# Audit logs, security detections and anomaly responses

*Slack Administrator Study Guide · Governance, Security and Compliance · Last updated October 21, 2026 · https://www.certifyforce.com/study-guide/slack-administrator/governance-security-and-compliance/audit-logs-security-detections-and-anomaly-responses*

How an Enterprise org investigates and reacts to a security concern: audit log filters and raw entries, the Security Detections tab, the Audit Logs API for a SIEM and long-term storage, search query exports, automatic anomaly event responses, and the roles that grant each.

- Certification: Salesforce Slack Administrator
- Exam section: Governance, Security and Compliance
- Study guide: https://www.certifyforce.com/study-guide/slack-administrator

**Official exam objective:**

> Given a scenario, determine how to track a security concern in the Enterprise Grid environment.

## What the exam expects

- Filter the audit logs to one person and a time window, and read a raw entry for IP address, user agent and timestamp.
- Use the Security Detections tab to find activity Slack flagged as suspicious.
- Choose the Audit Logs API for a SIEM or custom monitoring, and exports for keeping audit data longer than Slack does.
- Configure anomaly event responses that end sessions automatically, including exclusions, notifications and their limits.
- Grant the narrowest role: Audit Logs Admin to read logs, Security Admin for sessions, a custom role for search query exports.

Key terms:
- **Audit logs:** the Enterprise record of changes and usage, viewed in Organization settings > Security > Audit logs. They record events, not message content.
- **Anomaly event:** an audit event that indicates potentially unusual or suspicious user or app activity, such as excessive downloads.
- **Anomaly event response:** a setting that makes Slack end a user's sessions on all devices when a chosen anomaly event is detected.
- **Audit Logs API:** the API Enterprise orgs use to monitor audit events programmatically.
- **Enterprise org:** an Enterprise organization (Enterprise Grid or Enterprise+ plan); audit logs exist only there.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Who views audit logs | Org Owners and Audit Logs Admins, Enterprise plans | [Audit logs in Slack](https://slack.com/help/articles/360000394286-Audit-logs-in-Slack) |
| Audit log filters | Date range, Acting user, Affects, Events | [Audit logs in Slack](https://slack.com/help/articles/360000394286-Audit-logs-in-Slack) |
| Export formats | CSV or JSON | [Audit logs in Slack](https://slack.com/help/articles/360000394286-Audit-logs-in-Slack) |
| Audit log retention | Maximum two years since April 30, 2026; export for longer | [Audit logs in Slack](https://slack.com/help/articles/360000394286-Audit-logs-in-Slack) |
| IP address and user agent | Context section of View Full Log Details | [Monitor Slack Audit Logs](https://trailhead.salesforce.com/content/learn/modules/slack-audit-log-ui-quick-look/monitor-slack-audit-logs) |
| Security Detections entries | Action, IP address and geolocation | [Monitor Slack Audit Logs](https://trailhead.salesforce.com/content/learn/modules/slack-audit-log-ui-quick-look/monitor-slack-audit-logs) |
| SIEM feed | Audit Logs API | [Audit logs in Slack](https://slack.com/help/articles/360000394286-Audit-logs-in-Slack) |
| Search query export | Custom role with two permissions; last 90 days only | [Audit logs in Slack](https://slack.com/help/articles/360000394286-Audit-logs-in-Slack) |
| Responses on by default | Tor exit node access, data scraping | [Anomaly event responses](https://slack.com/help/articles/37193054707603-Configure-audit-log-anomaly-event-responses-in-Slack) |
| Who configures responses | Org Owners, Org Admins, Security Admins | [Anomaly event responses](https://slack.com/help/articles/37193054707603-Configure-audit-log-anomaly-event-responses-in-Slack) |

## Check yourself

- Why can't the audit logs show what a member wrote in a channel?
- When is exporting audit logs the right answer instead of viewing them in Slack?
- Which two permissions must a custom role include to export search queries?
- What happens to a user whose sessions an anomaly response ends?

## Sources

- [Audit logs in Slack](https://slack.com/help/articles/360000394286-Audit-logs-in-Slack)
- [Configure audit log anomaly event responses in Slack](https://slack.com/help/articles/37193054707603-Configure-audit-log-anomaly-event-responses-in-Slack)
- [Monitor Slack Audit Logs](https://trailhead.salesforce.com/content/learn/modules/slack-audit-log-ui-quick-look/monitor-slack-audit-logs)
- [Types of roles in Slack](https://slack.com/help/articles/360018112273-Types-of-roles-in-Slack)
- [Security tips to protect your workspace](https://slack.com/help/articles/115004155306-Security-tips-to-protect-your-workspace)
- [A guide to Slack's Discovery APIs](https://slack.com/help/articles/360002079527-A-guide-to-Slacks-Discovery-APIs)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 10 linked practice questions, and unlimited timed mock exams are included with the Slack Administrator pack (USD $19): https://www.certifyforce.com/practice-exams