{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/split-verkada-audit-investigations-into-complete-query-windows/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/split-verkada-audit-investigations-into-complete-query-windows/",
        "slug": "split-verkada-audit-investigations-into-complete-query-windows",
        "url": "https://update.dsesecurity.com/updates/split-verkada-audit-investigations-into-complete-query-windows/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/split-verkada-audit-investigations-into-complete-query-windows.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/split-verkada-audit-investigations-into-complete-query-windows/"
        },
        "title": "Split Verkada audit investigations into complete query windows",
        "summary": "Preserve query boundaries and filters when assembling an audit investigation longer than one interface window.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "managed-it",
            "label": "Managed IT operations",
            "alt": "A controlled technology lifecycle progressing from assessment to approved production.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "video-surveillance",
                "name": "Video Surveillance",
                "url": "https://update.dsesecurity.com/topic/video-surveillance/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-15T13:31:39+00:00",
        "modified_at": "2026-10-15T13:36:14+00:00",
        "reviewed_on": "2026-10-15",
        "reading_minutes": 2,
        "word_count": 250,
        "potentially_affected": "Applies to the Verkada Command organization audit interface. A maximum query window is not a statement that only that much history exists or that every conceivable activity is logged.",
        "dse_recommendation": "DSE recommends dividing a longer investigation into explicit adjacent windows and preserving the filter definition with each export.",
        "primary_source": {
            "name": "Verkada Help — Audit Logs",
            "url": "https://help.verkada.com/command/organization-settings/manage-your-admin-page-settings/manage-and-view-audit-logs",
            "published_on": null,
            "authority": "help.verkada.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>Preserve query boundaries and filters when assembling an audit investigation longer than one interface window.</p>\n<h2>Source facts</h2>\n<p>Verkada audit logs record Command user and device activity at organization and individual-camera levels. Events include an action timestamp and information about the actor, target, and originating address or device. Filters support time range, actor, event category, target, device type, and serial number. The documented interface queries up to 90 days at once. Org Admins can inspect the organization audit log, export CSV results, and create scheduled reports from selected filters.</p>\n<p>Source: <a href=\"https://help.verkada.com/command/organization-settings/manage-your-admin-page-settings/manage-and-view-audit-logs\">Verkada Help — Audit Logs</a>.</p>\n<h2>Applicability</h2>\n<p>Applies to the Verkada Command organization audit interface. A maximum query window is not a statement that only that much history exists or that every conceivable activity is logged.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends dividing a longer investigation into explicit adjacent windows and preserving the filter definition with each export. Define whether the review concerns logins, footage viewing, support activity, or configuration changes before selecting event categories. Keep actor and target identities intact when combining files, and reconcile boundary timestamps to prevent omissions or double counting. Schedule recurring exports only to approved recipients with a clear evidence-storage location and retention owner.</p>\n<h2>Verification</h2>\n<p>Run a small known activity through the chosen filters and confirm that the resulting event is present. For a multi-window review, compare earliest and latest timestamps in every export against the requested coverage. Record any absent categories or inaccessible periods as limitations rather than reporting a complete audit.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://help.verkada.com/command/organization-settings/manage-your-admin-page-settings/manage-and-view-audit-logs\">Verkada Help — Audit Logs</a>. Reviewed October 15, 2026.</p>",
        "content_text": "Preserve query boundaries and filters when assembling an audit investigation longer than one interface window.\nSource facts\nVerkada audit logs record Command user and device activity at organization and individual-camera levels. Events include an action timestamp and information about the actor, target, and originating address or device. Filters support time range, actor, event category, target, device type, and serial number. The documented interface queries up to 90 days at once. Org Admins can inspect the organization audit log, export CSV results, and create scheduled reports from selected filters.\nSource: Verkada Help — Audit Logs.\nApplicability\nApplies to the Verkada Command organization audit interface. A maximum query window is not a statement that only that much history exists or that every conceivable activity is logged.\nDSE recommendation\nDSE recommends dividing a longer investigation into explicit adjacent windows and preserving the filter definition with each export. Define whether the review concerns logins, footage viewing, support activity, or configuration changes before selecting event categories. Keep actor and target identities intact when combining files, and reconcile boundary timestamps to prevent omissions or double counting. Schedule recurring exports only to approved recipients with a clear evidence-storage location and retention owner.\nVerification\nRun a small known activity through the chosen filters and confirm that the resulting event is present. For a multi-window review, compare earliest and latest timestamps in every export against the requested coverage. Record any absent categories or inaccessible periods as limitations rather than reporting a complete audit.\nOfficial reference\nVerkada Help — Audit Logs. Reviewed October 15, 2026.",
        "content_markdown": "Preserve query boundaries and filters when assembling an audit investigation longer than one interface window.\n\n## Source facts\n\nVerkada audit logs record Command user and device activity at organization and individual-camera levels. Events include an action timestamp and information about the actor, target, and originating address or device. Filters support time range, actor, event category, target, device type, and serial number. The documented interface queries up to 90 days at once. Org Admins can inspect the organization audit log, export CSV results, and create scheduled reports from selected filters.\n\nSource: [Verkada Help — Audit Logs](https://help.verkada.com/command/organization-settings/manage-your-admin-page-settings/manage-and-view-audit-logs).\n\n## Applicability\n\nApplies to the Verkada Command organization audit interface. A maximum query window is not a statement that only that much history exists or that every conceivable activity is logged.\n\n## DSE recommendation\n\nDSE recommends dividing a longer investigation into explicit adjacent windows and preserving the filter definition with each export. Define whether the review concerns logins, footage viewing, support activity, or configuration changes before selecting event categories. Keep actor and target identities intact when combining files, and reconcile boundary timestamps to prevent omissions or double counting. Schedule recurring exports only to approved recipients with a clear evidence-storage location and retention owner.\n\n## Verification\n\nRun a small known activity through the chosen filters and confirm that the resulting event is present. For a multi-window review, compare earliest and latest timestamps in every export against the requested coverage. Record any absent categories or inaccessible periods as limitations rather than reporting a complete audit.\n\n## Official reference\n\n[Verkada Help — Audit Logs](https://help.verkada.com/command/organization-settings/manage-your-admin-page-settings/manage-and-view-audit-logs). Reviewed October 15, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/split-verkada-audit-investigations-into-complete-query-windows/",
                "url": "https://update.dsesecurity.com/updates/split-verkada-audit-investigations-into-complete-query-windows/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-15"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/split-verkada-audit-investigations-into-complete-query-windows/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Split Verkada audit investigations into complete query windows",
                        "item": "https://update.dsesecurity.com/updates/split-verkada-audit-investigations-into-complete-query-windows/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/split-verkada-audit-investigations-into-complete-query-windows/#article",
                "identifier": "https://update.dsesecurity.com/updates/split-verkada-audit-investigations-into-complete-query-windows/",
                "url": "https://update.dsesecurity.com/updates/split-verkada-audit-investigations-into-complete-query-windows/",
                "headline": "Split Verkada audit investigations into complete query windows",
                "description": "Preserve query boundaries and filters when assembling an audit investigation longer than one interface window.",
                "abstract": "Preserve query boundaries and filters when assembling an audit investigation longer than one interface window.",
                "articleBody": "Preserve query boundaries and filters when assembling an audit investigation longer than one interface window.\nSource facts\nVerkada audit logs record Command user and device activity at organization and individual-camera levels. Events include an action timestamp and information about the actor, target, and originating address or device. Filters support time range, actor, event category, target, device type, and serial number. The documented interface queries up to 90 days at once. Org Admins can inspect the organization audit log, export CSV results, and create scheduled reports from selected filters.\nSource: Verkada Help — Audit Logs.\nApplicability\nApplies to the Verkada Command organization audit interface. A maximum query window is not a statement that only that much history exists or that every conceivable activity is logged.\nDSE recommendation\nDSE recommends dividing a longer investigation into explicit adjacent windows and preserving the filter definition with each export. Define whether the review concerns logins, footage viewing, support activity, or configuration changes before selecting event categories. Keep actor and target identities intact when combining files, and reconcile boundary timestamps to prevent omissions or double counting. Schedule recurring exports only to approved recipients with a clear evidence-storage location and retention owner.\nVerification\nRun a small known activity through the chosen filters and confirm that the resulting event is present. For a multi-window review, compare earliest and latest timestamps in every export against the requested coverage. Record any absent categories or inaccessible periods as limitations rather than reporting a complete audit.\nOfficial reference\nVerkada Help — Audit Logs. Reviewed October 15, 2026.",
                "datePublished": "2026-10-15T13:31:39+00:00",
                "dateModified": "2026-10-15T13:36:14+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/split-verkada-audit-investigations-into-complete-query-windows/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/split-verkada-audit-investigations-into-complete-query-windows/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Split Verkada audit investigations into complete query windows"
                },
                "articleSection": [
                    "Video Surveillance"
                ],
                "keywords": [
                    "Video Surveillance",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Video Surveillance",
                        "url": "https://update.dsesecurity.com/topic/video-surveillance/"
                    }
                ],
                "wordCount": 250,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Verkada Help — Audit Logs",
                    "url": "https://help.verkada.com/command/organization-settings/manage-your-admin-page-settings/manage-and-view-audit-logs"
                }
            }
        ]
    }
}