Audit Logs

Overview

Audit logs record security-relevant events in the platform. Use them to track user actions, monitor for suspicious activity, and meet compliance requirements.

Navigation

Menu: System > Audit Logs

Page Layout

Statistics Cards

The top of the page displays two statistics cards:

Controls Card

A separate card contains filtering and action controls:

Audit Log Table

Pagination

• Default page size: 50 items
• Available sizes: 20, 50, 100, 200, 500 items per page
• Shows total count (e.g., “Total 1,234 events”)

Event Types

User Events

Host Events

Credential Events

Scan Events

Hardening Events

Schedule Events

Settings Events

Event Details

Each event includes basic information in the table columns. Click on a row to expand and see additional details.

Expanded Row Details

The Details JSON may contain:

• Old and new values for update events
• Additional parameters
• Error information for failed events

Filtering Events

By Event Type

1. Click the Filter by event type dropdown
2. Select an event type (e.g., “user.login”)
3. The table automatically updates to show only matching events
4. Click the X in the dropdown to clear the filter

Navigation

Use pagination to navigate through events:

• Events are sorted by time (newest first)
• Change page size using the dropdown at bottom
• Click page numbers to navigate

Event Retention

Retention Period

• Default: 90 days
• Configurable in Settings
• Older events are automatically eligible for cleanup

Manual Cleanup

Click Cleanup Old Logs to:

1. Remove events older than retention period
2. Free up database storage
3. A success message shows deleted count and retention days

Security Monitoring

Suspicious Activity Indicators

Monitor for:

• Multiple failed logins from same IP
• Unusual login times (outside business hours)
• Actions from unexpected IP addresses
• Mass deletions (host.deleted, schedule.deleted)
• Configuration changes (setting.updated)
• New user registrations (user.register)

Regular Review

• Review audit logs weekly for normal operations
• Daily review for high-security environments
• Investigate unusual patterns immediately
• Document security incidents

Compliance Use Cases

Access Tracking

Track who accessed what:

• User login history
• Resource modifications
• Configuration changes
• Time and source of access

Change Management

Document changes:

• When changes were made (timestamp)
• Who made them (user_id)
• What was changed (resource_type, resource_id)
• Before/after values (in details JSON)

Incident Investigation

Investigate security incidents:

• Timeline of events (sorted by time)
• User actions (filter by user events)
• Affected resources (resource column)
• Source identification (IP address)

Best Practices

Regular Monitoring

• Review logs daily for critical systems
• Set up SIEM integration for real-time alerts
• Investigate anomalies promptly
• Keep records of investigations

Retention Policy

• Set retention based on compliance requirements
• Export logs before cleanup if needed for legal purposes
• Consider PCI-DSS (1 year), HIPAA (6 years), GDPR (varies) requirements
• Balance storage costs with compliance needs

Access Control

• Limit access to audit logs
• Audit log access should itself be logged
• Protect log integrity
• Consider read-only access for auditors

API Access

Retrieve audit logs programmatically:

GET /api/v1/audit?limit=50&offset=0&event_type=user.login

Parameters:

• limit - Number of events to return
• offset - Pagination offset
• event_type - Filter by event type (optional)

Get statistics:

GET /api/v1/audit/stats

Returns aggregated event counts by type and date.

Troubleshooting

Missing Events

1. Verify event occurred after logging was enabled
2. Check event type filter is not excluding the event
3. Refresh the page
4. Verify the event is within retention period

Too Many Events

1. Use event type filter to narrow down
2. Reduce page size for faster loading
3. Export data for offline analysis
4. Consider shorter retention period

Performance Issues

1. Use smaller page sizes (20-50 items)
2. Apply specific filters
3. Export data and analyze offline
4. Run cleanup to reduce database size

Cleanup Not Working

1. Verify retention period setting
2. Check if there are events to delete
3. Ensure sufficient database permissions
4. Check for database errors in server logs

Related Pages

• Settings - Configure retention period
• Jobs - View hardening job details
• Compliance Scanning - View scan details