The Sucuri Security plugin records two streams locally: the audit logger writes events through the plugin's internal logging API, and wp_sucuriscan_lastlogins stores every successful login with user ID, IP, user agent, and timestamp. The Sucuri Pro WAF and malware scanner run as cloud services; everything you see in the WordPress admin is the local layer.

SleekView focuses on what lives in your database. The audit events stream is exposed as a flat grid with timestamp, user, IP, event type, and message as filterable columns. wp_sucuriscan_lastlogins joins on user ID to wp_users, so each login row carries the display name, role, and registration date alongside the IP and user agent.

Inline annotations let you tag a login as reviewed, archive a noisy event, or flag an entry for follow-up. The cloud WAF and scan dashboards stay on Sucuri's side; SleekView simply makes the local audit and login data first class inside WP Admin.

Sucuri's reputation rests on its cloud services, the WAF and the malware scanner, and they remain Sucuri's side of the picture. The piece that lives inside your WordPress database is the audit log and the last-login record, and that piece tends to be the one operations teams actually need during a triage moment. A failed login burst from one country, a role change shortly afterwards, a plugin activation from the same IP twenty minutes later: those signals all live in the audit stream that Sucuri's logger writes, and they read better as a joined grid than as a paged feed.

wp_sucuriscan_lastlogins adds the session context, because the question 'who was actually logged in when that happened' has a real answer when you join on user ID. Saved views make the next review cheaper because the same filter and column set come back in a click. Inline annotations keep the work attached to the data rather than scattered across chat threads and tickets.

Sucuri already records the trail; a real grid is what makes that trail useful at speed.