Several releases ago we released the S3/Athena powered "advanced audit log" with support for more sophisticated queries, but our audit log page in the web UI has remained unchanged. The most common gotcha is that the search bar is more of a client side filter - it only searches what is shown on the first page and does not do a server-side search.

This issue tracks a number of improvements that we seek to make when updating the UI to take advantage of the advanced audit log.

• Enrich the audit logs by linking through to relevant resources #14144
• View all sessions started in the context of an access request #29533
• Audit log UI search does not search entire time range. #33672
• Searching the audit log for an access request's UUID should show all events where it was assumed #43282

Somewhat related:

• Optimize the session recordings page: Advanced audit event filtering #7724 and Tie session recordings to session.upload event rather than session.end event #11599