# Workspace activity log and security alerts

See what members did in a workspace, export the activity as CSV, and get alerted about risky events such as mass deletion or suspected ransomware.

Updated: 2026-10-19  
Source: https://drime.cloud/support/workspaces/activity-and-alerts

The admin console keeps a log of what happens in the workspace and can warn you about risky events.

![Admin console of the demo workspace Lumen Studio, Activity: the members’ recent actions with their dates](https://drime.cloud/media/01M5AJGDSJRBFS7MTTEYWTF5DC/418cc71b2005-web-workspace-activity.png)

## Activity

**Activity** lists what members did in the workspace: actions on files, sharing, members, settings and security. Click **Create report** to export it as a CSV file, up to 50,000 rows.

The workspace owner and members whose role allows inviting members can see it. Activity in personal spaces is not part of it.

## Alert policies

**Alert policies** emails and notifies you when something risky happens:

| Policy | On by default |
| --- | --- |
| Suspected ransomware | Yes |
| Mass deletion | Yes (250 items at the default sensitivity) |
| Mass move | Yes (250 items at the default sensitivity) |
| **Sign-in from a high-risk country** | Yes |
| Multiple failed logins | Yes (10 within 15 minutes) |
| Malware shared by a team member | Yes |
| Personal data shared outside the team | No |
| Malware shared from outside the team | No |

Each policy has an **Alert sensitivity** from 1 to 5 and its own **Recipients**. The same alert is not sent again within 15 minutes.