Activity log

Activity records what people and NoCert did in your organization: who added a domain, who changed a rule, when a certificate was first seen, what was sent and to whom.

Operators and owners can read it. Viewers cannot.

What is in it

Actions taken by people: domains added, verified and removed, Sentinels enrolled and deleted, rules and targets created and changed, members added and their roles changed, policies and billing changed.

Things NoCert did on your behalf: certificates discovered and first seen on an endpoint, alerts sent. An alert entry names the certificates in the digest, the channel it went to, and any recipient that failed. Scans and enumerations are deliberately absent, since they run constantly and would bury everything else; the dashboard’s live feed is where you watch those.

Narrow the log with the All events and Changes toggle, the category filter (Configuration, Sentinel, Member, Notification, Discovery, Billing) or the search box. Changes drops the discovery category entirely, which is the quickest way to see only what people did. The discovery category is what the dashboard links into.

Note

Alert entries contain recipient email addresses. If that matters for your own data handling, this is the place it lives.

Times are UTC

Rows show relative ages. Hover one for the exact instant, given in UTC with your local time beside it.

Retention

The default retention is 365 days (12 months) on every published plan. If your organization has an agreed retention policy, Activity shows the duration that applies.

When an effective plan change reduces your retention, the previous duration remains in effect for a 30-day grace period. Activity shows the new duration and the date it starts. A scheduled downgrade does not start the grace period until the plan actually changes; a failed renewal payment alone does not shorten retention.

An upgrade can extend the lifetime of events still retained. It does not restore expired events, even if physical cleanup is still in progress. Returning to a duration at least as long as the current one cancels a pending reduction; a partial upgrade changes the pending duration without restarting the grace period. A further reduction to a shorter duration starts a fresh 30-day grace period for that change.

Paging stops after 10,000 rows, which a year of history on a busy organization reaches. Narrow with a date range to read further back.

Export retained activity

Select Export all retained activity to download a ZIP archive. It includes all retained events, including discovery, independently of your current search, category or date filters. The export can include more than 10,000 events. Operators and owners can export; the same plan restrictions on Compliance details apply as in Activity.

The archive contains audit.ndjson (one event per line) and manifest.json with the event count, snapshot time and retention policy. A complete archive has a manifest whose status is complete. A missing manifest or an unreadable ZIP means the download did not complete; try again. Exports are rate-limited. If another export is running or capacity is reached, wait before trying again.

Export before a retention reduction takes effect if you need to keep the older history outside NoCert. You are responsible for protecting and retaining your downloaded copy. The export attempt is recorded in Activity.

Do not confuse this with the live scan feed on the dashboard. That one shows what is running right now and keeps nothing.