Every admin action, with analytics and anomaly detection.
| Time | Actor | Action | Details | IP | Type |
|---|---|---|---|---|---|
| Sep 22, 10:39 | Alex Garcia | Assigned role | Role: Super Admin → Alex Garcia | 172.16.0.4 | Security |
| Sep 22, 09:12 | Dr. Smith | Created course | Advanced Pen Testing | 10.0.0.81 | Create |
| Sep 22, 08:47 | Sarah Mitchell | Updated profile | Email changed | 10.0.0.42 | Update |
| Sep 21, 17:20 | Admin Team | Deleted user | [email protected] | 10.0.0.81 | Delete |
| Sep 21, 16:05 | Prof. Morgan | Signed in | MFA verified | 185.220.101.9 | Login |
| Sep 21, 14:30 | Alex Garcia | Failed login | Wrong password ×3 | 172.16.0.4 | Security |
Detection sensitivity
Brute force ≥ 5 failures · bulk delete ≥ 4 · travel window 30 min · spike ≥ 2.5σAlex Garcia assigned the Super Admin role to their own account at Sep 22, 10:39 AM.
Alex Garcia · 172.16.0.4 (Kigali (office)) · 4 hours ago · 1 related eventRecommended: Self-granting elevated access should require a second approver. Revoke and investigate.
Prof. Morgan signed in from Kigali (office), Rwanda and 19 minutes later from Frankfurt (Tor exit node), Germany (185.220.101.9).
Prof. Morgan · 185.220.101.9 (Frankfurt (Tor exit node)) · 20 hours ago · 4 related eventsRecommended: Treat the second session as suspicious: revoke it and require re-authentication with MFA.
Sarah Mitchell signed in from Kigali (office), Rwanda and 18 minutes later from Unknown, Unknown (203.0.113.77).
Sarah Mitchell · 203.0.113.77 (Unknown) · Yesterday · 3 related eventsRecommended: Treat the second session as suspicious: revoke it and require re-authentication with MFA.
