How do I see what's been happening in my workspace?

Steps

1. Click Activity in the sidebar. The subtitle promises recent actions across your scope: scans, triage, profile and target changes.
2. Scroll down.
3. Read each entry from left to right. The left side names the actor, which is a user email, a support person, or a system chip for automatic actions such as a profile created behind the scenes.
4. Look at the title. It reads Action · Entity, such as Start · Scan or Triage · Issue.
5. Check the detail chips under the title. They are key and value pairs, like Target and Profile for a scan start.
6. Glance at the footer, which holds the time and a short eight-character id for the item.
7. Type in the search box when the list is long. See how to search the activity feed.

Good to know

What you see covers your scope, not the whole company, and that is by design. Visibility depends on role, and the permission list includes activity:read, activity:read_team and activity:read_all, so two people can see different feeds. Read how visibility tiers work.

• Entries can name user emails, so treat the page as sensitive.
• Find who stopped a run with this guide.
• The full list of action types sits in which actions appear in the feed.

The activity feed tutorial goes deeper. Think of it as an audit log for day-to-day review.

Related questions

• How do I search the activity feed for a person or action?
• How do I find out who cancelled or deleted a scan?
• Which actions show up in the activity feed?
• Who can see which entries in the activity feed?
• Why can't I see other people's actions in the activity feed?

Full tutorial

Cyberlop activity feed: what it records and how to use it for audits

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre