💡 Still using the classic Drata experience? Refer to Event Tracking for the original UI.
The Events page provides a centralized audit trail of activity across the Drata platform. It records system actions, user activity, and automated events to support audit evidence, troubleshooting, and security oversight.
Why the Events page matters
The Events page helps you:
Maintain an immutable audit trail of platform activity
Demonstrate control operation and monitoring over time
Investigate changes made by users or automated processes
Provide auditors with verifiable system evidence
Events captured here often serve as direct audit evidence for control effectiveness.
View events
To open the Events page:
Select Events.
Review the event table, which displays:
User (or system process, such as Autopilot)
Timestamp
Category
Connection
Account ID / alias
Result
Type
Description
Filter events
Use Filter to narrow results by event category or event type. Filtering helps you quickly locate activity such as:
Autopilot updates
Connection-related changes
User updates
Automated test executions
Review raw event evidence
Some events include raw system responses that can be reviewed as evidence. Select the event to view the raw evidence and its JSON response.
If the JSON response is too large to display, you can download it instead.
Download event evidence
You can download event evidence at any time for audit purposes:
PDF: Includes the raw JSON response plus contextual event details
TXT: Includes only the raw JSON response
These files can be shared directly with auditors as proof of control operation.
Key behaviors to understand
Events are read-only and cannot be edited or deleted
System-generated activity (such as Autopilot) appears as the event user
Events represent point-in-time historical evidence
The Events page supports both monitoring tests and audit requests