Audit Logs

Audit logs help you track and analyze your team members' activity. They can be accessed by team members with the owner role, and are available to customers on enterprise plans.

To export and download audit logs:

• Go to Team Settings > Security > Audit Log
• Select a timeframe to export a Comma Separated Value (CSV) file containing all events occurred during that time period
• Click the Export CSV button to download the file

The team owner requesting an export will then receive an email with a link containing the report. This link is used to access the report and is valid for 24 hours.

Note that reports can be generated for the last 90 days (three months) and will not impact your billing.

In addition to the standard audit log functionalities, Vercel supports custom log streaming to your Security Information and Event Management (SIEM) system of choice. This allows you to integrate Vercel audit logs with your existing observability and security infrastructure.

We support the following SIEM options out of the box:

• AWS S3
• Splunk
• Datadog
• Google Cloud Storage

We also support streaming logs to any HTTP endpoint, secured with a custom header.

If your SIEM requires IP allowlisting, please use the following IP addresses:

23.21.184.92
34.204.154.149
44.213.245.178
44.215.236.82
50.16.203.9
52.1.251.34
52.21.49.187
174.129.36.47

To set up custom log streaming to your SIEM, please contact your Customer Success Manager (CSM). They will guide you through the configuration process to ensure a smooth and secure integration.

The CSV file can be opened using any spreadsheet-compatible software, and includes the following fields:

Vercel logs the following list of actions performed by team members.

Maps a custom domain or subdomain to a specific deployment or URL of a project. To learn more, see the vercel alias docs.

Refers to the audit logs of your Vercel team account.

A digital certificate to manage SSL/TLS certificates for your custom domains through the vercel certs command. It is used to authenticate the identity of a server and establish a secure connection.

Create URLs that accept HTTP POST requests to trigger deployments and rerun the build step. To learn more, see the Deploy Hooks docs.

Refers to a successful build of your application. To learn more, see the deployment docs.

A unique name that identifies your website. To learn more, see the domains docs.

A key-value data store associated with your Vercel account that enables you to read data at the edge without querying an external database. To learn more, see the Edge Config docs.

Helps you pair Vercel's functionality with a third-party service to streamline installation, reduce configuration, and increase productivity. To learn more, see the integrations docs.

Password Protection allows visitors to access preview deployments with a password to manage team-wide access.

Customize the appearance of your preview deployment URLs by adding a valid suffix. To learn more, see the preview deployment suffix docs.

Refers to actions performed on your Vercel projects.

Refers to the password protection settings for a project.

Refers to the Single Sign-On (SSO) protection settings for a project.

Refers to the transfer of a project between Vercel accounts.

Refers to the generation of web analytics for a Vercel project.

Refers to environment variables defined at the team level. To learn more, see the shared environment variables docs.

Refers to actions performed by members of a Vercel team.

Refers to actions performed by any team member.