Logging of security events required by EU NIS2 Directives

Great question! The answer depends quite a bit on how your current M‑Files environment is set up. For example, are you running on M‑Files Cloud or a self‑hosted deployment? And what authentication method(s) are you using (M‑Files authentication, Active Directory, Entra ID, or some other OAuth‑based IdP)?

Here are a few key points to consider:

• Successful logins and user/group changes are recorded in the vault event log. Full list of logged events is available via the link.
• Vault event log keeps the latest 10,000 entries by default. If you need full audit history, you can enable Advanced Event Log features in the vault, which requires the Advanced Content Control Module add-on.
• With this add‑on, you can also automatically export logs using the Log Exporter module. This is useful if you want to feed logs into SIEM or other monitoring systems.
• Failed logins and other unauthorized access attempts may be logged by your identity provider (e.g., Entra ID).
• System errors and warnings are typically recorded in the Windows Application log on the server.

Hope this helps! If you need more specific guidance, it may be worth contacting your M‑Files representative.

Great question! The answer depends quite a bit on how your current M‑Files environment is set up. For example, are you running on M‑Files Cloud or a self‑hosted deployment? And what authentication method(s) are you using (M‑Files authentication, Active Directory, Entra ID, or some other OAuth‑based IdP)?

Here are a few key points to consider:

• Successful logins and user/group changes are recorded in the vault event log. Full list of logged events is available via the link.
• Vault event log keeps the latest 10,000 entries by default. If you need full audit history, you can enable Advanced Event Log features in the vault, which requires the Advanced Content Control Module add-on.
• With this add‑on, you can also automatically export logs using the Log Exporter module. This is useful if you want to feed logs into SIEM or other monitoring systems.
• Failed logins and other unauthorized access attempts may be logged by your identity provider (e.g., Entra ID).
• System errors and warnings are typically recorded in the Windows Application log on the server.

Hope this helps! If you need more specific guidance, it may be worth contacting your M‑Files representative.