Audit Logs

Overview

Audit Logs in DeepIntShield provide complete visibility into security-critical events, user activities, configuration changes, and data access patterns. Enterprise audit logging ensures compliance with regulatory requirements including SOC 2, GDPR, HIPAA, and ISO 27001 through comprehensive, immutable audit trails.

Key Features

Feature	Description
Immutable Logs	Tamper-proof audit trails with cryptographic verification
Request-path Capture	Security-relevant events are recorded as operations run; query/export visibility depends on ingestion and destination latency
Granular Filtering	Query by user, action, resource, or time range
Long-Term Retention	Configurable retention policies for compliance
SIEM Integration	Export to Splunk, Datadog, Elastic, and more
Alert Triggers	Automated alerts on suspicious activities

What Gets Logged

Authentication Events

User login (successful/failed)
User logout
Session creation/expiration
MFA verification
Password changes
Failed authentication attempts
Account lockouts
SSO redirects

Authorization Events

Model access attempts
Provider access checks
Virtual key usage
Budget limit checks
Rate limit violations
Permission denials

Configuration Changes

Virtual key creation/modification/deletion
Team/customer creation/updates
User provisioning/deprovisioning
Budget adjustments
Rate limit changes
Provider key updates
Guardrail configuration changes
SAML/OIDC settings updates

Data Access Events

PII detection and handling
Data export operations
Log access and queries
Sensitive configuration access
API key exposure attempts

Security Events

Prompt injection attempts
Jailbreak attempts
Unusual access patterns
Multiple failed authentication attempts
API key abuse
Rate limit violations
Suspicious IP addresses
Guardrail violations

Configuration

Audit logging is enabled by default and has no settings in the console: the Governance Hub → Audit Trail page has no on/off switch and no signing-key field. Events are recorded in a CADF-compliant format and linked in a SHA-256 hash chain for tamper-evidence.

Querying Audit Logs

Browse, search, and filter audit events from the Search tab of Governance Hub → Audit Trail in the DeepIntShield dashboard. The events table lists the newest events first, reloads when you click Search, and supports the filters below.

Filtering Events

Use the filter bar above the events table to narrow the view:

Filter	What it does
Event Types	Limit to one or more categories - `authentication`, `authorization`, `configuration_change`, `data_access`, or `security_event`.
Range	Restrict to a window (last 24 hours, 7 days, 30 days, or a custom start/end).
Search	Free-text match on the event ID, action, resource, actor user ID, actor email, source IP address, and details.
Resource	Filter by one resource type (e.g. `virtual_key`, `team`, `model_provider`).
Status	Filter by `success`, `failed`, `error`, `denied`, `blocked`, or `warning`.
Severity	Filter by `low`, `medium`, `high`, or `critical`.

Common reviews you can run from these filters:

Authentication activity - set Event Types to authentication and a Range to review logins and MFA events.
Failed access attempts - set Status to failed/blocked and Severity to high to surface denials.
Configuration changes - set Event Types to configuration_change and Resource to virtual_key to audit key changes.
Per-user history - enter the user’s email in Search to see everything a given user did.

The table is sorted newest first and shows each event’s time, type, action, status, severity, actor, resource, and whether its hash verifies (Verified or Pending).

Event Detail

Each event captures the actor, action, status, severity, and a verification hash. In the API and in JSON exports, an event looks like this:

{
  "event_id": "evt_001",
  "timestamp": "2024-01-15T10:30:00.123Z",
  "event_type": "authentication",
  "action": "user_login",
  "status": "failed",
  "severity": "medium",
  "actor": {
    "user_id": "user-alice-001",
    "email": "alice@company.com",
    "ip_address": "203.0.113.42"
  },
  "details": {
    "auth_method": "password",
    "failure_reason": "invalid_password",
    "attempts_count": 3
  },
  "verification": {
    "hash": "sha256:abc123...",
    "verified": true
  }
}

Exporting Audit Events

Audit events can be exported to a file and forwarded to your SIEM or long-term storage. From Governance Hub → Audit Trail:

Open the Export tab. In Export Builder, choose the Audit Types, the Range, and what to Include.
Set the Format - JSON or CSV - and the remaining builder fields, then click Create Export.
The export is generated as a job; once it completes, download the artifact from the Exports list on the same tab.

Verifying Tamper-Evidence

You can confirm at any time that the audit chain has not been altered. On Governance Hub → Audit Trail, click Verify chain - DeepIntShield re-computes the hash chain and reports whether the trail is intact. The Overview tab of the same page shows a summary of audit activity (event counts by type, status, and severity) for the selected period.

Agentic decision chains

Agent authorization decisions are recorded in their own append-only, hash-chained ledger and are verified separately:

curl -sS "https://gateway.example/api/agentic-new/decisions/verify" \
  -H "Authorization: Bearer $SESSION_TOKEN"

A broken chain is a successful verification carrying bad news, not a failed request.