> ## Documentation Index > Fetch the complete documentation index at: https://www.ghostwriter.wiki/llms.txt > Use this file to discover all available pages before exploring further. # Interacting with the Operation Log Table > Using the live activity log Once you are on the log entries page, you will be presented with an empty table. The following sections outline how to interact with the table and log entries. There will be times when you will need the log's unique ID. The ID number is displayed in the log header. ### Creating an Entry To manually create an entry, click on the "Create a new entry" button in the action bar or by pressing `CTRL+N`:

You see a new row appear pre-populated with the current UTC timestamps and your username in the *Operator* field. When writing in a rich text field, type `@today` or `@date` followed by a space or punctuation to insert the current UTC date using Ghostwriter's configured date format. Type `@now` or `@time` the same way to insert the current time in UTC, such as `20:14:13 UTC`. ### Modifying an Entry You can modify fields by double-clicking the table row you want to edit or pressing *Enter* while it is selected. A modal form will open:

You can also press *Enter* to submit your changes. Once you submit a change, the edits will sync via WebSockets and be visible to anyone with the log open. ### Linking, Copying, & Deleting Entries

When you select a log entry, the right pane displays the entry's details. This detail pane includes several buttons. | Action | Description | | ------------ | ------------------------------------------------------------------------------------------ | | Edit | Opens the editing modal | | Copy | Creates a copy of the log entry (good for repeated tasks) | | Copy as JSON | Copies the entry's details as JSON (good for quickly passing activity details to a client) | | Link | Copy a deep-link to the log entry to your clipboard | | Delete | Deletes the log entry from the log | ### Managing the Table View The command bar at the top of the page includes several powerful customization features and your connection status indicator. #### Customizing Columns You can customize the left-hand table view using the *Show/Hide Columns* button. Click it to reveal the column options and toggle columns on or off.

#### Sorting Entries You can also sort your log entries. By default, the page sorts log entries in descending order, from the most recent to the oldest. You can sort by any column by clicking it. You can sort by multiple columns by holding *Shift* as a you click. Your table column customizations and sorting will be saved in your browser's local storage, so it will persist between reloads. Reset table sorting by clicking the *Reset Sort* button. #### Filtering Entries You can filter the table using the box on the right. This filter helps you view log entries related to a specific user, host, or command. To use the filter, type in the keyword and press. The filter is applied as you type, so you can keep typing to narrow the results further. Note that text search will include columns you may have hidden and terminal recording content. If you're unsure why the filter returned certain log entries, check the entry's details for content from table-view columns you have hidden or recordings. #### Log Status and Connection The log header includes the WebSocket connection status. Since all entries are created, modified, and deleted using WebSockets, a persistent connection is maintained. If the connection is ever lost, the badge turns red and reports that it is disconnected. When disconnected, you will not be able to create, modify, or delete rows. When an authorized user has sanitized the log, the header also displays a **Sanitized** badge. Select it to see the last sanitization's date and time, requesting user, and selected fields. If an entry has been created or materially edited since that action, the badge indicates that there are new changes and the details explain that the sanitization is no longer current. ### Sanitizing Entries Managers and administrators can select **Sanitize Entries** from the overflow menu in the command bar. Sanitization is a manual, on-demand action; Ghostwriter does not automatically sanitize activity logs. Choose the fields to scrub and confirm the action. Sanitizing entries cannot be reversed. Export or otherwise preserve any information you need before running it. Ghostwriter records each successful sanitization with its date and time, the user who requested it, and the fields selected. The status uses the latest entry update time to help determine whether entry content has changed after the most recent sanitization. Updating tags on a log entry does not flag a sanitized log as needing review. You can safely update tags for reporting purposes after sanitization, if needed. ### Applying Tags to Log Entries Like many objects in Ghostwriter, you can add tags to a log entry to help with filtering and tracking. The log table will change how certain tags appear in the table:

Tags that include: * `att&ck`, `attack`, `mitre`, or `ttp` will appear as red tags (e.g., `ttp:t1549`) * `creds` or `credentials` will appear as yellow tags * `vuln` will appear as green tags (e.g., `vulnerable:DotNetPE`) * `detect` will appear as blue tags (e.g., `detected`) * `objective` will appear as purple tags (e.g., `objective:1`) Additional styles may be added in the future for different tags. The development is open to suggestions. Ghostwriter automatically tags log entries that have multimedia content—e.g., linked evidence files and terminal recordings (more on that below). When you link multimedia files, Ghostwriter will add the `evidence` tag for linked evidence and the `recording` tag for terminal recordings. Ghostwriter will also remove the tags automatically if you remove the file(s). You can use tags to easily find log entries—like those with linked evidence or terminal recordings—by entering the tag into the filter box. ### Muting Log Notifications By default, all new operation logs have notifications enabled. The optional [Operation Log Monitor task](/features/background-tasks) handles notifications. If desired, a user with the `admin` or `manager` role can mute notifications from the hamburger menu in the upper-right corner of the logging page. Notification status is also displayed in the operation logs table:

## Attaching Content to Log Entries Beyond the core log entry fields, Ghostwriter supports attaching additional content to entries to provide more context and documentation. ### Attaching Evidence You can link existing report evidence to a log entry. This allows you to associate relevant information with the specific activity documented in the entry. Evidence is displayed in a dedicated section within the entry details, with direct links to the original evidence. See [Linking Evidence to Log Entries](/features/operation-logs/linking-evidence-to-entries) for detailed instructions. Your project must have an available report before you will be able to upload evidence or link evidence to a log entry. ### Attaching Terminal Recordings You can upload terminal session recordings (Asciinema `.cast` or `.cast.gz` files) to document the exact commands and output from your operational activities. Recordings are stored with the log entry and can be played back directly within the application using the integrated Asciinema player. See [Attaching Terminal Recordings to Log Entries](/features/operation-logs/attaching-terminal-recordings) for detailed instructions.