Change Tracking Reference (admin)
Reference for the per-Site Change tracking configuration: toggle, retention, categories, sub-attributes, and the surfaces where change events appear.
Menu path
Admin Center > Site Settings > Settings > Change tracking.
Configuration fields
| Field | Type | Default | Description |
|---|---|---|---|
| Enabled | Toggle | OFF | Master switch. While off, no Change Events are ingested; existing change history is retained until retention expiry or manual purge. |
| Retention period | Combobox | (deployment-specific) | One of 6 months, 1 year, 2 years, 3 years, 5 years. Records older than this are auto-purged on a rolling basis. |
| Tracking categories | Multi-select with sub-attribute checkboxes | - | Seven categories - see below. Each category has sub-attribute checkboxes for fine-grained selection. |
| Purge change history | Button | - | Manually clears all stored change history. Destructive. See How to purge change history. |
Tracking categories
Seven categories are exposed in the UI:
| Category | Typical sub-attributes | Notes |
|---|---|---|
| General | Name, location, owner, department | Device-record metadata. |
| System | OS version, BIOS, hardware components | Audit-driven. |
| Security | User accounts, group membership, security settings | Subset of audit data. |
| User accounts | Local users, password age, last logon | OS-specific. |
| AWS assets | EC2 instance state, IAM, tags | Cloud audits required. |
| Azure assets | VM state, subscription, RBAC | Cloud audits required. |
| Custom audit fields | Per-field deltas | Driven by Custom Audit Fields Reference - once a field is defined, its values are tracked here too. |
Note: Earlier public documentation cited five categories. The UI exposes seven. Treat seven as authoritative for current builds.
Software-change scope (RFC C023901)
Software-related change events can be scoped to selected software groups (Required / Forbidden / Regular) so that change tracking does not record every install and removal of every software product detected by audits. The placement and exact UX of the group-selection control may vary by deployment.
Where change events surface
| Surface | Scope | Source |
|---|---|---|
| Per-device Change history tab | One device | Audit-driven changes for that device. |
| Site-wide Change log | One Site | Both audit-driven device changes and config-level changes (Sites, Users, Segments, Reports, Tags, Notification templates) with Added / Modified / Deleted verbs. |
State machine
| Toggle state | New events ingested | Existing history |
|---|---|---|
| Enabled = ON | yes | retained until retention expiry or manual purge |
| Enabled = OFF | no | retained until retention expiry or manual purge |
Turning Enabled off does not delete existing records; it only stops new ones from being created.
Constraints
- Change tracking is per-Site. There is no cross-Site change-history view.
- Pre-existing changes (those that occurred before Enabled was switched on) are not retroactively created.
- The exact set of sub-attribute checkboxes per category, and the mechanism for software-group scoping, may vary by deployment.
RBAC
| Action | Site Administrator | Site User |
|---|---|---|
| Toggle Enabled | yes | no |
| Set Retention period | yes | no |
| Pick categories and sub-attributes | yes | no |
| Click Purge change history | yes | no |
| View per-device Change history | yes | yes |
| View site-wide Change log | yes | may vary by deployment |