The activity feed records logins, scans started, cancelled or deleted, targets and profiles created or deleted, issue triage and user invites. It also logs role creation, support sessions, and AI provider or Git token changes. Rows name the actor, the action and the entity.
The short version
The feed is an audit-style list of who did what. A row reads "Action · Entity". Chips under the title add detail, and the foot of the row shows the time and a short ID.
How it works in Cyberlop
These are the pairs seen in the feed.
| Action · Entity | Detail chips |
|---|---|
| Login · User | Method |
| Start · Scan | Commit (white-box), Target, Profile, Trigger |
| Cancel · Scan; Delete · Scan | Target, Trigger on delete |
| Create · Target; Delete · Target | Name, MainUrl, RepoUrl |
| Create · Scan Profile | Name |
| Triage · Issue | Status change, Finding, Assignee, Severity |
| Invite · User; Create · User; Update · User | Emailed, Roles, AuthSource |
| Create · Role | Role name and its permissions |
| Session Start / Session End · Support Session | Until, Reason, EndedFrom |
| Ai Provider · Organization; Git Token · Organization | Action: set |
Secrets never appear. The AI and Git rows record only that someone set a credential, and they never show the value, so the feed is safe to share with an auditor. We did not see chat webhook or single sign-on changes in the feed. Check your own workspace before you rely on it for an audit.
What to do next
Use the search box, which reads "Search by actor, action, or entity...", to narrow the list. Type an action such as Cancel to find who stopped a scan. What you see also depends on your tier. Read who can see which entries for that.
For the page tour, see how to view the activity feed. For background on why this record matters, read about an audit log.
Related questions
- How do I see what's been happening in my workspace?
- How do I search the activity feed for a person or action?
- How do I find out who cancelled or deleted a scan?
- What does the "system" chip mean in the activity feed?
- What is a Support Session entry in the activity feed?
Cyberlop activity feed: what it records and how to use it for audits
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.