View and export Grok Bot audit logs in the dashboard

Enterprise admins review admin, security, and authentication events in the team dashboard audit log, then export CSV or ask Cursor for a SIEM stream. Official guides: Compliance and Monitoring; Grok Bot for teams and enterprises → Admin controls; Grok Bot security → Logging and audit.

Self-serve Teams do not get this log. Audit Logs cover control-plane events. Bot actions stay on Action Recording / OpenTelemetry Export.

Open the audit log

1. Sign in as a team admin on an Enterprise plan.
2. Open the team dashboard audit log (admin access required).
3. Set the date range.
4. Filter Application to Grok Bot when you want Bot-only rows (or leave All applications).
5. Optionally filter by event type and actor.

Grok Bot event labels in the filter include Bot Created, Grok Bot Access Updated, Grok Bot Team Setup, MCP Server Authenticated, Slack Account Link, and Routines.

What is logged

Cursor logs authentication (login/logout), user management, API key create/revoke, team settings, repository management, Cloud Agent environments, directory groups, privacy mode changes, team rules/commands/hooks, Bugbot settings, and Grok Bot control-plane events (Bot creation, access changes, Team Setup manifests, routines). Integrations such as MCP authentication and Slack account links are included.

Cursor does not log agent responses or generated code in this feed. For prompt/code activity metadata, use hooks carefully (prefer metadata over content).

Export CSV

1. Apply the filters you need (date, event type, actor, Application = Grok Bot).
2. Export the filtered results to CSV.
3. Confirm the export includes an Application column so you can keep grok_bot rows distinct offline.

SIEM streaming

For continuous delivery to Splunk, Sumo Logic, Datadog, a webhook, S3, Elasticsearch, or CloudWatch, contact hi@cursor.com and ask for audit-log streaming. Streamed events include application_type (grok_bot or cursor). There is no self-serve SIEM toggle in the dashboard today.

JSON delivery shape (stream / API family):

{
  "metadata": {
    "timestamp": "2024-10-14T18:30:45Z",
    "event_id": "evt_abc123xyz789"
  },
  "team_id": "team_xyz789",
  "ip_address": "203.0.113.42",
  "user_email": "alice@company.com",
  "application_type": "grok_bot",
  "event": { }
}

metadata.event_id identifies one audit event. It does not group related Bot turns — use OpenTelemetry Export for Action Recording joins.

Programmatic pulls

For scripted ingestion without waiting on SIEM setup, use the Admin API how-to: Fetch team audit logs with the Cursor Admin API.

Pitfalls

• Looking for Bot shell commands on the Audit Log page — those never appear there.
• Expecting a self-serve SIEM button — streaming is arranged with hi@cursor.com.
• Filtering only by event type and missing Application = Grok Bot when Bot rows are mixed with editor/admin traffic.