User Guide

How to enable Change tracking (admin)

This guide shows you how to turn Change tracking on for a Site, choose what gets tracked, and set how long the change history is kept.

Change tracking is off by default on every Site. Until an administrator enables it explicitly, no Change Events are recorded — even on devices that are being audited regularly.

Prerequisites

  • You are signed in as a Site Administrator.
  • You have decided which retention period meets your operational and compliance needs (6 months / 1 year / 2 years / 3 years / 5 years).
  • You have decided which categories of change to track (you can change this later).

Steps

  1. Navigate to Admin Center > Site Settings > Settings > Change tracking.
  2. Toggle Enabled on.
  3. Choose a Retention period from the combobox: 6 months, 1 year, 2 years, 3 years, or 5 years. Older records are auto-purged at retention expiry; you can also purge manually via How to purge change history.
  4. Pick which Tracking categories to record. Seven categories are available — General, System, Security, User accounts, AWS assets, Azure assets, Custom audit fields. Each category has sub-attribute checkboxes for fine-grained selection.
  5. Click Save.

Verify

After Change tracking has been on for at least one full audit cycle on the affected devices:

  1. Open any audited device (Inventory > Devices > (device)).
  2. Switch to the Change history tab. Recent changes detected by audits since the toggle was turned on appear here.
  3. The site-wide Change log also starts populating with config-level changes (Sites, Users, Segments, Reports, Tags, and so on).

Important: Change tracking only records events from the moment the toggle is on. Changes that happened on devices before the toggle was enabled are not retroactively created.

Behaviour when you turn the toggle off later

Turning Enabled off later stops the system from ingesting new Change Events. Existing change history is retained until retention expires for each record, or until you manually purge. To delete change history immediately, see How to purge change history.

Software-change tracking scope

Software-related change events can be scoped to selected software groups (Required / Forbidden / Regular) rather than to every software product the audit detects. This narrows the volume of change events generated for software installs and removals. The exact placement of the scoping control may vary by deployment.