# Audit log
URL: /security/audit-log
Foxborne records every import, view, edit, export and administrative change in an append-only log. Each entry carries the hash of the one before it, so a missing or altered entry breaks the chain.
The audit log answers who did what to which object and when. It lives in an append-only table, streams to your SIEM over syslog with TLS and is never deleted. Admins and auditors open it from **Audit log** in the **Administration** group of the sidebar.
## Columns [#columns]
| Column | What it shows |
| --------- | --------------------------------------------------------------------------------------------- |
| Time, UTC | Day and time, such as `26 Sep 09:44:02` |
| Person | The person's name, or **System** with a bolt icon for automated steps |
| Action | An icon for the action's area, then what happened, such as **Viewed evidence** |
| Object | What it happened to: an incident or run ID, a rule ID, a version, a person or a settings area |
| Detail | The specifics, cut short on screen |
| Entry | The entry number and the first 8 hexadecimal characters of its hash |
The log shows 25 entries a page, newest first, with the page controls under it.
### Area icons [#area-icons]
Each **Action** cell opens with the icon of the area the action belongs to, the same icon that area carries in the sidebar. Hold the pointer over it for the area's name. An action outside these areas carries the **Audit log** icon.
| Area | Icon | Actions, for example |
| ---------------------- | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Evidence | An eye | Viewed evidence, Dismissed finding, Aligned clock by hand, Removed clock alignment |
| Incidents and reports | **Incidents** | Opened incident, Changed status, Edited report, Requested review, Approved report, Commented |
| Reports | **Reports** | Created report, Changed report, Deleted report, Generated report, Downloaded report, Paused report schedule, Resumed report schedule, Exported chart data |
| Exports | A download arrow | Requested export, Approved export, Exported case file, Exported evidence, Exported audit log |
| Audit log | A shield | Verified audit chain |
| Imports | **Import files** | Imported run, Assembled run, Parsed run, Quarantined file, Rejected file, Ran rules again |
| Alert rules | **Alerts** | Created alert rule, Enabled alert rule, Changed alert rule |
| Automations | **Automations** | Created automation, Enabled automation |
| Detection rules | **Rules** | Created rule, Enabled rule, Changed rule |
| Sources and collectors | **Sources** | Added source, Paused source, Changed collector policy, Scheduled collector update |
| Vehicles | **Vehicles** | Added vehicle |
| Integrations | **Integrations** | Configured integration, Enabled egress, Sent test delivery, Replayed delivery, Turned on ingest endpoint |
| Access and sign-in | **Access** | Invited user, Changed role, Signed in, Acknowledged notice, Changed SSO settings |
| Settings | **Settings** | Changed settings, Changed marking, Changed retention, Changed ordering bound |
| Hosting | **Hosting** | Scheduled update, Installed update, Backup completed |
| AI models | A spark | Saved parser, Dismissed a rule suggestion, Changed AI settings |
The icon shows the area; the **Evidence**, **Reports**, **Imports** and **Administration** filters below group the same actions more broadly.
## The hash chain [#the-hash-chain]
In the example dataset the newest **Entry** cell reads `#18,247 852d7dc9`: the entry number, then the start of its hash. Hover over the cell to see both full hashes.
```text title="Entry tooltip" caption="Format; each hash is 64 hexadecimal characters"
Entry 18247, sha256:, previous
```
The tooltip prints the entry number without a thousands separator. Hashes appear nowhere else on screen.
## Verify the chain [#verify-the-chain]
Select **Verify chain**. The button reads **Verifying** while Foxborne works. The note above the log reads **Verifying** with the number of entries, then **Recomputing each hash from the entry and the hash before it.**
When every entry matches, the console confirms **Chain intact. Every entry matches.** The green note returns with the new count and time.
```text title="Audit log note" caption="Example dataset"
Chain intact
18,247 entries verified, the latest at 09:44:02 UTC on 26 Sep. Entries also stream to your SIEM over syslog with TLS.
```
The check is itself recorded, as **Verified audit chain** on **Audit log** with a detail such as **18,019 entries intact**. A missing or altered entry breaks the chain, which makes gaps and edits detectable.
## Filter the log [#filter-the-log]
* The segmented control picks a category: **All**, **Evidence**, **Reports**, **Imports** or **Administration**.
* **Filter by person, action or object** matches those fields and the detail text. Type `system` to find automated entries.
* The count reads, for example, **Showing 27 of 18,247**. The second number is the newest entry number.
* The page address keeps both filters, such as `/app/audit?kind=evidence&q=INC-0142`, so a filtered view can be bookmarked.
The category follows the wording of the action. The tables below list every action under the category it files to.
## Actions [#actions]
The **Detail** column shows a value from the example dataset, or the form the detail takes. Words in *italics* change from entry to entry.
### Evidence [#evidence]
| Action | Object | Detail, for example | Recorded by |
| ----------------------- | ----------- | --------------------------------------------------------------------------------------------------------------------------- | ----------------------------- |
| Viewed evidence | `INC-0142` | Kernel killed perception\_node (out of memory) | Anyone who opens the evidence |
| Aligned clock by hand | Incident ID | Offset +11:03:04.916, ±1.04 s, ending **from a suggested pair** when the [AI models](/concepts/ai-models) proposed the pair | Admin or investigator |
| Removed clock alignment | Incident ID | Companion clock | Admin or investigator |
| Dismissed finding | Incident ID | *rule ID*: *reason* | Admin or investigator |
**Viewed evidence** is written each time the evidence inspector or an event page opens, with the event's title as the detail.
### Reports [#reports]
| Action | Object | Detail, for example | Recorded by |
| ----------------------- | ------------------- | ------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------- |
| Opened incident | `INC-0141` | Window 11:06:10 to 11:07:15. An incident opened with **New incident** reads *run ID*, *count* events, such as `R-0930, 1 event` | Admin or investigator |
| Changed status | Incident ID | Open, In review or Closed | Admin or investigator |
| Edited report | `INC-0142` | Finding, revision 4 | Admin or investigator |
| Requested review | `INC-0142` | Reviewer: *name* | Admin or investigator |
| Approved report | Incident ID | Signed off by *name* | The incident's reviewer |
| Commented | `INC-0143` | Question on the lane history | Admin, investigator or reviewer |
| Exported case file | Incident ID | *export ID*, PDF case file with CUI markings, stamped DRAFT, coordinates removed | Admin, investigator, reviewer or auditor |
| Requested export | Incident ID | *export ID*, *formats*, *class* to *destination*. Approver: *name* | The person exporting |
| Exported audit log | Audit log | Hashes included | Admin or auditor |
| Created report | `RP-05` | *name*, *schedule*, such as `Weekly perception reliability, Mondays at 06:00 UTC` | Admin, investigator or reviewer |
| Changed report | Report ID | *name*, *schedule* | Admin, investigator or reviewer |
| Deleted report | Report ID | *name* | Admin, investigator or reviewer |
| Generated report | `RPT-0017` | *name*, *start* to *end*, such as `Weekly fleet reliability, 14 Sep to 20 Sep` | The person who selected **Generate now** |
| Downloaded report | Generated report ID | *file name*, sha256 *first 16 hex digits* | Anyone who downloads it |
| Paused report schedule | Report ID | *name*, *schedule* | Admin, investigator or reviewer |
| Resumed report schedule | Report ID | *name*, *schedule* | Admin, investigator or reviewer |
| Exported chart data | Reports | *chart*, *range*, *vehicles*, such as `Rule results by rule, 27 Aug, 09:45 to 26 Sep, 09:45 UTC, All vehicles` | Anyone who selects **CSV** |
**Edited report** also carries details such as **Sequence, added** *event ID* and **Resolved a question**. **Exported case file** is written when the PDF case file is exported with no approval needed. Its detail adds ", stamped DRAFT" and ", coordinates removed" only when they apply.
**Requested export** is written when an export needs approval. Its detail names both approvers, as "Approvers:", when the export leaves the enclave. [Export formats and evidence bundles](/integrate/exports) sets out when each applies.
When the Generic webhook (HMAC) has egress on, **Changed status** also sends a `case.status_changed` event. When Jira Data Center has egress on and the incident has an issue, it also comments on that issue.
### Imports [#imports]
| Action | Object | Detail, for example | Recorded by |
| -------------------- | ------------- | -------------------------------------------------------------------------------------------- | ----------------------- |
| Imported run | `R-0935` | 3 files from the fleet log archive | Admin or investigator |
| Assembled run | `R-0934` | 3 files from 3 sources | System |
| Parsed run | Run ID | *count* files, rules produced *count* findings | System |
| Quarantined file | `R-0933` | Truncated inside a data message | System |
| Rejected file | `R-0932` | Encrypted log | System |
| Saved parser | *format name* | *columns*, *clock*, from *file*, such as `7 columns, own clock, from mesh0-radio-status.csv` | Admin |
| Ran rules again | Run ID | *count* rules, same versions | The person who ran them |
| Changed import limit | Settings | 1 GB | Admin |
A run imported by hand reads, for example, **1 file, manual upload**.
### Administration [#administration]
**Sources and collectors**
| Action | Object | Detail, for example | Recorded by |
| -------------------------- | -------------------- | -------------------------------- | ----------- |
| Added source | *source name* | Amazon S3, read-only test passed | Admin |
| Edited source | *source name* | Connection settings | Admin |
| Synced source | *source name* | Manual sync | Admin |
| Paused source | Legacy journal share | Share migration | Admin |
| Resumed source | *source name* | No detail | Admin |
| Changed collector policy | All vehicles | Units, processes and redaction | Admin |
| Added vehicle | `UAS-11` | Q4 recon quad, system ID 27 | Admin |
| Scheduled collector update | `UAS-07` | 0.7.3 to 0.8.1 | Admin |
**Rules**
| Action | Object | Detail, for example | Recorded by |
| --------------------------- | --------------------- | ---------------------------------------------------------------------------------------------------------------------- | ----------- |
| Created rule | `low_pack_voltage` | Version 1.0: Below 21.0 V for 2 s. A rule created from a suggestion reads `Version 1.0, from a suggestion on INC-0143` | Admin |
| Dismissed a rule suggestion | `usb_after_vibration` | *name*, from *incident* | Admin |
| Changed AI settings | Settings | `Models on`, `Models off`, or the features turned on or off | Admin |
| Enabled rule | `battery_sag` | Version 0.9 | Admin |
| Disabled rule | *rule ID* | Version *version* | Admin |
| Changed rule | `memory_pressure` | Override for T4 vehicles: 24,576 MiB, version 1.1 | Admin |
**Hosting**
| Action | Object | Detail, for example | Recorded by |
| ---------------- | ------------ | ------------------------------- | ----------- |
| Scheduled update | `1.4.3` | Signature and SBOM verified | Admin |
| Installed update | `1.4.2` | Signature verified, SBOM stored | Admin |
| Backup completed | Backup vault | Snapshot of 18.4 GB, verified | System |
**Access and sign-in**
| Action | Object | Detail, for example | Recorded by |
| ---------------------- | ------------- | ----------------------------------- | ------------------------- |
| Acknowledged notice | Sign-in | System use notice | Everyone, at each sign-in |
| Signed in | Local account | Break-glass admin with hardware key | The break-glass account |
| Invited user | *work email* | Investigator | Admin |
| Changed role | *name* | Reviewer | Admin |
| Removed user | *name* | Access revoked | Admin |
| Synced users | SCIM | 9 users, 5 groups, no changes | System |
| Changed SSO settings | Access | Metadata refreshed | Admin |
| Changed session policy | Access | 30 minutes idle, 12 hours max | Admin |
**Audit log and settings**
| Action | Object | Detail, for example | Recorded by |
| ---------------------- | ----------------- | ------------------------------ | ---------------- |
| Verified audit chain | Audit log | 18,019 entries intact | Admin or auditor |
| Changed settings | Organization | Name | Admin |
| Changed settings | System use notice | Text updated | Admin |
| Changed marking | Settings | Banner shown | Admin |
| Changed marking | Settings | CUI, EXPT | Admin |
| Changed retention | Settings | 2 years after import | Admin |
| Changed redaction | Settings | Coordinates on export: removed | Admin |
| Changed redaction | Settings | 4 patterns | Admin |
| Changed ordering bound | Settings | 1.0 s | Admin |
**Integrations**
| Action | Object | Detail, for example | Recorded by |
| -------------------------- | --------------------------------------------- | -------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------- |
| Configured integration | *destination*, such as Mattermost | *first host*, *protocol*, *class*: `chat.hfr.internal:443, Incoming webhook, HTTPS POST, L0` | The person who saves the settings |
| Sent test delivery | *destination* | Delivered to *host*, *response*, or Failed to reach *host*, *response* | The person who sends the test |
| Enabled egress | *destination*, such as Splunk HEC | `L1 to splunk-hec.hfr.internal:8088`, plus ", confirmed by" the admin when another admin confirmed | An admin, or the person at the keyboard with an admin confirming |
| Disabled egress | *destination* | Stopped deliveries to *host* | The person who turns it off |
| Turned on ingest endpoint | *endpoint*, such as journald receiver | Listening on HTTPS 19532 | Admin |
| Turned off ingest endpoint | *endpoint* | No longer listening | Admin |
| Replayed delivery | *destination*, such as Generic webhook (HMAC) | *delivery*, delivered on attempt *number*: `run.closed_out, R-0934, delivered on attempt 6` | The person who replays it |
**Alerts and automations**
| Action | Object | Detail, for example | Recorded by |
| ------------------- | --------------- | ------------------------------------------------------------ | ------------------------------ |
| Created alert rule | `R7` | Low pack voltage in flight, Medium | The person who creates it |
| Enabled alert rule | `R1` | Vibration above threshold (tracked-UGV profile), version 1.0 | The person who switches it on |
| Disabled alert rule | *rule ID* | *rule name*, version *version* | The person who switches it off |
| Changed alert rule | `R1` | Version 1.1: condition, severity and routing, destinations | The person who saves the edit |
| Created automation | `A5` | Jamming report to range safety | The person who creates it |
| Enabled automation | `A1` | Sortie closeout triage | The person who switches it on |
| Disabled automation | *automation ID* | *automation name* | The person who switches it off |
**Changed alert rule** lists only the parts that changed. With every part changed, it reads `condition, severity and routing, destinations`. In the example dataset, one admin configured and tested each destination, and a second admin turned on its egress.
## Export the audit log [#export-the-audit-log]
Select **Export**. The **Export the audit log** dialog notes **The export includes each entry’s hash and the hash before it, so it can be verified offline.**
| Field | Choices |
| ---------- | --------------------------------------------------- |
| **Format** | **JSON Lines**, the default, or **CSV** |
| **Range** | **Last 7 days**, **Last 30 days** or **Everything** |
Select **Export**. The console confirms **Audit log exported with hashes**, and the export is itself recorded as **Exported audit log** with the detail **Hashes included**.
Each exported entry carries its own hash and the one before it. A reviewer holding the file can check the chain away from the deployment.
## Stream to your SIEM [#stream-to-your-siem]
When the Syslog over TLS destination has egress on, Foxborne forwards each entry as it is written, one syslog message per entry. Each message carries the entry's marking, number, time, person, action, object and detail, with its `hash` and the `prev` hash before it.
The **Hosting** page lists the stream under **Outbound connections** as **Your SIEM**, for example "Audit log and delivery ledger, syslog over TLS to logs.soc.hfr.internal:6514. Data class L1." The **Delivery ledger** tab of **Integrations** lists each forwarded entry under **Audit stream**, such as **Audit entry 18,247, Viewed evidence**.
[Forward logs to your SIEM](/integrate/siem) covers the setup and the message format.
## Storage and retention [#storage-and-retention]
| Property | Value |
| ---------- | --------------------------------------------------------- |
| Where | An append-only table in PostgreSQL, streamed to your SIEM |
| Encryption | Your customer-managed key |
| Retention | Never deleted |
| Readers | Admins and auditors |
## Related [#related]
* [Roles and permissions](/security/roles) shows who holds **Read the audit log**.
* [Encryption and keys](/security/keys) covers the key that encrypts the log.
* [Security model](/security) places the log among the other controls.