g., a queue, a flow, a user)
Property Changes	Detail view shows values before and after each change
Related Events	Upstream or downstream events linked to the selected event
RemoteIP	IP address of the user who triggered the event (visible in event details)
Real-time vs Async	The UI viewer shows real-time query results only; async queries require the API or Amazon EventBridge
Amazon EventBridge	Integration that allows orgs to consume all audit events — useful for backup or ingestion into external log tooling

---

Permissions

Action	Permission Required
View audit events	Audits > Audit > View
View interaction audit trail (separate)	Audits > Interaction Details > View

The Admin role is also listed as a prerequisite for full use of the Audit Viewer.

---

Navigation

Task	Path
Open full-page viewer	Admin → Troubleshooting → Audit Viewer
Alt full-page path	Menu → IT and Integrations → Audit Viewer
Open mini footer viewer	Bottom of any admin page under Menu → IT and Integrations → hover → click Show audits footer
Close mini footer viewer	Click Hide audits footer
Go from footer to full page	Click Link to full page audit viewer icon in the footer

---

Viewer Modes

Mode	Description	Detail Level
Full-Page Viewer	Main audit log interface with date range, service filter, entity filter, user filter, and event detail panel	Full
Mini Viewer (Footer)	Lightweight footer panel visible from any admin page	Limited

---

Filtering Options (Full-Page Viewer)

Filter	Description
Date Range	Select Start and End dates/times. Default: current day. Maximum interval: last 14 days
Filter by Service	Select Service Name → Entity Type → Action to narrow results
Filter by Entity	Enter an Entity ID to find all events affecting a specific object (e.g., a specific queue ID)
Filter by User	Enter a user name to see all events performed by that user
Refresh	Apply filters and reload results

Important: The UI viewer only supports queries for the last 14 days. For events older than 14 days, use the Audit APIs available in the Genesys Cloud Developer Center.

---

Event Detail View

Clicking any event in the results opens the Details panel, which shows:

Detail Field	Description
Who performed the action	User name, or API / upstream service if system-generated
Causing event link	If an upstream service triggered the event, a related link is available
RemoteIP	IP address of the user who triggered the event
Property Changes	Before and after values for each changed property
Related Events	Linked upstream or downstream events — click See related audits

---

Data Retention & API Access

Method	Scope	Notes
Audit Viewer UI	Last 14 days (real-time query)	Date interval cannot exceed 14 days
Audit APIs (Developer Center)	Beyond 14 days	Use asynchronous query endpoints
Amazon EventBridge	All available audit events	Useful for backup or ingestion into external SIEM/log tooling

---

Interaction Audit Trail (Related but Separate Feature)

The Audit Viewer covers org-wide admin changes. There is a separate Audit Trail tab on individual interactions that tracks recording and evaluation-level access:

Attribute	Detail
Navigation	Performance → Workspace → Interactions → click interaction → Audit Trail tab → Load All Audits
Alt Navigation	Menu → Analytics → Analytics Workspace → Interactions tab
Permission Required	Audits > Interaction Details > View
Roles	Quality Administrator, Quality Evaluator
Objects tracked	Evaluations, Annotations, Recordings, Calibrations, Screen Recordings, Surveys

---

Compliance Use Cases

Regulation	How Audit Viewer Helps
GDPR	Track who accessed or changed user/contact data configurations
HIPAA	Verify access controls and configuration change history
PCI-DSS	Audit routing, recording, and security configuration changes
Internal Change Management	Identify who changed a queue, flow, role, or schedule and when

---

Best Practices

Practice	Reason
Review audit logs regularly	Required by many compliance frameworks
Use Filter by Service to scope searches	Reduces noise when investigating a specific area
Use Filter by Entity for targeted investigations	Quickly find all changes to a specific object by its ID
Export or stream to external tooling via EventBridge	Retain events beyond the 14-day UI window
Grant Audits > Audit > View only to appropriate roles	Audit logs contain sensitive config change history

---

Key Takeaways

Topic	Summary
Navigation	Admin → Troubleshooting → Audit Viewer or Menu → IT and Integrations → Audit Viewer
Permission	Audits > Audit > View
Viewer modes	Full-page (detailed) and mini footer (lightweight)
Date limit	Last 14 days in UI; older data via Audit API
Event details	Who, what, before/after values, RemoteIP, related events
Filtering	By date range, service, entity ID, or user
Real-time only	UI shows real-time query results; async data via API or EventBridge
Interaction Audit Trail	Separate feature on individual interactions — different permission and navigation