Skip to main content

Audit & Escalations

Role Required: REGIONAL_ADMIN
Navigation: Sidebar → Audit Logs
Last Updated: March 2026 | Portal Version: 1.0

Overview​

As Regional Admin, you have cross-society audit access (AuditCrossSociety policy). You can view audit logs across all societies system-wide, track your own activity, and export data for investigations.

Audit Access​

Your audit access allows:

FeatureAvailable
Query audit logs across all societies (system-wide)✅
Filter by entity type, action, user, severity, date✅
Filter by specific society✅
View your own activity history✅
Export audit logs as CSV✅
View summary statistics✅
View individual entity audit history✅
Modify audit settings❌
View retention configuration❌

Querying Audit Logs​

  1. Navigate to Audit Logs
  2. Use filters:
FilterDescription
SearchFull-text search
Entity TypeLayout, Plot, Booking, Payment, etc.
ActionCREATE, UPDATE, DELETE, STATUS_CHANGE
SocietyFilter to a specific society
UserFilter to a specific user
SeverityINFO / WARNING / CRITICAL
Date RangeStart and end date
  1. Results show paginated audit entries with full details

My Activity​

View all actions you've performed:

  1. Navigate to Audit Logs → My Activity
  2. See your complete audit trail

Exporting Data​

  1. Apply your desired filters
  2. Click Export CSV
  3. Up to 10,000 entries exported
  4. CSV includes: Timestamp, EntityType, EntityId, Action, Severity, User, SocietyId, IP, Source, Summary

Escalation Procedures​

When you identify an issue through monitoring or audit review:

Level 1: Society Admin Contact​

For operational issues:

  1. Contact the Society Admin directly
  2. Share the specific concern (e.g., high refund rate, declining collections)
  3. Request an explanation or action plan
  4. Follow up within 48 hours

Level 2: Super Admin Escalation​

For issues requiring higher authority:

  1. Contact the Super Admin
  2. Provide:
    • Society name and ID
    • Issue description
    • Evidence from dashboard/reports/audit logs
    • Actions already taken at Level 1
  3. The Super Admin can take direct action (block users, suspend societies, etc.)

When to Escalate​

SituationEscalation Level
Society performance decliningLevel 1
Society Admin unresponsiveLevel 2
Financial irregularities detectedLevel 2
Suspicious audit trail activityLevel 2
Alert not acknowledged for 72+ hoursLevel 2
Potential security breachLevel 2 (immediate)

Investigating an Incident​

Step-by-step investigation workflow:

  1. Define the scope: What happened, when, which society?
  2. Check audit logs: Filter to the relevant entity, time, and society
  3. Review the changes: Look at Old Values vs New Values
  4. Identify the actor: Who made the change (UserName, UserRole)
  5. Check for patterns: Use Correlation ID for bulk operations
  6. Gather evidence: Export filtered audit logs
  7. Report: Contact the appropriate escalation level with findings

Common Scenarios​

"A society's financial data doesn't match expected values"​

  1. Check audit logs for Entity Type = Payment and the society
  2. Look for any UPDATE or DELETE actions on payment records
  3. Check if offline payments were voided after verification
  4. Export the relevant logs and escalate if needed

"A Society Admin reports they didn't make a change that appears in the system"​

  1. Filter audit logs by the society and the entity in question
  2. Check the User ID, IP Address, and User Agent for each action
  3. If the action was made from an unexpected IP, this may indicate a security issue
  4. Escalate to Super Admin immediately