The Activity Log is PointFive's chronological record of everything that happens to an opportunity or a resource - every user action, every change to the underlying cloud resource, and every system event. It's the single place to go when you need to understand why an opportunity is in the state it's in, or what changed since you last looked.
This article covers what the Activity Log captures, how the different event types are organized, and how to use the log to investigate state changes - particularly the common question of why an opportunity transitioned to "No Longer Detected."
Where to find it
The Activity Log is available on:
Every resource page - showing every change to that resource regardless of which opportunities it backs
Every opportunity page - showing everything that happened to that opportunity and its underlying resource
Filtering the Activity Log
The filtering options differ between the two logs.
Resource Activity Log
Since the Resource Activity Log only contains resource-side events, the filtering surface is different. A Show frequently changed values filter controls whether resource attributes that update often are included in the log. By default these high-churn attributes are hidden to keep the log readable; enable it when you need the full picture.
Opportunity Activity Log
Entries can be filtered by three categories:
User Activity - anything done by a user (status changes, edits, comments, detection configuration changes)
Resource Activity - changes to the underlying cloud resource (configuration, tags, deletions, key attributes change)
System Activity - events emitted by PointFive itself (opportunity lifecycle, automation runs, AI Co-worker runs)
The rest of this article is organized along these three categories.
User Activity
User Activity events are created when someone in your organization takes an action that affects an opportunity - either directly on the opportunity or on a configuration that governs it.
Actions on the opportunity
Status changes - moving an opportunity between Open, Validated, In Progress, Resolved, or Dismissed, including Temporary Dismissals. See Opportunity Status Guide.
Assignments - assigning an opportunity to a user.
Comments - internal notes added by users.
Opportunity edits - overriding PointFive's calculated potential savings, risk, or effort. See Edit PointFive Opportunities.
Ticket links - linking or unlinking Jira / ServiceNow tickets.
Each entry shows who performed the action, when, and what changed.
Detection Configuration Changes
When a user modifies PointFive's detection logic - activating or deactivating a detection, creating or modifying an override, reordering override priorities - those changes appear in the Opportunity Activity Log of any opportunity they could affect.
The change happened outside the opportunity itself, but it can directly explain why the opportunity moved into or out of "No Longer Detected."
Each event documents who made the change, when, and what changed - including the previous and new values.
For details on detections, overrides, and how detection configuration changes are tracked, see Detections Management.
Resource Activity
PointFive captures changes to the cloud resources it monitors during each daily collection cycle.
How it works
During each collection cycle, PointFive compares the current attributes and tags of every resource to their previous state. Whenever a difference is detected - a tag added, a value updated, a configuration modified - the change is automatically recorded in the Activity Log.
These entries appear in both the Resource Activity Log (every change to that resource) and the Opportunity Activity Log (changes to the resource backing each opportunity). Each record displays what changed, along with the previous and new values for easy comparison.
Configuration and tag changes
Resource changes are recorded as either:
Configuration changes - changes to the resource's attributes (e.g.,
lifecycle_ruleson an S3 bucket)Tag changes - additions, removals, or value updates on the resource's tags
Key Attribute changes
Some resource changes are visually distinguished in the Opportunity Activity Log as Key Attribute changes - these are the resource attributes mapped to a detection as most likely to affect whether an opportunity still applies. When investigating "No Longer Detected," Key Attribute changes are one investigation direction to look at.
Resource deletions
When the underlying cloud resource is deleted, a Resource Deleted event is recorded in both the Resource Activity Log and the Opportunity Activity Log. A deleted resource is a common explanation for an opportunity moving to "No Longer Detected," and can also be used as an optional trigger reason in automations.
Example use case: investigating with resource changes
Suppose an opportunity of type "Missing Intelligent Tiering on an S3 Bucket" is no longer detected, and you want to investigate why.
Navigate to the Activity Log on the opportunity page.
Look for entries near the state change date - Key Attribute changes will be visually distinguished.
Review the configuration diff - for example, you may find that the attribute
lifecycle_ruleschanged from empty ([]) to a populated configuration.
This indicates that Intelligent Tiering was configured, resolving the opportunity and explaining why it's no longer detected.
System Activity
System Activity entries are events emitted by PointFive itself - not by users acting on an opportunity, and not by changes to the underlying cloud resource.
Opportunity lifecycle events
PointFive records key moments in an opportunity's lifecycle:
Detected - when an opportunity is first surfaced
No Longer Detected - when the detection engine no longer finds the conditions that produced the opportunity
Re-detected - when an opportunity that was previously No Longer Detected is found again
These events are the anchor points for most investigations - once you see "No Longer Detected" in the log, the entries around it usually explain why.
Automation activity
When an automation runs on an opportunity, the action it takes is recorded in the Activity Log alongside a reference to the automation or workflow that triggered it. This applies to:
Classic Automations - rule-based automations defined under Automations.
AI Co-workers - autonomous workflows that act on opportunities based on natural-language rules. AI Co-worker entries are visually distinguished from Classic Automation entries.
Each entry shows what the automation did (status change, assignment, comment, dismissal, etc.) and links back to the automation definition for context.
Investigating "No Longer Detected" opportunities
The most common Activity Log workflow is figuring out why an opportunity moved to "No Longer Detected." A useful order of investigation:
Look for a Resource Deleted event. If the underlying resource was deleted, that very likely explains why the opportunity is no longer detected.
Look for visually distinguished Key Attribute changes near the state change date. These point to a change that likely resolved the opportunity.
Look for Detection Configuration Changes. If a user deactivated a detection, modified a relevant override, or changed override priority, the opportunity may have dropped out of detection scope.
Check other resource changes. Less obvious changes - attribute or tag updates not mapped as Key Attributes - may still be relevant.
Check automation activity. A Classic Automation or AI Co-worker may have already dismissed or resolved the opportunity for reasons captured elsewhere in the log.