Workspace activity log and security alerts

See what members did in a workspace, export the activity as CSV, and get alerted about risky events such as mass deletion or suspected ransomware.

Updated October 19, 2026Web

The admin console keeps a log of what happens in the workspace and can warn you about risky events.

#Activity

Activity lists what members did in the workspace: actions on files, sharing, members, settings and security. Click Create report to export it as a CSV file, up to 50,000 rows.

The workspace owner and members whose role allows inviting members can see it. Activity in personal spaces is not part of it.

#Alert policies

Alert policies emails and notifies you when something risky happens:

Policy	On by default
Suspected ransomware	Yes
Mass deletion	Yes (250 items at the default sensitivity)
Mass move	Yes (250 items at the default sensitivity)
Sign-in from a high-risk country	Yes
Multiple failed logins	Yes (10 within 15 minutes)
Malware shared by a team member	Yes
Personal data shared outside the team	No
Malware shared from outside the team	No

Each policy has an Alert sensitivity from 1 to 5 and its own Recipients. The same alert is not sent again within 15 minutes.

Was this helpful?

Contact support

#Activity

#Alert policies

Related articles