Sucuri Security records audit events, last logins, and file integrity findings in its own flat-file datastore inside wp-content/uploads/sucuri/. The decision to keep logs out of the WordPress database is deliberate: a database compromise should not also compromise the audit trail. The trade-off is that the default admin presents Audit Logs, Last Logins, and Integrity tools on separate screens with limited cross-filtering and exports that effectively require copy-paste.

SleekView reads from the same datastore the Sucuri admin reads. One row per event shows time, user, IP, event type, detail, and severity. Sort the full event stream by IP to spot a single source touching multiple users, filter to file changes plus failed logins from the last hour during an incident, or save a view called Critical events this week for the security review meeting. None of this changes how Sucuri stores its data: the flat files remain authoritative.

The integration is read-only against Sucuri's datastore, so log integrity stays exactly where Sucuri promised it would. WAF logs continue to require a Sucuri WAF API key, the same way they do in the Sucuri admin. Saved views with per-role scoping let a developer or junior admin work an audit queue without access to the rest of the Sucuri toolset, and CSV exports of any filtered view make compliance write-ups straightforward.

Sucuri's choice to keep logs outside the database is a security feature, not an oversight. If a vulnerability lets an attacker write to your tables, you still want the audit log to be intact. The downside is that flat-file storage usually means a basic UI: a chronological scroll with a few filters, exports that come down to manual scraping, and no way to ask the kind of cross-cutting question that matters during an actual investigation.

Most teams either spin up a separate log analysis tool or accept that the Sucuri admin is for browsing, not for querying. SleekView sits on top of the existing datastore and gives the audit log a working table without changing Sucuri's storage model. The flat files remain authoritative, the integrity story stays exactly as Sucuri designed it, and people who actually do security work get to read events the way they think about them: filtered by severity, sorted by user, scoped to the time around an incident, exportable for the compliance write-up.

The plugin keeps doing what it does well; SleekView fills in the missing query layer.