Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

<https://osquery.slack.com/archives/C08V7KTJB/p1650389628874209>

I am also interested in this.  I'm guessing there may only be these types of user audit logs in Fleet 4 or greater when the Teams enhancement was introduced

Hey <@U03CEUSSA9X>, when you thought about Fleet “audit logs,” did examples of this in other products come to mind? If so, which products?

Currently, Fleet reveals usage as a paginated list of activities in the `GET /activities` API route.

Docs for this API route can be found here: <https://fleetdm.com/docs/using-fleet/rest-api#list-activities>

Thanks Noah, exactly what I was looking for!

Also in regards to your question some other products with audit logging are AWS, Splunk, databases, linux, windows, etc. I think EDR solutions like HX and Crowdstrike also have logging

Great, thanks.

Please feel free to follow up in this thread, or open a new one, if you find yourself thinking usage/activity in Fleet could be more helpful.