⚠️ Select your experience
The steps depend on your interface version. Select a link to skip to the instructions for your version.
Customers who joined Drata on or after Feb 24, 2026 are automatically on the New Experience.
Instructions for the New Experience ⬇️
The Events page provides a centralized audit trail of activity across the Drata platform. It records system actions, user activity, and automated events to support audit evidence, troubleshooting, and security oversight.
Why the Events page matters
The Events page helps you:
Maintain an immutable audit trail of platform activity
Demonstrate control operation and monitoring over time
Investigate changes made by users or automated processes
Provide auditors with verifiable system evidence
Events captured here often serve as direct audit evidence for control effectiveness.
View events
To open the Events page:
Select Events.
Review the event table, which displays:
User (or system process, such as Autopilot)
Timestamp
Category
Connection
Account ID / alias
Result
Type
Description
Filter events
Use Filter to narrow results by event category or event type. Filtering helps you quickly locate activity such as:
Autopilot updates
Connection-related changes
User updates
Automated test executions
Review raw event evidence
Some events include raw system responses that can be reviewed as evidence. Select the event to view the raw evidence and its JSON response.
If the JSON response is too large to display, you can download it instead.
Download event evidence
You can download event evidence at any time for audit purposes:
PDF: Includes the raw JSON response plus contextual event details
TXT: Includes only the raw JSON response
These files can be shared directly with auditors as proof of control operation.
Key behaviors to understand
Events are read-only and cannot be edited or deleted
System-generated activity (such as Autopilot) appears as the event user
Events represent point-in-time historical evidence
The Events page supports both monitoring tests and audit requests
Instructions for the Classic Experience ⬇️
The 'Event Tracking' page provides you an audit trail of all events within the Drata platform.
BEFORE DIVING IN
Only account administrators or information security leads have access to this section within Drata.
HERE'S HOW
In the upper left corner of the 'Events' page, you can filter by the category or type of event.
To get more details on a specific event, find the event and click on the row or scroll all the way to the right and click on the arrow icon. A drawer will open with additional details of the event selected.
From there, you can expand the ‘Response’ section by selecting 'Show raw evidence' to review the raw evidence provided as a JSON response. Once expanded, you can click on the copy icon to copy the full JSON response to your clipboard. Please note that if the raw JSON evidence is too large to display, you can always download the raw JSON evidence as a PDF or txt file.
These automated test results serve as evidence of the operating effectiveness of your controls over time. When asked for the evidence by your auditor, you can download this evidence anytime as a PDF. While the txt file contains only the raw JSON response, the PDF contains both the raw JSON response as well as additional details from the drawer to be used as evidence.