---
title: The Audit trail
canonical: "https://cloudmonitor.ai/docs/using-cloudmonitor/reports/audit-trail/"
description: "Who changed what across your cost groups (budgets, membership, triage decisions and comments) with filters to find one thing."
---

The **Audit trail** is the record of who changed what. Every budget edit, every person added to or
removed from a cost group, every anomaly or recommendation someone snoozed, dismissed or reopened,
and every comment left explaining one of those decisions.

It answers the questions that arrive weeks later: why did this budget move, who took that person off
the team, and what did we say when we decided to ignore that spike.

## What you can see

You see activity for the cost groups you can see, and nothing else. That is the same boundary as
everywhere else in CloudMonitor: if you are not a member of a cost group and you are not an admin,
its history is not yours to read. The summaries carry budget figures, colleagues' email addresses and
the reasons people gave for closing things, so this is deliberate.

That also means two people can open this screen and see two different trails. Neither is wrong.

## Finding one thing

The controls sit above the list.

**Search** matches the person's name, their email address, the description, the comment text and the
cost group name. Typing part of a cost group name is usually the fastest way to get to one team's
history.

**Anyone** narrows to a single person, listed by name. The list offers only people who appear in
activity you can read.

**All activity** narrows to one kind of change: budgets, members, anomalies, recommendations or
comments. It offers only the kinds that actually appear in your activity, so a choice here always
leads somewhere.

When something is narrowed, a **Clear filters** button appears and puts everything back in one click.

The [top filter bar](/docs/using-cloudmonitor/global-filters/) applies too. **Period** limits the
list to the days the change was recorded, and **Cost group** limits it to the groups you pick.
Provider, virtual tags and cost basis do nothing here and are hidden, because an audit entry records
an action rather than a charge.

If the filters empty the screen you get **No entries match these filters** rather than
**No activity yet**: the difference tells you whether to widen the search or stop looking.

## Reading an entry

Each entry names the person, says what they did, and shows the cost group and how long ago it was.
Hover a name for that person's email address, and the timestamp for the exact date and time on your
own clock.

If someone left a comment, a dismissal reason or a note with a reassignment, that text appears under
the description. That's usually the part worth reading.

## Opening the full history

Selecting an entry opens that cost group's own **Audit trail** tab, which shows everything recorded
for that group in one place. That tab is also where comments and replies are written: you can add a
comment to any cost group you can see, whether or not you own it. See
[Inside a cost group](/docs/using-cloudmonitor/reports/inside-a-cost-group/).

## What it does not do

**Nothing here can be changed or removed.** Entries are permanent, including your own comments. That
is what makes the record worth trusting, and it is why archiving someone who leaves is better than
deleting them: deleting would leave holes in this list.

**It does not cover workspace-level settings.** Changes to your organization's currency, branding,
users or connected data sources are not recorded here yet.

**It does not export.** There is no download from this screen today.