> For the complete documentation index, see [llms.txt](https://docs.nexthink.com/platform/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nexthink.com/platform/security/exporting-audit-logs.md).
# Exporting audit logs
This document lists all audit trail codes necessary for writing audit-related queries and subsequently, exporting audit log results by third-party integrations.
## Querying audit logs in Infinity
{% hint style="warning" %}
The procedures and NQL queries in this section apply to Nexthink Infinity.
Refer to the [Audit Trail API (classic)](/platform/configuring_nexthink/bringing-data-into-your-nexthink-instance/integrating-nexthink-with-third-party-tools/api-and-integrations-classic/audit-trail-api-classic.md) documentation only if you still need to track Experience events (Engine, Finder) when exporting the audit logs.
{% endhint %}
To query audit logs follow these steps:
1. Identify the required fields from the Audit logs table by accessing the [NQL data model ](/platform/understanding-key-data-platform-concepts/nql-data-model.md)documentation.
2. Determine the required [audit trail codes](/platform/security/exporting-audit-logs/audit-trail-codes.md) to audit the actions of Nexthink users or system.
3. Run the NQL query in any of the query-based features from Nexthink Infinity.
Refer to the [Audit trail codes Infinity ](/platform/security/exporting-audit-logs/audit-trail-codes.md)documentation for audit trail codes that apply to Nexthink Infinity.
### NQL query example with audit trail codes
The NQL query example below uses the `platform.audit_logs` field and the `94011` audit trail code to retrieve all **manual executions of remote actions** taken by Nexthink users in the UI.
{% code title="Code" overflow="wrap" lineNumbers="true" %}
```
platform.audit_logs during past 30d
| where code == 94011
```
{% endcode %}
After running the NQL query example in the [NQL editor](/platform/user-guide/investigations/creating-investigations/nql-editor.md) of an investigation, the investigation results report the following information under the **Message** column:
* `Web request manual execution of remote action`
* `source= source where remote action is triggered`
* `ID=remote action uid`
* `name=remote action on n devices with uids devices uids`
In the image below you can see the result in the **Message** column in the Nexthink web interface.
{% hint style="info" %}
Refer to the [Roles](/platform/user-guide/administration/account-management/roles.md) documentation to grant the **View audit logs in NQL** permission required for querying audit logs.
{% endhint %}
## Exporting audit logs by third-party integrations
To export audit logs to a third-party system, you have the following integration options:
* [Data exporter for Azure Data Lake](/platform/configuring_nexthink/bringing-data-into-your-nexthink-instance/integrating-nexthink-with-third-party-tools/outbound-connectors/data-exporters/exporter-for-azure-data-lake.md) - recommended option
* Handle up to 1 million records per request.
* [NQL API export](https://docs.nexthink.com/api/nql)
* Handle up to 1 million records per request.
* Avoid consuming more than 24 API calls per day to prevent the system from exhausting the maximum daily limit of 50 requests.
* [Webhooks](/platform/configuring_nexthink/bringing-data-into-your-nexthink-instance/integrating-nexthink-with-third-party-tools/outbound-connectors/webhooks.md)
Audit logs are also available as event triggers for workflows; refer to the [Triggering workflows](/platform/user-guide/workflows/triggering-workflows.md#triggeringworkflows-triggeringaneventworkflow) documentation.
{% hint style="info" %}
Refer to the [Audit trail codes Infinity ](/platform/security/exporting-audit-logs/audit-trail-codes.md)documentation for audit trail codes that apply to Nexthink Infinity.
Refer to the documentation specific to [Audit trail codes Engine (classic)](/platform/security/exporting-audit-logs/audit-trail-codes-engine-classic.md) and [Audit trail codes Portal (classic)](/platform/security/exporting-audit-logs/audit-trail-codes-portal-classic.md), depending on the case.
{% endhint %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.nexthink.com/platform/security/exporting-audit-logs.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
