Skip to main content

Ops Replay

Ops Replay is a complete, chronological timeline of every operation performed on this device — like a DVR for your infrastructure. It answers what happened, when, who did it, and what the result was.

What's recorded​

Every action against the device is logged: commands, scans, restarts, updates, software installs, config snapshots, compliance checks, remediations, and more — each with a timestamp, the user who initiated it, and the outcome.

Working the timeline​

  • Expand an event — click any entry to see the full payload: the command executed, result output, and any error messages. This is your go‑to for post‑incident review and debugging.
  • Filter — narrow by action type (scan, command, restart, …), by severity (info / success / warning / error / critical), or by date range to find exactly what you need.
  • Log Event — manually record an operation into the timeline (e.g. an out‑of‑band change) so the history stays complete.
  • Evidence Pack — export the operation history as an evidence bundle for compliance or incident response. Every operation is tied to a user and immutably logged, giving you a defensible audit trail.
note

Ops Replay is the operations audit (actions taken on the device). It's separate from Remote Sessions Audit, which is the recording/playback of interactive RDP/SSH/VNC sessions. Actions you run via NL Ops or the Sandbox show up here.