{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["platform-badges","admonition","img"]},"type":"markdown"},"seo":{"title":"Network Audit Log in Treasure AI Studio","description":"Review the outbound connections Treasure AI Studio agents made by domain, user, chat, and allow or block outcome, and trace each back to its chat.","siteUrl":"https://docs.treasure.ai","lang":"en-US","jsonLd":{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://www.treasure.ai/","name":"Treasure AI","url":"https://www.treasure.ai/","logo":"https://www.treasure.ai/hubfs/assets/images/logos/primary-logo.svg"},{"@type":"WebSite","@id":"https://docs.treasure.ai/#website","name":"Treasure AI Documentation","url":"https://docs.treasure.ai/","inLanguage":["en","ja"],"publisher":{"@id":"https://www.treasure.ai/"}}]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"network-audit-log","__idx":0},"children":["Network Audit Log"]},{"$$mdtype":"Tag","name":"PlatformBadges","attributes":{"platforms":["Web","Desktop"]},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The Network Audit Log is the administrator's record of every outbound connection made on behalf of Treasure AI Studio agents, and what the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/ai-studio/security/network-policy"},"children":["network policy"]}," did with each one. (A connector whose requests are made outside the sandbox is recorded here too, but the policy is not applied to it — see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/ai-studio/security/network-policy#connectors-that-the-policy-does-not-govern"},"children":["Connectors That the Policy Does Not Govern"]},". Those records carry an ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["allow"]}," action because nothing blocked them, not because a rule matched.) It answers the questions that follow an agent doing something unexpected: which host did it contact, which user's chat caused it, and was the request allowed or blocked. Use it to verify a policy change took effect, to investigate a report of unexpected agent behavior, or to satisfy a periodic review that agent traffic stayed inside approved destinations."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"objective","__idx":1},"children":["Objective"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Search the outbound network activity of Treasure AI Studio agents across your organization, and trace any connection back to the user and chat that produced it."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"prerequisites","__idx":2},"children":["Prerequisites"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Signed in to Treasure AI Studio (",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/ai-studio/getting-started"},"children":["Getting Started"]},")"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["account administrator"]}," role — regular users do not see the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Organization"]}," section in Settings"]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"open-the-network-audit-log","__idx":3},"children":["Open the Network Audit Log"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Open ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings"]}," — click your user avatar in the sidebar footer."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["In the left navigation, under ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Organization"]},", click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Network Audit Log"]},"."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The page opens on the last 24 hours of activity, newest first."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Administrators only"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The Network Audit Log is visible only to account administrators. Regular users see no ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Organization"]}," section in Settings, and the underlying search API rejects non-administrator requests."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"what-the-log-records","__idx":4},"children":["What the Log Records"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The Network Audit Log records the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["destination host"]}," of each connection, not the content of the request. Each record carries the fields below."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"width":"18%","data-label":"Column"},"children":["Column "]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Contents"},"children":["Contents"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Timestamp"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["When the connection was evaluated, shown in your local timezone."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Chat"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The chat whose agent made the request, as a shortened chat ID. Click it to filter the log to that chat."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["User"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The email of the user whose session made the request. Click it to filter the log to that user. A shortened user ID appears instead when the email is unavailable — for example, for a deleted user."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Action"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["What the network policy decided: ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["allow"]}," (green), ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["block"]}," (red), or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rewrite"]}," (neutral)."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Domain"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The destination hostname, taken from the connection's SNI, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CONNECT"]}," target, or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Host"]}," header."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["IP"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The resolved destination IP address."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Port"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The destination port."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Protocol"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The transport protocol of the connection."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Action"]}," column records the decision the policy made, not whether the request then succeeded. A permitted request that failed afterwards — a DNS failure, a TLS error, a refused connection, an error returned by the remote service — still appears as ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["allow"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rewrite"]},". Read the log to see what an agent was permitted to reach, not to confirm it got a response."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Domains, not URLs"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The log captures the hostname of each connection. Request paths, query parameters, request bodies, and response bodies are ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["not"]}," recorded, so the log shows that an agent contacted a host but never what it sent or received. Chat content lives with the chat and is governed by ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/ai-studio/security/data-retention"},"children":["Chat Data Retention"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"what-the-rewrite-action-means","__idx":5},"children":["What the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rewrite"]}," Action Means"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rewrite"]}," action means the request was allowed ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["and"]}," matched a connector, so Treasure AI Studio substituted the real access token for the placeholder the agent's sandbox holds. Seeing ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rewrite"]}," against a connector's host is the normal, healthy state for ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/ai-studio/connections"},"children":["Connections"]}," — it is the credential injection working as designed, not a warning. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/ai-studio/security#credentials-never-enter-the-sandbox"},"children":["Security Overview"]}," for how the substitution works."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"filter-the-log","__idx":6},"children":["Filter the Log"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Set any combination of the fields below and click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Apply"]},". Filters are held in the page URL, so a filtered view can be bookmarked or shared with another administrator, and browser back and forward move between searches."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"width":"20%","data-label":"Filter"},"children":["Filter "]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Accepts"},"children":["Accepts"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Time range"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["1h"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["6h"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["24h"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["3d"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["7d"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["14d"]},", or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["30d"]},". Defaults to the last 24 hours."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Ending"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A date and time marking the newest end of the window. Leave it empty to search back from now. Combined with ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Time range"]},", this is how you inspect a window in the past."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Action"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Any"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["allow"]},", or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["block"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Domain"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Any part of the destination hostname. The value is matched as a substring, so ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["github"]}," returns ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["github.com"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["api.github.com"]},", and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["raw.githubusercontent.com"]}," alike. Letters, digits, dots, and hyphens only — you do not type wildcards yourself, because the search wraps whatever you enter in them."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["IP"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A destination IP address."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Port"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A port number from 1 to 65535."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["User ID"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The UUID of a user. Clicking a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["User"]}," cell fills this in for you."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Chat ID"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The UUID of a chat. Clicking a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Chat"]}," cell fills this in for you."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When nothing matches, the page reads \"No audit records in the selected range.\""]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/ai-studio-settings-network-audit-log.3df9a14b4ce941cef007fd7a7a6e08b451935cfb9a540bb9b5d35a52170e692f.8a9297e8.webp","alt":"The Network Audit Log page under Settings > Organization with a Domain filter of github applied, returning allowed connections to github.com across the Timestamp, Chat, User, Action, Domain, IP, Port, and Protocol columns","framed":false,"withLightbox":true},"children":[]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"`rewrite` records cannot be filtered by action"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Action"]}," filter accepts only ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["allow"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["block"]},". Records with the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rewrite"]}," action still appear in unfiltered results — filter by the connector's ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Domain"]}," instead to isolate them."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"known-limits","__idx":7},"children":["Known Limits"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The Network Audit Log has three limits that change how you should read a result set:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Up to 100 records per search, newest first."]}," A search returns the 100 most recent matching records and nothing beyond them, and results cannot be sorted oldest-first. Widening ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Time range"]}," does not get you past the cap — it only spreads the same 100 rows over a longer span. To reach older activity, set ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Ending"]}," to an earlier moment so the window itself moves back, and add a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Domain"]},", ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["User ID"]},", or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Chat ID"]}," filter so the records you care about fit under the cap."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Records are kept for roughly four weeks."]}," Audit records age out on a rolling schedule, so the widest range — ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["30d"]}," — can return less than a full 30 days of history. Export or record anything you need for a longer compliance window while it is still in range."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["There is no export button."]}," Copy the values you need from the table, or capture the filtered URL alongside your findings."]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"An empty result is not proof of no activity"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A search that returns nothing means no ",{"$$mdtype":"Tag","name":"em","attributes":{},"children":["retained"]}," record matched those filters. Records older than the retention window are gone, and a result set that hits the 100-record cap silently hides everything older inside the same window — the table shows no truncation notice, so a full 100 rows is the only signal that you are not seeing everything. Confirm the window and count the rows before concluding an agent never contacted a host."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"verification","__idx":8},"children":["Verification"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"input","attributes":{"checked":false,"type":"checkbox","readOnly":true},"children":[]}," The ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Network Audit Log"]}," page under ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings → Organization"]}," loads records for the last 24 hours"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"input","attributes":{"checked":false,"type":"checkbox","readOnly":true},"children":[]}," Filtering by a known ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Domain"]}," returns the expected ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["allow"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["block"]}," records"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"input","attributes":{"checked":false,"type":"checkbox","readOnly":true},"children":[]}," Clicking a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Chat"]}," or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["User"]}," cell narrows the log to that chat or user"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"input","attributes":{"checked":false,"type":"checkbox","readOnly":true},"children":[]}," A domain you blocked in the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/ai-studio/security/network-policy"},"children":["network policy"]}," appears with the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["block"]}," action after an agent attempts it"]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"troubleshooting","__idx":9},"children":["Troubleshooting"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"width":"40%","data-label":"Issue"},"children":["Issue "]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Solution"},"children":["Solution"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The audit log shows no entries"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Confirm the time range covers the activity, and that no filter is narrowing it away. Every filter except ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Domain"]}," is an exact match, so a mistyped ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Chat ID"]}," or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Port"]}," returns nothing. If the page itself is missing, audit access requires the account administrator role."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["You expect a connection but see no record for it"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Requests that never left the sandbox produce no record. Check that the agent actually reached the tool call, and that the activity falls inside the retention window."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A connector's host shows ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rewrite"]}," instead of ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["allow"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["That is expected. ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rewrite"]}," means the platform substituted the real credential for the sandbox's placeholder token on an allowed request."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["\"Failed to load audit records\""]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The search backend was unreachable. Retry the search; if it persists, contact Treasure AI support."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["You need more than 30 days of history"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The log's retention is fixed at roughly four weeks. Capture the records you need for longer retention while they are still in range."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"next-steps","__idx":10},"children":["Next Steps"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/ai-studio/security/network-policy"},"children":["Network Policy"]}," — Change what the log records as allowed or blocked"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/ai-studio/security"},"children":["Security Overview"]}," — Sandbox isolation, encryption, and data residency"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/ai-studio/security/data-retention"},"children":["Chat Data Retention"]}," — How long chat content itself is kept"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/ai-studio/credits/credit-usage"},"children":["Credit Usage"]}," — Per-user consumption, the other admin dashboard in Settings"]}]}]},"headings":[{"value":"Network Audit Log","id":"network-audit-log","depth":1},{"value":"Objective","id":"objective","depth":2},{"value":"Prerequisites","id":"prerequisites","depth":2},{"value":"Open the Network Audit Log","id":"open-the-network-audit-log","depth":2},{"value":"What the Log Records","id":"what-the-log-records","depth":2},{"value":"What the rewrite Action Means","id":"what-the-rewrite-action-means","depth":3},{"value":"Filter the Log","id":"filter-the-log","depth":2},{"value":"Known Limits","id":"known-limits","depth":2},{"value":"Verification","id":"verification","depth":2},{"value":"Troubleshooting","id":"troubleshooting","depth":2},{"value":"Next Steps","id":"next-steps","depth":2}],"frontmatter":{"seo":{"title":"Network Audit Log in Treasure AI Studio","description":"Review the outbound connections Treasure AI Studio agents made by domain, user, chat, and allow or block outcome, and trace each back to its chat."},"platforms":["Web","Desktop"]},"lastModified":"2026-09-02T05:20:32.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/ai-studio/security/network-audit-log","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}