# Split Verkada audit investigations into complete query windows

> Preserve query boundaries and filters when assembling an audit investigation longer than one interface window.

- Canonical URL: https://update.dsesecurity.com/updates/split-verkada-audit-investigations-into-complete-query-windows/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-15T13:31:39+00:00
- Modified: 2026-10-15T13:36:14+00:00
- Last reviewed by DSE: 2026-10-15
- Resource type: Guide
- DSE priority: Information
- Topics: Video Surveillance
- Reading time: 2 minutes

## What you need to know

Preserve query boundaries and filters when assembling an audit investigation longer than one interface window.

## Potentially affected

Applies to the Verkada Command organization audit interface. A maximum query window is not a statement that only that much history exists or that every conceivable activity is logged.

## DSE recommendation

DSE recommends dividing a longer investigation into explicit adjacent windows and preserving the filter definition with each export.

## Article

Preserve query boundaries and filters when assembling an audit investigation longer than one interface window.

## Source facts

Verkada audit logs record Command user and device activity at organization and individual-camera levels. Events include an action timestamp and information about the actor, target, and originating address or device. Filters support time range, actor, event category, target, device type, and serial number. The documented interface queries up to 90 days at once. Org Admins can inspect the organization audit log, export CSV results, and create scheduled reports from selected filters.

Source: [Verkada Help — Audit Logs](https://help.verkada.com/command/organization-settings/manage-your-admin-page-settings/manage-and-view-audit-logs).

## Applicability

Applies to the Verkada Command organization audit interface. A maximum query window is not a statement that only that much history exists or that every conceivable activity is logged.

## DSE recommendation

DSE recommends dividing a longer investigation into explicit adjacent windows and preserving the filter definition with each export. Define whether the review concerns logins, footage viewing, support activity, or configuration changes before selecting event categories. Keep actor and target identities intact when combining files, and reconcile boundary timestamps to prevent omissions or double counting. Schedule recurring exports only to approved recipients with a clear evidence-storage location and retention owner.

## Verification

Run a small known activity through the chosen filters and confirm that the resulting event is present. For a multi-window review, compare earliest and latest timestamps in every export against the requested coverage. Record any absent categories or inaccessible periods as limitations rather than reporting a complete audit.

## Official reference

[Verkada Help — Audit Logs](https://help.verkada.com/command/organization-settings/manage-your-admin-page-settings/manage-and-view-audit-logs). Reviewed October 15, 2026.

## Primary reference

- Name: Verkada Help — Audit Logs
- Authority: help.verkada.com
- URL: https://help.verkada.com/command/organization-settings/manage-your-admin-page-settings/manage-and-view-audit-logs
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Split Verkada audit investigations into complete query windows,” DSE Security, https://update.dsesecurity.com/updates/split-verkada-audit-investigations-into-complete-query-windows/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.